This campaign uploaded content in English and Urdu that was critical of India’s government in its treatment of Muslims, particularly in the region of Kashmir.


Our findings are similar to findings reported by Facebook.


We received leads from Graphika that supported us in this investigation.


We terminated 123 YouTube channels as part of our investigation into coordinated influence operations linked to Russia.


This campaign uploaded content in Russian that was critical of the protests supporting Alexei Navalny.


We terminated 9 YouTube channels as part of our investigation into coordinated influence operations linked to China.


This campaign uploaded content in Mandarin Chinese that was positive in sentiment about life in Xinjiang, China and was critical of Western allegations of abuses.


We terminated 2 YouTube channels as part of our investigation into coordinated influence operations linked to Moldova.


This campaign uploaded content in Russian that contained a variety of sensational political narratives, including one about an imminent threat to Russia from Ukraine and the U.S.We terminated 989 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China.


These channels mostly uploaded spammy content in Chinese about music, entertainment, and lifestyle.


A very small subset uploaded content in Chinese and English about China’s COVID-19 vaccine efforts and social issues in the U.S. These findings are consistent with our previous reports.


We received leads from FireEye and Graphika that supported us in this investigation.


In January, the Threat Analysis Group documented a hacking campaign, which we were able to attribute to a North Korean government-backed entity, targeting security researchers.


On March 17th, the same actors behind those attacks set up a new website with associated social media profiles for a fake company called “SecuriElite.”


The new website claims the company is an offensive security company located in Turkey that offers pentests, software security assessments and exploits.


Like previous websites we’ve seen set up by this actor, this website has a link to their PGP public key at the bottom of the page.


In January, targeted researchers reported that the PGP key hosted on the attacker’s blog acted as the lure to visit the site where a browser exploit was waiting to be triggered.


The attacker’s latest batch of social media profiles continue the trend of posing as fellow security researchers interested in exploitation and offensive security.


On LinkedIn, we identified two accounts impersonating recruiters for antivirus and security companies.


We have reported all identified social media profiles to the platforms to allow them to take appropriate action.


At this time, we have not observed the new attacker website serve malicious content, but we have added it to Google Safebrowsing as a precaution.


Following our January blog post, security researchers successfully identified these actors using an Internet Explorer 0-day.


Based on their activity, we continue to believe that these actors are dangerous, and likely have more 0-days.


We encourage anyone who discovers a Chrome vulnerability to report that activity through the Chrome Vulnerabilities Rewards Program submission process.


Fake Security Company Website:     LinkedIn Profiles:    Email:    Attacker Owned Domains:        Over the past several months, the Threat Analysis Group has identified an ongoing campaign targeting security researchers working on vulnerability research and development at different companies and organizations.


The actors behind this campaign, which we attribute to a government-backed entity based in North Korea, have employed a number of means to target researchers which we will outline below.


We hope this post will remind those in the security research community that they are targets to government-backed attackers and should remain vigilant when engaging with individuals they have not previously interacted with.


In order to build credibility and connect with security researchers, the actors established a research blog and multiple Twitter profiles to interact with potential targets.


They've used these Twitter profiles for posting links to their blog, posting videos of their claimed exploits and for amplifying and retweeting posts from other accounts that they control.


Their blog contains write-ups and analysis of vulnerabilities that have been publicly disclosed, including “guest” posts from unwitting legitimate security researchers, likely in an attempt to build additional credibility with other security researchers.


While we are unable to verify the authenticity or the working status of all of the exploits that they have posted videos of, in at least one case, the actors have faked the success of their claimed working exploit.


On Jan 14, 2021, the actors shared via Twitter a YouTube video they uploaded that proclaimed to exploit CVE-2021-1647, a recently patched Windows Defender vulnerability.


In the video, they purported to show a successful working exploit that spawns a cmd.exe shell, but a careful review of the video shows the exploit is fake.


Multiple comments on YouTube identified that the video was faked and that there was not a working exploit demonstrated.


After these comments were made, the actors used a second Twitter account (that they control) to retweet the original post and claim that it was “not a fake video.”


The actors have been observed targeting specific security researchers by a novel social engineering method.


After establishing initial communications, the actors would ask the targeted researcher if they wanted to collaborate on vulnerability research together, and then provide the researcher with a Visual Studio Project.


Within the Visual Studio Project would be source code for exploiting the vulnerability, as well as an additional DLL that would be executed through Visual Studio Build Events.


The DLL is custom malware that would immediately begin communicating with actor-controlled C2 domains.


An example of the VS Build Event can be seen in the image below.


In addition to targeting users via social engineering, we have also observed several cases where researchers have been compromised after visiting the actors’ blog.


In each of these cases, the researchers have followed a link on Twitter to a write-up hosted on blog.br0vvnn[.]io, and shortly thereafter, a malicious service was installed on the researcher’s system and an in-memory backdoor would begin beaconing to an actor-owned command and control server.


At the time of these visits, the victim systems were running fully patched and up-to-date Windows 10 and Chrome browser versions.


At this time we’re unable to confirm the mechanism of compromise, but we welcome any information others might have.


Chrome vulnerabilities, including those being exploited in the wild (ITW), are eligible for reward payout under Chrome's Vulnerability Reward Program.


We encourage anyone who discovers a Chrome vulnerability to report that activity via the Chrome VRP submission process.


These actors have used multiple platforms to communicate with potential targets, including Twitter, LinkedIn, Telegram, Discord, Keybase and email.


We are providing a list of known accounts and aliases below.


If you have communicated with any of these accounts or visited the actors’ blog, we suggest you review your systems for the IOCs provided below.


To date, we have only seen these actors targeting Windows systems as a part of this campaign.


If you are concerned that you are being targeted, we recommend that you compartmentalize your research activities using separate physical or virtual machines for general web browsing, interacting with others in the research community, accepting files from third parties and your own security research.


Host IOCs Registry Keys HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\KernelConfig HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverConfig HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SSL Update File Paths C:\Windows\System32\Nwsapagent.sys C:\Windows\System32\helpsvc.sys C:\ProgramData\USOShared\uso.bin C:\ProgramData\VMware\vmnat-update.bin C:\ProgramData\VirtualBox\update.bin


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q4 2020.


It was last updated on January 26, 2021.


We terminated 12 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Russia.


This campaign uploaded content in Russian supporting the Russian military and criticizing U.S. military involvement in Japan.


We received leads from Facebook that supported us in this investigation.


We terminated 2 YouTube channels as part of our investigation into coordinated influence operations linked to Myanmar.


This domestic campaign posted content focused on elections and supporting the Union Solidarity and Development Party, (USDP).


This campaign was consistent with similar findings reported by Facebook.


We terminated 35 YouTube channels as part of our investigation into coordinated influence operations linked to Azerbaijan.


This domestic campaign was linked to the New Azerbaijan Party and posted content supporting the Azerbaijani government and promoting Azerbaijani nationalism.


We terminated 26 YouTube channels and 1 blog as part of our ongoing investigation into coordinated influence operations linked to Russia.


This campaign uploaded content primarily in Russian and included news clips and military videos supporting the Russian government.


We received leads from the FBI that supported us in this investigation.


We terminated 2 YouTube channels as part of our ongoing investigation into a coordinated influence operation linked to Iran.


This campaign uploaded content in Farsi and Arabic that was critical of the Saudi government.


We terminated 10 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Russia.


This campaign uploaded content in Ukrainian about current events in Ukraine and critical of President Zelensky and former Ukrainian President Petro Poroshenko.


We terminated 22 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Indonesia.


This domestic campaign posted content supporting the Indonesian government.


We terminated 2 YouTube channels and 1 blog as part of our ongoing investigation into coordinated influence operations linked to Iran.


This campaign posted content in Arabic about the Syrian civil war and critical of U.S. foreign policy.


We terminated 3 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Iran.


This campaign posted content in English, Hebrew, and Arabic supporting anti-government protests in Israel.


We terminated 9 YouTube channels as part of our investigation into a coordinated influence operation linked to Egypt.


This campaign posted content in Arabic supportive of the Muslim Brotherhood and critical of Israel and Saudi Arabia.


This campaign was consistent with similar findings reported by Facebook.


We terminated 6 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Iran.


This campaign posted content in Farsi and Dari about current events and included some content that misrepresented itself as Turkish and Afghan news outlets.


We terminated 1 YouTube channel as part of our ongoing investigation into coordinated influence operations linked to Myanmar.


This domestic campaign was linked to the Arakan Army and posted content that misrepresented itself as local news.


We terminated 1 YouTube channel and 1 advertising account as part of our ongoing investigation into coordinated influence operations linked to Russia.


This campaign uploaded content in Russian critical of the Ukrainian government.


We terminated 1 blog as part of our investigation into coordinated influence operations linked to Argentina.


The campaign uploaded content in Spanish that was critical of an Ecuadorian member of parliament.


We terminated 5 YouTube channels and 2 blogs as part of our ongoing investigation into coordinated influence operations linked to Russia.


This campaign uploaded content in Arabic about current events in the Middle East and North Africa.


We terminated 3 YouTube channels as part of our investigation into coordinated influence operations linked to France.


This campaign uploaded content in French that was supportive of the French government and critical of the Russian government.


The campaign targeted the Central African Republic and Mali.


We terminated 34 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Myanmar.


This domestic campaign uploaded content about the Myanmar elections, regional conflicts, and current events related to the U.S., China, and Malaysia.


We terminated 3,317 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China.


These channels mostly uploaded spammy content in Chinese about music, entertainment, and cooking.


A very small subset uploaded content in Chinese and English about the U.S. response to COVID-19 and anti-Chinese sentiment in the U.S.


We received leads from Graphika and Fireye that supported us in this investigation.


