Threat Reports

German Automotive Sector Targeted with Info-Stealer Campaign

Industry: Automotive | