Threat Intelligence Report September 13 - September 19 2022

Researchers recently found targeted attacks that used undocumented tools against various high-profile companies and local governments mostly in Asia. These attacks were conducted by a previously unknown espionage group named-Worok and which has been active since 2020. Worok’s toolset includes a C++ loader CLRLoad, a PowerShell backdoor PowHeartBeat, and a C# loader PNGLoad that uses steganography to extract hidden malicious payloads from PNG files.

The Dracarys Spyware is an android-based threat recently observed to be distributed by the Bitter APT group. It is distributed as a trojanized messaging application such as Signal/Telegram. It is sent to its victims via phishing. This android spyware captures data found on your android mobile such as SMS, Contacts list, Call logs, etc. In addition, it can also capture the audio.

A remote command execution (RCE) vulnerability in D-Link devices' "/shareport.php" component has been discovered. Shareport.php doesn't sanitize the value that is passed to it, leading to a command execution. Upon successful exploitation, MooBot is dropped which contacts it Command-and-Control server and adds the impacted device to its botnet. MooBot, on the other hand, is a malware which targets networking devices that are running Linux. It is usually utilized to conduct DDoS.

Red Piranha has deployed rules to detect and reject these exploit attempts against D-Link routers.

Researchers have recently identified a new Phishing-as-a-Service (PhaaS) called EvilProxy advertised on the Dark Web. In some sources, the alternative name is Moloch, which has some connection to a phishing-kit developed by several notable underground actors who targeted financial institutions and the e-commerce sector. EvilProxy actors use Reverse Proxy and Cookie Injection methods to bypass 2FA authentication – proxyfying victim’s session. Previously such methods have been seen in targeted campaigns of APT and cyberespionage groups. However, now these methods have been successfully productized in EvilProxy which highlights the significance of growth in attacks against online services and MFA authorization mechanisms. EvilProxy was first detected in early May 2022, this is when the actors running it released a demonstration video detailing how it could be used to deliver advanced phishing links with the intention to compromise consumer accounts belonging to major brands such as Apple, Facebook, GoDaddy, GitHub, Google, Dropbox, Instagram, Microsoft, Twitter, Yahoo, Yandex and others.

As the name suggests, its primary purpose is logging keystrokes, clipboard data, HTTP cookies, taking periodic screenshots, and viewing the webcam of infected computers. When a device is infected with the Origin Logger malware, it becomes easy for an attacker to familiarize themselves with an employee’s sensitive information, including schedules and communications. For industries that use expensive equipment or large orders, this intel can create plethora of opportunities for the attacker. The Origin Logger malware provided additional information to the attacker by taking a screenshot as the supervisor writes an email to management.

Threat actors associated with the ShadowPad remote access Trojan have implemented a new toolset to assist its campaigns. The group is targeting various government and state-owned organizations spanning multiple Asian countries. The attack method leveraged by ShadowPad consists of placing a malicious dynamic link library in a legitimate DLL directory. The attacker runs the legitimate application, which then executes the previously-dropped payload. These types of attacks are often associated with multiple software packages, such as graphics software, web browsers, and outdated versions of security software. Most current versions of the software used would possess mitigation against this type of attack, hence why the attackers target older versions. The group then uses Mimikatz and ProcDump to steal user credentials and network scanning tools to identify other devices on the network that could facilitate lateral movement.

Execution TA0002 - Privilege Escalation TA0004 - Defense Evasion TA0005 Discovery TA0007