These findings are consistent with our previous reports in the Q2 and Q3 TAG bulletins.


Major events like elections and COVID-19 present opportunities for threat actors, and Google’s Threat Analysis Group (TAG) is working to thwart these threats and protect our products and the people using them.


As we head into the U.S. election, we wanted to share an update on what we’re seeing and how threat actors are changing their tactics.


In June, we announced that we saw phishing attempts against the personal email accounts of staffers on the Biden and Trump campaigns by Chinese and Iranian APTs (Advanced Persistent Threats) respectively.


We haven’t seen any evidence of such attempts being successful.


The Iranian attacker group (APT35) and the Chinese attacker group (APT31) targeted campaign staffers’ personal emails with credential phishing emails and emails containing tracking links.


As part of our wider tracking of APT31 activity, we've also seen them deploy targeted malware campaigns.


One APT31 campaign was based on emailing links that would ultimately download malware hosted on GitHub.


The malware was a python-based implant using Dropbox for command and control.


It would allow the attacker to upload and download files as well as execute arbitrary commands.


Every malicious piece of this attack was hosted on legitimate services, making it harder for defenders to rely on network signals for detection.


In one example, attackers impersonated McAfee.


The targets would be prompted to install a legitimate version of McAfee anti-virus software from GitHub, while malware was simultaneously silently installed to the system.


When we detect that a user is the target of a government-backed attack, we send them a prominent warning.


In these cases, we also shared our findings with the campaigns and the Federal Bureau of Investigation.


This targeting is consistent with what others have subsequently reported.


Overall, we’ve seen increased attention on the threats posed by APTs in the context of the U.S. election.


U.S government agencies have warned about different threat actors, and we’ve worked closely with those agencies and others in the tech industry to share leads and intelligence about what we’re seeing across the ecosystem.


This has resulted in action on our platforms, as well as others.


Shortly after the U.S. Treasury sanctioned Ukrainian Parliament member Andrii Derkach for attempting to influence the U.S. electoral process, we removed 14 Google accounts that were linked to him.


We’ve been sharing actions against coordinated influence operations in our quarterly TAG bulletin (check out our Q1, Q2 and Q3 updates).


To date, TAG has not identified any significant coordinated influence campaigns targeting, or attempting to influence, U.S. voters on our platforms.


Since last summer, TAG has tracked a large spam network linked to China attempting to run an influence operation, primarily on YouTube.


This network has a presence across multiple platforms, and acts by primarily acquiring or hijacking existing accounts and posting spammy content in Mandarin such as videos of animals, music, food, plants, sports, and games.


A small fraction of these spam channels will then post videos about current events.


Such videos frequently feature clumsy translations and computer-generated voices.


Researchers at Graphika and FireEye have detailed how this network behaves—including its shift from posting content in Mandarin about issues related to Hong Kong and China’s response to COVID-19, to including a small subset of content in English and Mandarin about current events in the U.S. (such as protests around racial justice, the wildfires on the West Coast, and the U.S. response to COVID-19).


As the course of the COVID-19 pandemic evolves, we’ve seen threat actors evolve their tactics as well.


In previous posts, we discussed targeting of health organizations as well as attacker efforts to impersonate the World Health Organization.


This summer, we and others observed threat actors from China, Russia and Iran targeting pharmaceutical companies and researchers involved in vaccine development efforts.


In September, we started to see multiple North Korea groups shifting their targeting towards COVID-19 researchers and pharmaceutical companies, including those based in South Korea.


One campaign used URL shorteners and impersonated the target’s webmail portal in an attempt to harvest email credentials.


In a separate campaign, attackers posed as recruiting professionals to lure targets into downloading malware.


In the threat actor toolkit, different types of attacks are used for different purposes: Phishing campaigns can be used like a scalpel—targeting specific groups or individuals with personalized lures that are more likely to trick them into taking action (like clicking on a malware link), while DDoS attacks are more like a hatchet—disrupting or blocking a site or a service entirely.


While it’s less common to see DDoS attacks rather than phishing or hacking campaigns coming from government-backed threat groups, we’ve seen bigger players increase their capabilities in launching large-scale attacks in recent years.


For example in 2017, our Security Reliability Engineering team measured a record-breaking UDP amplification attack sourced out of several Chinese ISPs (ASNs 4134, 4837, 58453, and 9394), which remains the largest bandwidth attack of which we are aware.


Addressing state-sponsored DDoS attacks requires a coordinated response from the internet community, and we work with others to identify and dismantle infrastructure used to conduct attacks.


Going forward, we’ll also use this blog to report attribution and activity we see in this space from state-backed actors when we can do so with a high degree of confidence and in a way that doesn’t disclose information to malicious actors.


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q3 2020.


It was last updated on October 16, 2020.


We terminated 1 advertising account and 7 YouTube channels as part of our actions against a coordinated influence operation linked to Ecuador.


The campaign was linked to the PR firm Estraterra, and posted content in Spanish about former Ecuador government employees.


These findings are consistent with similar findings reported by Facebook.


We terminated 299 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China.


These channels mostly uploaded spammy content in Chinese about music, entertainment, and lifestyle.


A very small subset uploaded content in Chinese about COVID-19 and current events in Hong Kong.


These findings are consistent with our previous reports in the Q2 TAG bulletin.


We terminated 1,846 YouTube channels and 5 blogs as part of our ongoing investigation into coordinated influence operations linked to China.


A small subset of the channels uploaded content in English about current events in Hong Kong and the U.S. response to COVID-19.


We terminated 8 YouTube channels as part of our actions against a coordinated influence operation linked to Yemen.


This domestic campaign posted content in Arabic in support of the Yemeni government.


This campaign was consistent with similar findings reported by Facebook.


We terminated 4 YouTube channels as part of our actions against a coordinated influence operation.


The campaign was linked to a U.S.-based PR firm, CLS Strategies, and posted content in Spanish about Mexican elections.


We terminated 1,628 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China.


These channels mostly uploaded spammy content in English and Chinese about music, entertainment, and lifestyle.


A small subset of the channels uploaded content in English about current events in the U.S. and the U.S. response to COVID-19.


In January, the Threat Analysis Group documented a hacking campaign, which we were able to attribute to a North Korean government-backed entity, targeting security researchers.


On March 17th, the same actors behind those attacks set up a new website with associated social media profiles for a fake company called “SecuriElite.”


The new website claims the company is an offensive security company located in Turkey that offers pentests, software security assessments and exploits.


Like previous websites we’ve seen set up by this actor, this website has a link to their PGP public key at the bottom of the page.


In January, targeted researchers reported that the PGP key hosted on the attacker’s blog acted as the lure to visit the site where a browser exploit was waiting to be triggered.


The attacker’s latest batch of social media profiles continue the trend of posing as fellow security researchers interested in exploitation and offensive security.


On LinkedIn, we identified two accounts impersonating recruiters for antivirus and security companies.


We have reported all identified social media profiles to the platforms to allow them to take appropriate action.


At this time, we have not observed the new attacker website serve malicious content, but we have added it to Google Safebrowsing as a precaution.


Following our January blog post, security researchers successfully identified these actors using an Internet Explorer 0-day.


Based on their activity, we continue to believe that these actors are dangerous, and likely have more 0-days.


We encourage anyone who discovers a Chrome vulnerability to report that activity through the Chrome Vulnerabilities Rewards Program submission process.


Fake Security Company Website:     LinkedIn Profiles:    Email:    Attacker Owned Domains:        Over the past several months, the Threat Analysis Group has identified an ongoing campaign targeting security researchers working on vulnerability research and development at different companies and organizations.


The actors behind this campaign, which we attribute to a government-backed entity based in North Korea, have employed a number of means to target researchers which we will outline below.


We hope this post will remind those in the security research community that they are targets to government-backed attackers and should remain vigilant when engaging with individuals they have not previously interacted with.


In order to build credibility and connect with security researchers, the actors established a research blog and multiple Twitter profiles to interact with potential targets.


They've used these Twitter profiles for posting links to their blog, posting videos of their claimed exploits and for amplifying and retweeting posts from other accounts that they control.


Their blog contains write-ups and analysis of vulnerabilities that have been publicly disclosed, including “guest” posts from unwitting legitimate security researchers, likely in an attempt to build additional credibility with other security researchers.


While we are unable to verify the authenticity or the working status of all of the exploits that they have posted videos of, in at least one case, the actors have faked the success of their claimed working exploit.


On Jan 14, 2021, the actors shared via Twitter a YouTube video they uploaded that proclaimed to exploit CVE-2021-1647, a recently patched Windows Defender vulnerability.


In the video, they purported to show a successful working exploit that spawns a cmd.exe shell, but a careful review of the video shows the exploit is fake.


Multiple comments on YouTube identified that the video was faked and that there was not a working exploit demonstrated.


After these comments were made, the actors used a second Twitter account (that they control) to retweet the original post and claim that it was “not a fake video.”


The actors have been observed targeting specific security researchers by a novel social engineering method.


After establishing initial communications, the actors would ask the targeted researcher if they wanted to collaborate on vulnerability research together, and then provide the researcher with a Visual Studio Project.


Within the Visual Studio Project would be source code for exploiting the vulnerability, as well as an additional DLL that would be executed through Visual Studio Build Events.


The DLL is custom malware that would immediately begin communicating with actor-controlled C2 domains.


An example of the VS Build Event can be seen in the image below.


In addition to targeting users via social engineering, we have also observed several cases where researchers have been compromised after visiting the actors’ blog.


In each of these cases, the researchers have followed a link on Twitter to a write-up hosted on blog.br0vvnn[.]io, and shortly thereafter, a malicious service was installed on the researcher’s system and an in-memory backdoor would begin beaconing to an actor-owned command and control server.


At the time of these visits, the victim systems were running fully patched and up-to-date Windows 10 and Chrome browser versions.


At this time we’re unable to confirm the mechanism of compromise, but we welcome any information others might have.


Chrome vulnerabilities, including those being exploited in the wild (ITW), are eligible for reward payout under Chrome's Vulnerability Reward Program.


We encourage anyone who discovers a Chrome vulnerability to report that activity via the Chrome VRP submission process.


These actors have used multiple platforms to communicate with potential targets, including Twitter, LinkedIn, Telegram, Discord, Keybase and email.


We are providing a list of known accounts and aliases below.


If you have communicated with any of these accounts or visited the actors’ blog, we suggest you review your systems for the IOCs provided below.


To date, we have only seen these actors targeting Windows systems as a part of this campaign.


If you are concerned that you are being targeted, we recommend that you compartmentalize your research activities using separate physical or virtual machines for general web browsing, interacting with others in the research community, accepting files from third parties and your own security research.


Host IOCs Registry Keys HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\KernelConfig HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverConfig HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SSL Update File Paths C:\Windows\System32\Nwsapagent.sys C:\Windows\System32\helpsvc.sys C:\ProgramData\USOShared\uso.bin C:\ProgramData\VMware\vmnat-update.bin C:\ProgramData\VirtualBox\update.bin


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q4 2020.


It was last updated on January 26, 2021.


We terminated 12 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Russia.


This campaign uploaded content in Russian supporting the Russian military and criticizing U.S. military involvement in Japan.


We received leads from Facebook that supported us in this investigation.


We terminated 2 YouTube channels as part of our investigation into coordinated influence operations linked to Myanmar.


This domestic campaign posted content focused on elections and supporting the Union Solidarity and Development Party, (USDP).


This campaign was consistent with similar findings reported by Facebook.


We terminated 35 YouTube channels as part of our investigation into coordinated influence operations linked to Azerbaijan.


This domestic campaign was linked to the New Azerbaijan Party and posted content supporting the Azerbaijani government and promoting Azerbaijani nationalism.


We terminated 26 YouTube channels and 1 blog as part of our ongoing investigation into coordinated influence operations linked to Russia.


This campaign uploaded content primarily in Russian and included news clips and military videos supporting the Russian government.


We received leads from the FBI that supported us in this investigation.


We terminated 2 YouTube channels as part of our ongoing investigation into a coordinated influence operation linked to Iran.


This campaign uploaded content in Farsi and Arabic that was critical of the Saudi government.


We terminated 10 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Russia.


This campaign uploaded content in Ukrainian about current events in Ukraine and critical of President Zelensky and former Ukrainian President Petro Poroshenko.


We terminated 22 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Indonesia.


This domestic campaign posted content supporting the Indonesian government.


We terminated 2 YouTube channels and 1 blog as part of our ongoing investigation into coordinated influence operations linked to Iran.


This campaign posted content in Arabic about the Syrian civil war and critical of U.S. foreign policy.


We terminated 3 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Iran.


This campaign posted content in English, Hebrew, and Arabic supporting anti-government protests in Israel.


We terminated 9 YouTube channels as part of our investigation into a coordinated influence operation linked to Egypt.


This campaign posted content in Arabic supportive of the Muslim Brotherhood and critical of Israel and Saudi Arabia.


This campaign was consistent with similar findings reported by Facebook.


We terminated 6 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Iran.


This campaign posted content in Farsi and Dari about current events and included some content that misrepresented itself as Turkish and Afghan news outlets.


We terminated 1 YouTube channel as part of our ongoing investigation into coordinated influence operations linked to Myanmar.


This domestic campaign was linked to the Arakan Army and posted content that misrepresented itself as local news.


We terminated 1 YouTube channel and 1 advertising account as part of our ongoing investigation into coordinated influence operations linked to Russia.


This campaign uploaded content in Russian critical of the Ukrainian government.


We terminated 1 blog as part of our investigation into coordinated influence operations linked to Argentina.


The campaign uploaded content in Spanish that was critical of an Ecuadorian member of parliament.


We terminated 5 YouTube channels and 2 blogs as part of our ongoing investigation into coordinated influence operations linked to Russia.


This campaign uploaded content in Arabic about current events in the Middle East and North Africa.


We terminated 3 YouTube channels as part of our investigation into coordinated influence operations linked to France.


This campaign uploaded content in French that was supportive of the French government and critical of the Russian government.


The campaign targeted the Central African Republic and Mali.


We terminated 34 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Myanmar.


This domestic campaign uploaded content about the Myanmar elections, regional conflicts, and current events related to the U.S., China, and Malaysia.


We terminated 3,317 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China.


These channels mostly uploaded spammy content in Chinese about music, entertainment, and cooking.


A very small subset uploaded content in Chinese and English about the U.S. response to COVID-19 and anti-Chinese sentiment in the U.S.


We received leads from Graphika and Fireye that supported us in this investigation.


These findings are consistent with our previous reports in the Q2 and Q3 TAG bulletins.


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q1 2022.


It was last updated on May 12, 2022.


We have also taken extraordinary measures beyond our actions against coordinated influence operations to protect users and stop the spread of misinformation and disinformation about the war in Ukraine online.


Google TAG actively monitors threat actors and the evolution of their tactics and techniques.


We use our research to continuously improve the safety and security of our products and share this intelligence with the community to benefit the internet as a whole.


As announced today, Google has taken action to disrupt the operations of Glupteba, a multi-component botnet targeting Windows computers.


We believe this action will have a significant impact on Glupteba's operations.


However, the operators of Glupteba are likely to attempt to regain control of the botnet using a backup command and control mechanism that uses data encoded on the Bitcoin blockchain.


Glupteba is known to steal user credentials and cookies, mine cryptocurrencies on infected hosts, deploy and operate proxy components targeting Windows systems and IoT devices.


TAG has observed the botnet targeting victims worldwide, including the US, India, Brazil and Southeast Asia.


The Glupteba malware family is primarily distributed through pay per install (PPI) networks and via traffic purchased from traffic distribution systems (TDS).


For a period of time, we observed thousands of instances of malicious Glupteba downloads per day.


The following image shows a webpage mimicking a software crack download which delivers a variant of Glupteba to users instead of the promised software.


While analyzing Glupteba binaries, our team identified a few containing a git repository URL: “git.voltronwork.com”.


This finding sparked an investigation that led us to identify, with high confidence, multiple online services offered by the individuals operating the Glupteba botnet.


These services include selling access to virtual machines loaded with stolen credentials (dont[.]farm), proxy access (awmproxy), and selling credit card numbers (extracard) to be used for other malicious activities such as serving malicious ads and payment fraud on Google Ads.


This past year, TAG has been collaborating with Google’s CyberCrime Investigation Group to disrupt Glupteba activity involving Google services.


We’ve terminated around 63M Google Docs observed to have distributed Glupteba, 1,183 Google Accounts, 908 Cloud Projects, and 870 Google Ads accounts associated with their distribution.


Furthermore, 3.5M users were warned before downloading a malicious file through Google Safe Browsing warnings.


In the last few days, our team partnered with Internet infrastructure providers and hosting providers, including Cloudflare, to disrupt Glupteba’s operation by taking down servers and placing warning interstitial pages in front of the malicious domain names.


During this time, an additional 130 Google accounts associated with this operation were terminated.


Parallel to the analysis, tracking, and technical disruption of this botnet, Google has filed a lawsuit against two individuals believed to be located in Russia for operating the Glupteba Botnet and its various criminal schemes.


Google is alleging violations under the Racketeer Influenced and Corrupt Organizations Act (RICO), the Computer Fraud and Abuse Act, the Electronic Communications Privacy Act, the Lanham Act, and tortious interference of business relationships, and unjust enrichment.


While these actions may not completely stop Glupteba, TAG estimates that combined efforts will materially affect the actor’s ability to conduct future operations.


The command and control (C2) communication for this botnet uses HTTPS to communicate commands and binary updates between the control servers and infected systems.


To add resilience to their infrastructure, the operators have also implemented a backup mechanism using the Bitcoin blockchain.


In the event that the main C2 servers do not respond, the infected systems can retrieve backup domains encrypted in the latest transaction from the following bitcoin wallet addresses:  The following 32 byte AES keys for decryption are hard coded in the binaries:  The blockchain transaction’s OP_RETURN data can be decrypted using AES-256 GCM to provide a backup command and control domain name.


The first 12 bytes of the OP_RETURN contains the IV, the last 16 bytes the GCM tag, while the middle section is the AES-256 GCM encrypted domain


Full details of Glupteba’s network protocol can be found in this report from 2020, the following Python script illustrates how one can decrypt an encrypted domain name:


Recent domains used for command and control:


Recent sha256 hashes of malware samples:


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q4 2021.


It was last updated on February 7, 2022.


To protect our users, TAG routinely hunts for 0-day vulnerabilities exploited in-the-wild.


In late August 2021, TAG discovered watering hole attacks targeting visitors to Hong Kong websites for a media outlet and a prominent pro-democracy labor and political group.


The watering hole served an XNU privilege escalation vulnerability (CVE-2021-30869) unpatched in macOS Catalina, which led to the installation of a previously unreported backdoor.


As is our policy, we quickly reported this 0-day to the vendor (Apple) and a patch was released to protect users from these attacks.


Based on our findings, we believe this threat actor to be a well-resourced group, likely state backed, with access to their own software engineering team based on the quality of the payload code.


In this blog we analyze the technical details of the exploit chain and share IOCs to help teams defend against similar style attacks.


The websites leveraged for the attacks contained two iframes which served exploits from an attacker-controlled server—one for iOS and the other for macOS.


iOS Exploits


The iOS exploit chain used a framework based on Ironsquirrel to encrypt exploits delivered to the victim's browser.


We did not manage to get a complete iOS chain this time, just a partial one where CVE-2019-8506 was used to get code execution in Safari.


macOS Exploits


The macOS exploits did not use the same framework as iOS ones.


The landing page contained a simple HTML page loading two scripts—one for Capstone.js and another for the exploit chain.


The parameter rid is a global counter which records the number of exploitation attempts.


This number was in the 200s when we obtained the exploit chain.


While the javascript starting the exploit chain checks whether visitors were running macOS Mojave (10.14) or Catalina (10.15) before proceeding to run the exploits, we only observed remnants of an exploit when visiting the site with Mojave but received the full non-encrypted exploit chain when browsing the site with Catalina.


The exploit chain combined an RCE in WebKit exploiting CVE-2021-1789 which was patched on Jan 5, 2021 before discovery of this campaign and a 0-day local privilege escalation in XNU (CVE-2021-30869) patched on Sept 23, 2021.


Loading a page with the WebKit RCE on the latest version of Safari (14.1), we learned the RCE was an n-day since it did not successfully trigger the exploit.


To verify this hypothesis, we ran git bisect and determined it was fixed in this commit.


Capstone.js


It was interesting to see the use of Capstone.js, a port of the Capstone disassembly framework, in an exploit chain as Capstone is typically used for binary analysis.


The exploit authors primarily used it to search for the addresses of dlopen and dlsym in memory.


Once the embedded Mach-O is loaded, the dlopen and dlsym addresses found using Capstone.js are used to patch the Mach-O loaded in memory.


With the Capstone.js configured for X86-64 and not ARM, we can also derive the target hardware is Intel-based Macs.


Embedded Mach-O


After the WebKit RCE succeeds, an embedded Mach-O binary is loaded into memory, patched, and run.


Upon analysis, we realized this binary contained code which could escape the Safari sandbox, elevate privileges, and download a second stage from the C2.


Analyzing the Mach-O was reminiscent of a CTF reverse engineering challenge.


It had to be extracted and converted into binary from a Uint32Array.


Then the extracted binary was heavily obfuscated with a relatively tedious encoding mechanism--each string is XOR encoded with a different key.


Fully decoding the Mach-O was necessary to obtain all the strings representing the dynamically loaded functions used in the binary.


There were a lot of strings and decoding them manually would have taken a long time so we wrote a short Python script to make quick work of the obfuscation.


The script parsed the Mach-O at each section where the strings were located, then decoded the strings with their respective XOR keys, and patched the binary with the resulting strings.


Once we had all of the strings decoded, it was time to figure out what capabilities the binary had.


There was code to download a file from a C2 but we did not come across any URL strings in the Mach-O so we checked the javascript and saw there were two arguments passed when the binary is run–the url for the payload and its size


After downloading the payload, it removes the quarantine attribute of the file to bypass Gatekeeper.


It then elevated privileges to install the payload.


day or 0-day?


Before further analyzing how the exploit elevated privileges, we needed to figure out if we were dealing with an N-day or a 0-day vulnerability.


An N-day is a known vulnerability with a publicly available patch.


Threat actors have used N-days shortly after a patch is released to capitalize on the patching delay of their targets.


In contrast, a 0-day is a vulnerability with no available patch which makes it harder to defend against.


Despite the exploit being an executable instead of shellcode, it was not a standalone binary we could run in our virtual environment.


It needed the address of dlopen and dlsym patched after the binary was loaded into memory.


These two functions are used in conjunction to dynamically load a shared object into memory and retrieve the address of a symbol from it.


They are the equivalent of LoadLibrary and GetProcAddress in Windows.


To run the exploit in our virtual environment, we decided to write a loader in Python which did the following:  For our payload, we wrote a simple bash script which runs id and pipes the result to a file in /tmp.


The result of the id command would tell us whether our script was run as a regular user or as root.


Having a loader and a payload ready, we set out to test the exploit on a fresh install of Catalina (10.15) since it was the version in which we were served the full exploit chain.


The exploit worked and ran our bash script as root.


We updated our operating system with the latest patch at the time (2021-004) and tried the exploit again.


It still worked.


We then decided to try it on Big Sur (11.4) where it crashed and gave us the following exception.


The exception indicates that Apple added generic protections in Big Sur which rendered this exploit useless.


Since Apple still supports Catalina and pushes security updates for it, we decided to take a deeper look into this exploit.


Elevating Privileges to Root The Mach-O was calling a lot of undocumented functions as well as XPC calls to mach_msg with a MACH_SEND_SYNC_OVERRIDE flag.


This looked similar to an earlier in-the-wild iOS vulnerability analyzed by Ian Beer of Google Project Zero.


Beer was able to quickly recognize this exploit as a variant of an earlier port type confusion vulnerability he analyzed in the XNU kernel (CVE-2020-27932).


Furthermore, it seems this exact exploit was presented by Pangu Lab in a public talk at zer0con21 in April 2021 and Mobile Security Conference (MOSEC) in July 2021.


In exploiting this port type confusion vulnerability, the exploit authors were able to change the mach port type from IKOT_NAMED_ENTRY to a more privileged port type like IKOT_HOST_SECURITY allowing them to forge their own sec_token and audit_token, and IKOT_HOST_PRIV enabling them to spoof messages to kuncd.  After gaining root, the downloaded payload is loaded and run in the background on the victim's machine via launchtl.


The payload seems to be a product of extensive software engineering.


It uses a publish-subscribe model via a Data Distribution Service (DDS) framework for communicating with the C2.


It also has several components, some of which appear to be configured as modules.


For example, the payload we obtained contained a kernel module for capturing keystrokes.


There are also other functionalities built-in to the components which were not directly accessed from the binaries included in the payload but may be used by additional stages which can be downloaded onto the victim's machine.


Notable features for this backdoor include:  Our team is constantly working to secure our users and keep them safe from targeted attacks like this one.


We continue to collaborate with internal teams like Google Safe Browsing to block domains and IPs used for exploit delivery and industry partners like Apple to mitigate vulnerabilities.


We are appreciative of Apple’s quick response and patching of this critical vulnerability.


For those interested in following our in-the-wild work, we will soon publish details surrounding another, unrelated campaign we discovered using two Chrome 0-days (CVE-2021-37973 and CVE-2021-37976).


That campaign is not connected to the one described in today’s post.


Delivery URLs Javascript Sandbox escape / LPE Backdoor C2 This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q3 2021.


It was last updated on October 29, 2021.


Updated on May 6, 2020, 7:20 Pacific Time with further details regarding directories targeted for encryption.


A new targeted attack has infected several organizations in Taiwan with a new ransomware family, which we have dubbed ColdLock.


This attack is potentially destructive as the ransomware appears to target databases and email servers for encryption.


The information we gathered indicates that this attack started hitting organizations in early May.


Analysis of the malware points to similarities between ColdLock and two previously known ransomware families, specifically Lockergoga, Freezing, and the EDA2 “educational” ransomware kit.


There have been no indications that this attack has hit any other organization outside of those targeted; we do not believe that this family is currently in widespread use.


Trend Micro users are protected from this threat, which we detect as Ransom.MSIL.COLDLOCK.YPAE-A and Ransom.PS1.COLDLOCK.YPAE-A.


The blog post below describes the behavior of this threat, and describes its links to other ransomware threats.


Arrival Vector


We currently do not know the initial arrival vector of this threat into a potential victim’s network.


However, we believe that the attackers somehow gained access to the target organization’s Active Directory servers.


From this point, they were able to set Group Policies that led to the ransomware file being downloaded and run onto machines within the affected domain.


The payload arrives as a .NET executable (as a .DLL file), which has been packed/protected using the ConfuserEx packer.


It uses PowerShell reflective loading of .NET executables to run the said .DLL file:  Figure 1. Reflective loading of the .DLL file


It also contains two checks to verify if it’s running.


Firstly, it checks for the presence of %System Root%\ProgramData\readme.tmp, which is used by the ransom note.


This check prevents a system from being reinfected by the same threat:  Figure 2.


Ransom note check


More unusually, it will check the system clock.


It will only run at or later than 12:10 PM on any given day; if it is earlier, it will sleep for 15 seconds until it is past the said time.


Figure 3.


Time bomb in code Encryption Routines


Before it encrypts any file, the ransomware also performs certain preparatory routines.


Firstly, it terminates several services on the system if they are running to prevent file access violations.


These services are:  mariadb msexchangeis mssql mysql oracleservice  These are service names used by various databases, as well as the Exchange mail server.


It will also terminate the Outlook process.


Figure 4.


Service and process termination


It also checks the Windows version running on the system.


If it is running Windows 10, it carries out several Windows 10-specific routines.


Windows Defender is disabled, as well as the ability to send feedback/malware samples to Microsoft.


Push notifications are disabled as well.


Figure 5. Disabling Windows Defender


The actual encryption routine is slightly unusual.


It will avoid encrypting the following directories:  %System Root%\Program Files %System Root%\Program Files (x86) %System Root%\ProgramData %System Root%\Users\all users %System Root%\Users\default {malware directory} {drive letter}:\System Volume Information {drive letter}:\$Recycle.bin  However, the following directories are exceptions to the above list, and would still be encrypted:  %System Root%\ProgramData\Microsoft\Windows\Start Menu %System Root%\Program Files\Microsoft\Exchange Server %System Root%\Program Files (x86)\Microsoft\Exchange Server Directories under (Program Files, Program Files (x86), and ProgramData) containing any of the following strings: sql mariadb oracle    Whether files in other directories are encrypted depends on a set of three conditions, namely:  Number of files on the target directory is less than 100 Directory’s last write time is newer than January 1, 2018.


Directory name should not contain any of the following strings: .git appdata cache image lib log logs microsoft reference res resource script setup skin temp theme third_party thirdparty    If all of the above conditions are met, it will encrypt all the files in the given directory except those with the following extensions:  .avi .dll .gif .iso .m2ts .mkv .mov .mp3 .msi .ocx .tmp .wmv


In other cases — where some (or all) of the conditions are not met — it will only encrypt files with the following extensions:  .7z .aspx .bak .cpp .csv .doc .docx .gz .hwp .java .jpg .jsp .lnk


.odt


.one


.php .ppt


.pptx .pst .rar .sh .sql .txt .xls .xlsx .xml .zip


Figure 6.


Whitelist/blacklist code


The encryption process uses the AES function in CBC mode.


It generates the needed key and initialization vector (IV) using a salt and secret key; the former is embedded in the code while the latter is generated dynamically using the SHA-256 hash of a randomly generated 32-byte long string.


This is then encrypted using a hard-coded public RSA key and then embedded in the ransom note.


Encrypted files get the .locked extension.


Figure 7.


AES encryption code  Figure 8.


Secret key generation


The ransom note is stored in various locations on the system, namely:  %Desktop%\How To Unlock Files.Txt %System Root%\ProgramData\readme.tmp %User Startup%\How To Unlock Files.Txt {Encrypted Drive}:\How To Unlock Files.


Txt


The contents of this note are similar to other ransomware notes:  Figure 9.


Ransom note


The ransomware then changes the system’s wallpaper for all users; it now contains an instruction to read a text file (the ransom note).


It does this by changing several registry settings.


Figure 10. Modified system wallpaper


Connections to other ransomware families


At first glance, it would seem that this threat is related to Lockergoga, since they share the same extension for encrypted files (.locked).


However, other ransomware families also use this extension, making the connection more tenuous.


A more reasonable link to the Freezing ransomware family exists.


It shares a similar method of propagation within networks (compromised AD servers), reflective injection methods, and internal module architecture.


The code also shares similarities with the open-source EDA2 ransomware kit.


As early as several years ago, ransomware threats spreading in the wild were based on EDA2, which was supposedly only for “recreational” purposes.


Trend Micro solutions Ransomware continues to be a lingering threat, something we mentioned in our last Annual Security Roundup after seeing that the number of ransomware cases we detected climbed from 55 million in 2018 to 61 million in 2019.


Cases like these are more dangerous, as threats that compromise enterprise systems allow for much easier propagation within enterprise networks.


Below are some of the best practices users can do to protect systems from ransomware:  Periodically back up files using the 3-2-1 rule.


The rule entails creating three backups in two different formats and storing one copy offsite.


Regularly patch and update applications, software, and operating systems to address any exploitable vulnerabilities.


For zero-day vulnerabilities, take advantage of virtual patching.


Activate sandbox analysis.


This enables safe monitoring as malicious files can be executed in an isolated environment.


For more robust and proactive defense against ransomware, the following Trend Micro solutions are recommended:


Trend Micro Smart Protection Suites - Applies AI and analytics for earlier detection of threats across endpoints and other layers of the system Trend Micro™ Deep Discovery™– Detects, blocks, and analyzes malicious email attachments through custom sandboxing and other detection techniques   Trend Micro Safe Lock™ TXOne Edition locks down system functionality to allow only authorized applications and services to be run on mission-critical assets.


It has negligible impact on system performance compared to traditional cybersecurity software, which requires an internet connection, periodic updates, and regular malware scans.


It provides control of operational integrity while efficiently reducing the chance of downtime and cost of maintaining resilience.


Indicators of Compromise  SHA-256 hash Detection Name 08677a3dac3609d13dc4a2a6868ee2f6c1334f4579356d162b706a03839bb9ff Ransom.PS1.COLDLOCK.YPAE-A c5108344e8a6da617af1c4a7fd8924a64130b4c86fa0f6d6225bb75534a80a35 Ransom.MSIL.COLDLOCK.YPAE-A   All Trend Micro products using the latest VSAPI pattern (15.849.00 or later) are capable of successful detection of this malware.


Tags  APT & Targeted Attacks | Endpoints | Research | Ransomware | Network


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q1 2022.


It was last updated on May 12, 2022.


We have also taken extraordinary measures beyond our actions against coordinated influence operations to protect users and stop the spread of misinformation and disinformation about the war in Ukraine online.


Google TAG actively monitors threat actors and the evolution of their tactics and techniques.


We use our research to continuously improve the safety and security of our products and share this intelligence with the community to benefit the internet as a whole.


As announced today, Google has taken action to disrupt the operations of Glupteba, a multi-component botnet targeting Windows computers.


We believe this action will have a significant impact on Glupteba's operations.


However, the operators of Glupteba are likely to attempt to regain control of the botnet using a backup command and control mechanism that uses data encoded on the Bitcoin blockchain.


Glupteba is known to steal user credentials and cookies, mine cryptocurrencies on infected hosts, deploy and operate proxy components targeting Windows systems and IoT devices.


TAG has observed the botnet targeting victims worldwide, including the US, India, Brazil and Southeast Asia.


The Glupteba malware family is primarily distributed through pay per install (PPI) networks and via traffic purchased from traffic distribution systems (TDS).


For a period of time, we observed thousands of instances of malicious Glupteba downloads per day.


The following image shows a webpage mimicking a software crack download which delivers a variant of Glupteba to users instead of the promised software.


While analyzing Glupteba binaries, our team identified a few containing a git repository URL: “git.voltronwork.com”.


This finding sparked an investigation that led us to identify, with high confidence, multiple online services offered by the individuals operating the Glupteba botnet.


These services include selling access to virtual machines loaded with stolen credentials (dont[.]farm), proxy access (awmproxy), and selling credit card numbers (extracard) to be used for other malicious activities such as serving malicious ads and payment fraud on Google Ads.


This past year, TAG has been collaborating with Google’s CyberCrime Investigation Group to disrupt Glupteba activity involving Google services.


We’ve terminated around 63M Google Docs observed to have distributed Glupteba, 1,183 Google Accounts, 908 Cloud Projects, and 870 Google Ads accounts associated with their distribution.


Furthermore, 3.5M users were warned before downloading a malicious file through Google Safe Browsing warnings.


In the last few days, our team partnered with Internet infrastructure providers and hosting providers, including Cloudflare, to disrupt Glupteba’s operation by taking down servers and placing warning interstitial pages in front of the malicious domain names.


During this time, an additional 130 Google accounts associated with this operation were terminated.


Parallel to the analysis, tracking, and technical disruption of this botnet, Google has filed a lawsuit against two individuals believed to be located in Russia for operating the Glupteba Botnet and its various criminal schemes.


Google is alleging violations under the Racketeer Influenced and Corrupt Organizations Act (RICO), the Computer Fraud and Abuse Act, the Electronic Communications Privacy Act, the Lanham Act, and tortious interference of business relationships, and unjust enrichment.


While these actions may not completely stop Glupteba, TAG estimates that combined efforts will materially affect the actor’s ability to conduct future operations.


The command and control (C2) communication for this botnet uses HTTPS to communicate commands and binary updates between the control servers and infected systems.


To add resilience to their infrastructure, the operators have also implemented a backup mechanism using the Bitcoin blockchain.


In the event that the main C2 servers do not respond, the infected systems can retrieve backup domains encrypted in the latest transaction from the following bitcoin wallet addresses:  The following 32 byte AES keys for decryption are hard coded in the binaries:  The blockchain transaction’s OP_RETURN data can be decrypted using AES-256 GCM to provide a backup command and control domain name.


The first 12 bytes of the OP_RETURN contains the IV, the last 16 bytes the GCM tag, while the middle section is the AES-256 GCM encrypted domain


Full details of Glupteba’s network protocol can be found in this report from 2020, the following Python script illustrates how one can decrypt an encrypted domain name:


Recent domains used for command and control:


Recent sha256 hashes of malware samples:  This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q4 2021.


It was last updated on February 7, 2022.


Having covered TeamTNT in several of our blog entries over the past couple of years, we embarked on a research that encompasses the malicious actor group’s campaigns, tools, and techniques in 2020 and early 2021.


Although believed to have been active since 2011, TeamTNT stayed under the radar for many years before exploding onto the scene in 2020.


In the past year, the group launched a few preliminary campaigns, including such notable ones as a series of cryptocurrency mining and distributed denial-of-service (DDoS) attacks on Docker Daemon parts, and a campaign where it deployed a DDoS-capable IRC (Internet Relay Chat) bot.


Things ramped up in early 2021, as TeamTNT initiated a number of new campaigns targeting various cloud services and using tools and techniques such as malicious shell scripts and other credential harvesting software to steal cloud credentials.


Probing for and exploiting security weaknesses        Figure 1.


The typical infection chain used by TeamTNT      What makes TeamTNT particularly noteworthy is not only its targets — primarily cloud-based software and services — but also how quickly it has evolved existing techniques and integrated new ones into its campaigns.


Be that as it may, in most of the group’s campaigns, TeamTNT’s method of entry is more or less consistent: It uses a number of tools to scan the internet for potential targets with misconfigurations and vulnerabilities, and takes advantage of these weaknesses to gain a foothold in the systems.


TeamTNT specializes in finding exploitable gaps in security, be they unsecured Redis instances, exposed Docker APIs, vulnerable internet-of-things (IoT) devices, or leaked credentials.


For a victim organization, the group’s payloads, if successfully deployed, could at best be disruptive — as with cryptocurrency miners — and at worst cause heavy monetary loss and even reputational damage — especially if the group manages to exfiltrate credentials and other sensitive information from the organization.


Dealing with misconfigurations and other security concerns TeamTNT has largely been successful because of various exploitable security weaknesses.


While it is admittedly difficult to completely eliminate these, enterprises need to prioritize security as much as they can.


They should implement the most effective strategies for protecting the cloud from external attacks, while also being mindful of which aspects of the shared responsibility model they need to be accountable for.


Here are several best practices that organizations should consider putting into place:  Grant users access only to the parts of the system they need in order to reduce possible entry points and contain damage even in the event of a successful attack.


This is known as the principle of least privilege.


Implement private keys authentication for Secure Shell (SSH) on the client side for stronger access control security.


Regularly patch and update systems and devices to minimize instances of vulnerability exploitation.


For organizations that need time to implement patches, virtual patching can provide buffer time, helping protect their systems from vulnerabilities while updates are still being prepared.  Enterprises should also consider using security solutions such as the Trend Micro Cloud One™ platform, which protects cloud-native systems by securing continuous-integration and continuous-delivery (CI/CD) pipelines and applications.


The platform includes:  Workload Security: runtime protection for workloads Container Security: automated container image and registry scanning File Storage Security: security for cloud files and object storage services Network Security: cloud network layer for intrusion prevention system (IPS) security Application Security: security for serverless functions, APIs, and applications Conformity: real-time security for cloud infrastructure — secure, optimize, comply      Our research paper, titled “Tracking the Activities of TeamTNT: A Closer Look at a Cloud-Focused Malicious Actor Group,” provides an overview of how the group operates, with emphasis on the primary tools, techniques, and payloads it uses in its campaigns.     Tags  Cloud | APT & Targeted Attacks | Research | Articles, News, Reports


We covered the threat actor group TeamTNT in previous entries, noting that they were actively stealing Amazon Web Services (AWS), Docker and Linux Secure Shell (SSH) credentials as well as participating in other activities, including cryptojacking and placing backdoors — such as IRC bots and remote shells — inside Linux devices.


However, the scope of the attack remained unknown.


While investigating the team's activities, we found a binary containing a hardcoded shell script designed to steal AWS credentials, which provided us a lead on the scope of the attack.


Figure 1: IRC bot dropping encoded shell script (detected as Backdoor.Linux.TSUNAMI.USELVBF21)      We begin by examining the dropped script from a new AWS-focused credential stealer.


As the image in Figure 2 shows, after the actor compromises an instance and runs their script, it searches for any credentials deployed via the AWS metadata service, as we previously highlighted.


To gather these credentials, the attacker must perform remote code execution (RCE) on the initial target, which can be accomplished via a number of methods, including abusing the abuse of such as abusing misconfiguration issues or the exploitation of exploiting unpatched vulnerabilities and other security flaws.


An AWS instance, by default, does not have any identity access management (IAM) permissions attached; rather, these permissions must be defined by the AWS administrator.


AWS administrators should follow the principle of least privilege when attaching roles to an AWS instance.


Regardless of whether this search is successful or not, the script creates a file and then uploads it to a remote web server that is set to receive the stolen files.      Figure 2. Malicious shell scripts stealing secrets      Although the script is meant to run on AWS instances, our analysis reveals that it ran on any kind of Linux machine, container, or cloud instance when they are compromised by this actor.


Additionally, it failed to retrieve any useful data most of the times.


The web server where the malware uploads its data was configured (or misconfigured) to be set as open directory, thus allowing access to all the uploaded files — including data on targets to be further compromised, stolen files, and statistics of ongoing attacks.      Figure 3. Open directory with malware, stolen credentials and statistics     Alongside storing the stolen data, the server also serves as a repository for Linux cryptocurrency-mining tools that the group deploys on infected systems, which is part of their objectives.


Figure 4. Other binaries found on the open directory


If the group succeeds in running their malicious script on an AWS instance, the script uploads any credentials that it is able to retrieve from the instance metadata service.


If an AWS administrator has not attached any permissions to these credentials, then they will not grant the attacker any additional access.


AWS administrators can also detect the use of these instance credentials outside of AWS by enabling the UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration finding in Amazon GuardDuty.


Figure 5. Example of a report with stolen secrets     Conclusion and impact


During our research, we noticed over 4,000 infected instances.


While not all of them necessarily ran on AWS instances, the malware that was deployed against them was designed to target AWS users (due to the shell script looking for AWS services metadata that is present only with AWS services).


From the total number, around 5% or approximately 200 of them contained sensitive information on AWS costumers.


Note that AWS instances will not have permissions defined unless the user specifically takes action for such.


Based on the timestamps in the file names, we can assume that the campaign started on February 10, 2021.


In addition, we can also assume that the number of files represents the number of infected machines.


As a result of observing TeamTNT for a while now, we are able to note that they are following IT industry trends and shifting to the cloud as well.


Recommendations and Trend Micro Solutions


Given the increased focus on the cloud by threat actor groups, organizations should take the necessary steps to secure as much of their cloud infrastructure as they can.


Most cloud service providers, including AWS, follow the shared responsibility model for securing the cloud.


Following  this model, the cloud provider is responsible for securing the infrastructure — such as the hardware, software, networking, and facilities —  needed to run the cloud service.


On the other hand, AWS adminstrators are tasked with the responsibility of securing their assets running within the cloud service.


Although the specifics differ depending on the type of cloud service being used, AWS administrators are generally expected to secure their own data, platforms, applications, operating systems, and network configurations, among others.


As mentioned earlier, Team TNT is targeting cloud service providers and is able to compromise AWS instances based on a number of methods.


Hence on the shared responsibility model, the AWS administrator is responsible for securing its instances.


We advise organizations to consider the following security measures:   Patch and update systems regularly to reduce the chance of vulnerability exploitation.


Apply the principle of least privilege, which helps reduce the attack surface and minimizes the damage potential of an attack.


For this specific TeamTNT attack, granting access to security information only to those who need it can prevent the threat actors from leaking the information.


Prioritize the continuous monitoring and auditing of devices, especially if these are used to access the organization’s network.


Use private key authentication when you have SSH enabled inside your instance.


Use strong passwords and always enable multifactor authentication on your cloud account.


Amazon also offers additional recommendations on how to secure AWS resources, as well as services such as Amazon GuardDuty, Amazon Macie, and AWS Security Hub that enhance the existing security of cloud implementations.


Security solutions such as Trend Micro Hybrid Cloud Security can also help in protecting cloud-native systems and their various layers.


By using Trend Micro Cloud One™, enterprises gain access to protection for continuous integration and continuous delivery (CI/CD) pipeline and applications.


The Trend Micro Cloud One platform includes:  Workload Security: runtime protection for workloads Container Security: automated container image and registry scanning File Storage Security: security for cloud file and object storage services


Network Security: cloud network layer IPS security Application Security: security for serverless functions, APIs, and applications Conformity: real-time security for cloud infrastructure — secure, optimize, comply  Indicators of Compromise (IOCs)  SHA-256  Detection  Description  9504b74906cf2c4aba515de463f20c02107a00575658e4637ac838278440d1ae  Backdoor.Linux.TSUNAMI.USELVBF21  IRC bot  3139a85a18e42bf60ba65deb3d691b5c088a0fac2b80a4d05f17a68eac3d4882  TrojanSpy.SH.AWSTEAL.A  Script       Tags  Cloud | APT & Targeted Attacks | Research | Articles, News, Reports


BlackTech is a cyber espionage group operating against targets in East Asia, particularly Taiwan, and occasionally, Japan and Hong Kong.


Based on the mutexes and domain names of some of their C&C servers, BlackTech’s campaigns are likely designed to steal their target’s technology.


Following their activities and evolving tactics and techniques helped us uncover the proverbial red string of fate that connected three seemingly disparate campaigns: PLEAD, Shrouded Crossbow, and of late, Waterbear.


Over the course of their campaigns, we analyzed their modus operandi and dissected their tools of the trade—and uncovered common denominators indicating that PLEAD, Shrouded Crossbow, and Waterbear may actually be operated by the same group.


PLEAD PLEAD is an information theft campaign with a penchant for confidential documents.


Active since 2012, it has so far targeted Taiwanese government agencies and private organizations.


PLEAD’s toolset includes the self-named PLEAD backdoor and the DRIGO exfiltration tool.


PLEAD uses spear-phishing emails to deliver and install their backdoor, either as an attachment or through links to cloud storage services.


Some of the cloud storage accounts used to deliver PLEAD are also used as drop off points for exfiltrated documents stolen by DRIGO.


PLEAD’s installers are disguised as documents using the right-to-left-override (RTLO) technique to obfuscate the malware’s filename.


They are mostly accompanied by decoy documents to further trick users.


We’ve also seen PLEAD use exploits for these vulnerabilities:   CVE-2015-5119, patched by Adobe last July, 2015 CVE-2012-0158, patched by Microsoft last April, 2012 CVE-2014-6352, patched by Microsoft last October, 2014 CVE-2017-0199, patched by Microsoft last April, 2017  PLEAD also dabbled with a short-lived, fileless version of their malware when it obtained an exploit for a Flash vulnerability (CVE-2015-5119) that was leaked during the Hacking Team breach.


Figure 1: How PLEAD utilizes compromised routers PLEAD actors use a router scanner tool to scan for vulnerable routers, after which the attackers will enable the router’s VPN feature then register a machine as virtual server.


This virtual server will be used either as a C&C server or an HTTP server that delivers PLEAD malware to their targets.


PLEAD also uses CVE-2017-7269, a buffer overflow vulnerability Microsoft Internet Information Services (IIS) 6.0 to compromise the victim’s server.


This is another way for them to establish a new C&C or HTTP server.


Figure 2:


One of the methods PLEAD operators use to distribute their malware PLEAD’s backdoor can:  Harvest saved credentials from browsers and email clients like Outlook List drives, processes, open windows, and files Open remote Shell Upload target file Execute applications via ShellExecute API Delete target file  PLEAD also uses the document-targeting exfiltration tool DRIGO, which mainly searches the infected machine for documents.


Each copy of DRIGO contains a refresh token tied to specific Gmail accounts used by the attackers, which are in turn linked to a Google Drive account.


The stolen files are uploaded to these Google Drives, where the attackers can harvest them.


Shrouded Crossbow


This campaign, first observed in 2010, is believed to be operated by a well-funded group given how it appeared to have purchased the source code of the BIFROST backdoor, which the operators enhanced and created other tools from.


Shrouded Crossbow targeted privatized agencies and government contractors as well as enterprises in the consumer electronics, computer, healthcare, and financial industries.


Shrouded Crossbow employs three BIFROST-derived backdoors: BIFROSE, KIVARS, and XBOW.


Like PLEAD, Shrouded Crossbow uses spear-phishing emails with backdoor-laden attachments that utilize the RTLO technique and accompanied by decoy documents.


BIFROSE, known for evading detection by communicating with its C&C servers via Tor protocol, also has a version targeting UNIX-based operating systems, which are usually used in servers, workstations, and mobile devices.


KIVARS has less functionality than BIFROSE, but its modular structure made it easier to maintain.


KIVARS enabled attackers to download and execute files, list drives, uninstall malware service, take screenshots, activate/deactivate keylogger, show/hide active windows, and trigger mouse clicks and keyboard inputs.


A 64-bit version of KIVARS also emerged to keep pace with the popularity of 64-bit systems.


XBOW’s capabilities are derived from BIFROSE and KIVARS; Shrouded Crossbow gets its name from its unique mutex format.


Waterbear Waterbear has actually been operating for a long time.


The campaign’s name is based on its malware’s capability to equip additional functions remotely.


Waterbear similarly employs a modular approach to its malware.


A loader component executable will connect to the C&C server to download the main backdoor and load it in memory.


A later version of this malware appeared and used patched server applications as its loader component, while the main backdoor is either loaded from an encrypted file or downloaded from the C&C server.


The tactic it later adopted required prior knowledge of their targets’ environment.


It’s possible attackers used Waterbear as a secondary payload to help maintain presence after gaining some levels of access into the targets’ systems.


All Roads Lead to BlackTech


Based on the use of the same C&C servers, the campaigns’ coordinated efforts, and similarities in tools, techniques, and objectives, we can conclude that they are operated by the same group.


It is not uncommon, for instance, for a group—especially a well-funded one—to split into teams and run multiple campaigns.


While most of the campaigns’ attacks are conducted separately, we’ve seen apparently joint operations conducted in phases that entail the work of different teams at each point in the infection chain.


Use of the Same C&C Servers.


In several instances, we found the campaigns’ malware communicating with the same C&C servers.


In targeted attacks, C&C servers are typically not shared with other groups.


Here are some of the C&C servers we found that are shared by the campaigns:


C&C Server PLEAD Shrouded Crossbow Waterbear itaiwans[.]com Yes No Yes microsoftmse[.]com Yes Yes No 211[.]72[.]242[.]120 Yes Yes No


Table 1: C&C servers shared by PLEAD, Shrouded Crossbow, and Waterbear


Additionally, the IP 211[.]72 [.]242[.]120 is one of the hosts for the domain microsoftmse[.]com, which has been used by several KIVARS variants.


Joint Operations.


We also found incidents where the backdoors were used on the same targets.


While it’s possible for separate groups to attack at the same time, we can construe at they are at least working together:    PLEAD


Shrouded Crossbow Samples from different groups using the same filename Loader component named after its target, i.e. {target name}.exe Loader component named after its target, i.e. {target name}.exe or {target name}64.exe Backdoors using the same C&C servers Connected to 211[.]72[.]242[.]120:53 Connected to 211[.]72[.]242[.]120:443 Timeline indicating arrival order Arrived two days after initial infection by SC Established presence two years prior, but re-infected at a recent time


Table 2: Incident where PLEAD and KIVARS attack the same target    PLEAD Shrouded Crossbow Waterbear Samples found in same machine vmdks.exe  cfbcjtqx.dll tpauto.dll Timeline of infection 3/16/2017 2/23/2017 3/8/2017   Table 3: Incidents where PLEAD, KIVARS, and Waterbear were used on the same target


Similarities between tools and techniques.


PLEAD and KIVARS, for instance, share the use of RTLO techniques to disguise their installers as documents.


Both also use decoy documents to make the RTLO attack more convincing.


Another similarity is the use of a small loader component to load encrypted backdoors into memory.


Similar Objectives.


The ulterior motive of these campaigns is to steal important documents from their victims; initial recipients of their attacks are not always their primary target.


For instance, we saw several decoy documents stolen by the attackers that are then used against another target.


This indicates that document theft is most likely the first phase of an attack chain against a victim with ties to the intended target.


While PLEAD and KIVARS are most likely to be used in first phase attacks, Waterbear can be seen as a secondary backdoor installed after attackers have gained a certain level of privilege.


Based on the type of documents stolen by these campaigns, we can get a clearer view of who they’re targeting and compromising, the purpose of their campaigns, and when they take place.


Below are some of the categories or labels of the stolen documents:  Address book Budget Business Contract Culture Defense Education Energy Foreign affairs Funding application Human affairs    Internal affairs Laws Livelihood economy Meeting Official letter Password list Performance appraisal Physical culture Press release


Public security Schedule   Enterprises Need to be Proactive PLEAD, Shrouded Crossbow, and Waterbear


are still actively mounting their campaigns against its targets, which is why organizations must proactively secure their perimeter.


IT/system administrators and information security professionals can consider making a checklist of what to look out for in the network for any signs of anomalies and suspicious behavior that can indicate intrusions.


Adopting best practices and employing multilayered security mechanisms and strategies against targeted attacks are also recommended.


Network traffic analysis, deployment of firewalls and intrusion detection and prevention systems, network segmentation, and data categorization are just some of them.


Trend Micro Solutions Trend Micro™ Deep Discovery™ provides detection, in-depth analysis, and proactive response to today’s stealthy malware, and targeted attacks in real-time.


It provides a comprehensive defense tailored to protect organizations against targeted attacks and advanced threats through specialized engines, custom sandboxing, and seamless correlation across the entire attack lifecycle, allowing it to detect threats like the above mentioned zero-day attacks even without any engine or pattern update.


Trend Micro™ Deep Security™ and Vulnerability Protection provide virtual patching that protects endpoints from threats that abuses unpatched vulnerabilities.


OfficeScan’s Vulnerability Protection shield endpoints from identified and unknown vulnerability exploits even before patches are deployed.


Trend Micro™ Smart Protection with Maximum XGen™ security infuses high-fidelity machine learning into a blend of threat protection techniques to eliminate security gaps across user activity and any endpoint—the broadest possible protection against advanced attacks.


An overview and analysis of the various malware used by PLEAD, Shrouded Crossbow, and Waterbear, along with their Indicators of Compromise (hashes, C&Cs), can be found in this technical brief.        Tags  Articles, News, Reports | APT & Targeted Attacks | Research


The MITRE ATT&CK® knowledge base is an extremely valuable tool that helps drive advancement and alignment throughout the cybersecurity industry.


It has standardized the interpretation of an attacker’s approach and provided a common language to describe threat group behaviours.


Evaluations conducted by MITRE Engenuity don’t generate any scores, rankings or ratings.


Instead, businesses are shown in full transparency how a vendor can help detect attacks from certain threat groups.


By aligning to the ATT&CK framework, these evaluations provide a complete story of the attack.


Security teams can leverage the MITRE ATT&CK framework to tell a story that helps simplify security communication across their organization.


The framework also provides security teams increased coverage visibility.


A security professional can leverage MITRE ATT&CK to audit for coverage gaps to discover where they may be vulnerable to threats.


From there they can use the evaluations to compare vendors and determine which solutions are best suited to fill this gap.


The increase in visibility can also help identify coverage overlaps that could be adjusted to optimize cost.


For all the benefits MITRE ATT&CK delivers, it is a pretty dense amount of information to sort through and interpret, so we wanted to help break down the evaluation.


However, before we get into the actual evaluation breakdown of what each phase analyzes and highlights, it is important to understand this year’s attack scenarios.


The MITRE Engenuity ATT&CK Evaluations builds their simulations based on real world advanced persistent threat (APT) attacks, simulating the tradecraft and operational flows of specific adversary threat groups.


This year the evaluation separately simulated two financially motivated threat groups that use similar behaviors, Carbanak on day 1 and FIN7 on day 2 which in total included over 174 steps.


MITRE Engenuity ATT&CK Evaluations tests a solution’s ability to detect an adversary performing a targeted attack.


This means that unlike traditional testing, MITRE Engenuity is solely focused on the product’s detection capabilities after a compromise has occurred.


However, this year, an optional evaluation was run to test a product’s ability to block/prevent an attack, validating how effective a product is at detecting an on-going threat and stopping it in its track before further damage occurs.


The Compromise: Tricking the Target


The MITRE Engenuity ATT&CK Evaluations story begins with an integral manager, whether at the bank or hotel, being compromised.


The simulated attackers sent a spear phishing email with a malicious attachment to the manager with the goal of tricking them into opening it, as this technique relies upon user execution.


When the manager opened the attachment, initial access was granted to the threat group.


Figure 1 - A Technique detection named "User Execution of Office Related Document" was generated when explorer.exe spawned winword.exe when the user clicked 2-list.rtf.


Maintaining Access:


The Leg Work


Now that the threat group has been granted access to the organization’s network, they must collect the necessary information needed to complete their objective.


There are several tactics used throughout the attacker’s journey.


They maintain access and avoid detection through persistence and defense evasion techniques.


Figure 2 - A Technique detection named "Clipboard Data or Screenshot Collection via PowerShell" was generated when powershell.exe executed CopyFromScreen().     The adversary uses privilege escalation, which commonly involves taking advantage of pre-existing system weaknesses, misconfigurations, and vulnerabilities to gain higher permissions.


From here the threat actor will access and collect credentials and work to discover the right systems to target to complete their objective.


Figure 3 - Workbench results pulling together a chain of attack involved Credential Dumping using Mimikatz Malware.


The two groups in question are both financially motivated, so they’re looking for information that can give them the highest dollar value when resold.


Historically, Carbanak and Fin7 have targeted personally identifiable information (PII) and credit card information for resale.


Lateral Movement: Moving in for the Kill


The threat group will use lateral movement techniques to locate the targeted system that they will take control of for fraud or to steal data that they can sell for financial profit.


This is a critical point in attack detection.


If the threat actors are still living in your network and moving laterally, data correlation across the environment is crucial in connecting the dots and weeding out the attacker before their final steps.


Figure 4 - Workbench models showing correlated events ready for further investigation.


Trend Micro Vision One is great for this step.


Automatically correlating threat data from different areas of the network and endpoint provides better alerts to security teams.


We don’t just tell you these individual events have all occurred – we connect the dots for you, showing that they might be related and have similar indicators of compromise as a certain attack group or type.


So let’s summarise the story of the evaluation: The first advanced attack was from the Carbanak Group who were targeting a bank, which is one of the popular targets for this group.


The attack started with compromising the HR Manager, moving laterally to locate the CFO’s system from which collection of sensitive data and spoof money transfers being carried out.


Figure 5 - Carbanak evaluation environment with Trend Micro solution placement for both detection and prevention scenarios.


The second simulation was a staged attack was from the Fin7 group who launched an attack on a Hotel chain in which they compromised the Hotel Manager who silently maintained access until credentials were collected and a new victim systems was discovered, from there moving laterally to an IT admin system, pivoting to an accounting system and setting up persistence to skim customer payment data information.


Figure 6 - FIN7 evaluation environment with Trend Micro solution placement for both detection and prevention scenarios.


In the third scenario, the evaluation simulated 10 attack scenarios involving 96 tests, playing out to test the advanced prevention controls used in rapidly reducing exposure and allowing you to respond to less common threats.


Think of it like locking your front door instead of relying on a CCTV system to record someone stepping right in.


Ensuring prevention controls are in place alongside detection is a key tenant to depend on to prevent and detect advanced threats like these.


Figure 7 - Blocking early prevents the rest of the attack from spreading.


What Does it Mean for Me?


This is where Trend Micro’s 30+ years of data and threat research become a major value add allowing you to bring all the telemetry together to clearly tell the story of an attack.


Trend Micro Vision One platform can help customers like you deliver impressive results:  96% of attack coverage to provide visibility of 167 out of 174 simulated steps across the evaluations.


This broad visibility allows customers to build a clear picture of the attack and respond faster.


With Linux gaining huge popularity amongst many organizations, especially moving to the cloud, 100% of attacks against the Linux host were detected, capturing 14/14 attacker steps.


139 pieces of telemetry were enriched by the Trend Micro Vision One platform to provide extremely effective threat visibility to better understand and investigate attacks.


90% of attack simulations were prevented through automated detection and response very early on in each test.


Deflecting risk early on frees up investigation resources, allowing teams to focus on the harder security problems to solve.


What else do I need to consider?


When evaluating the performance of vendors, it is important to consider the hierarchy of detection types.


There are 5 types identified by MITRE ATT&CK:


None:


While no detection information is given, None doesn’t mean that no detection occurred.


Rather, it means it did not meet the required detection criteria set by MITRE Engenuity.


Telemetry:


Data was processed that shows an event occurred related to the process being detected.


General:


A general detection indicates that something was deemed suspicious, but it was not assigned to a specific tactic or technique.


Tactic: A detection on tactic means the detection can be attributed to a tactical goal (e.g. credential access).


Technique: A detection on technique means the detection can be attributed to a specific adversarial action (e.g. credential dumping).


Results that are categorized as a detection type of general, tactic and technique reflect enriched data, which is a good thing.


Since these detections such as the individual MITRE ATT&CK technique, and associated tactic can be used to tell the detailed story of the attack.


This has resulted in a general understanding that general, tactic and technique detections are one of the priorities across vendors.


Tactics are similar to a chapter of a book.


A CISO can outline a story they want to tell with the high-level tactics used in an attack and then refer to the techniques to tell the story of how they accomplished the attack which provides extra detail.


Figure 8 - Carbanak and FIN7 evaluation, 65 ATT&CK techniques across 11 ATT&CK tactics are in scope for this evaluation.


So, when evaluating vendors, the most important detection type to weigh is the number of general, tactics and techniques detected.


Telemetry also gives security analysts access to the raw footprints that provide increased depth of visibility they need when looking into detailed attacker activity across assets.


Again, it’s not only important to have access to the data, but to make sense of the data.


Trend Micro doesn’t leave that responsibility wholly on you.


We start the data correlation process for you to make a larger attack campaign more apparent.


You also have the option to further explore relationships to the MITRE ATT&CK framework or get more information on specific attack types and groups from the platform.


Figure 9 -


Some organizations may want telemetry, while others would want Technique detection.


During the simulation, the Trend Micro Vision One platform detected both attacks successfully with complete visibility across the environment allowing centralized detection and investigation.


Collecting over 167 pieces of telemetry and correlating these back to over 139 pieces of enriched data allowing the team to paint a clear story of exactly what the attackers were trying to achieve.


A separate third round was conducted to test prevention controls that are used to prevent risk in the environment.


This was an optional protection scenario in which 17 of the 29 vendors participated, including Trend Micro.


For this specific test, Trend Micro performed exceptionally with the ability to block 90% of simulations automatically.


Another added element this year which deserves a special mention was the introduction of a Linux servers, where we detected all 14 techniques executed in the simulated attack scenario.


We are always happy to participate in MITRE Engenuity ATT&CK Evaluations to test our products against rigorous attacks.


Check out the complete results and more information on Trend Micro Vision One here: https://resources.trendmicro.com/MITRE-Attack-Evaluations.html.


Tags  Cloud | Endpoints | APT & Targeted Attacks | Expert Perspective | Network |


Articles, News, Reports


To protect our users, Google’s Threat Analysis Group (TAG) routinely hunts for 0-day vulnerabilities exploited in-the-wild.


In 2021, we reported nine 0-days affecting Chrome, Android, Apple and Microsoft, leading to patches to protect users from these attacks.


This blog is a follow up to our July 2021 post on four 0-day vulnerabilities we discovered in 2021, and details campaigns targeting Android users with five distinct 0-day vulnerabilities: We assess with high confidence that these exploits were packaged by a single commercial surveillance company, Cytrox, and sold to different government-backed actors who used them in at least the three campaigns discussed below.


Consistent with findings from CitizenLab, we assess likely government-backed actors purchasing these exploits are operating (at least) in Egypt, Armenia, Greece, Madagascar, Côte d’Ivoire, Serbia, Spain and Indonesia.


The 0-day exploits were used alongside n-day exploits as the developers took advantage of the time difference between when some critical bugs were patched but not flagged as security issues and when these patches were fully deployed across the Android ecosystem.


Our findings underscore the extent to which commercial surveillance vendors have proliferated capabilities historically only used by governments with the technical expertise to develop and operationalize exploits.


Seven of the nine 0-days TAG discovered in 2021 fall into this category: developed by commercial providers and sold to and used by government-backed actors.


TAG is actively tracking more than 30 vendors with varying levels of sophistication and public exposure selling exploits or surveillance capabilities to government-backed actors.


All three campaigns delivered one-time links mimicking URL shortener services to the targeted Android users via email.


The campaigns were limited — in each case, we assess the number of targets was in the tens of users.


Once clicked, the link redirected the target to an attacker-owned domain that delivered the exploits before redirecting the browser to a legitimate website.


If the link was not active, the user was redirected directly to a legitimate website.


We've seen this technique used against journalists and other unidentified targets, and alerted those users when possible.


We assess that these campaigns delivered ALIEN, a simple Android malware in charge of loading PREDATOR, an Android implant described by CitizenLab in December 2021.


ALIEN lives inside multiple privileged processes and receives commands from PREDATOR over IPC.


These commands include recording audio, adding CA certificates, and hiding apps.


The first campaign, detected in August 2021, used Chrome on a Samsung Galaxy S21 and the web server immediately replied with a HTTP redirect (302) pointing to the following intent URL.


This URL abused a logic flaw and forced Chrome to load another URL in the Samsung Browser without user interaction or warnings.


We did not capture the subsequent stages, but assess the attackers did not have exploits for the current version of Chrome (91.0.4472) at that time, but instead used n-day exploits targeting Samsung Browser, which was running an older and vulnerable version of Chromium.


We assess with high confidence this vulnerability was sold by an exploit broker and probably abused by more than one surveillance vendor.


More technical details about this vulnerability are available in this RCA by Maddie Stone.


Related IOCs


In September 2021, TAG detected a campaign where the exploit chain was delivered to a fully up-to-date Samsung Galaxy S10 running the latest version of Chrome.


We recovered the exploit used to escape the Chrome Sandbox, but not the initial RCE exploit.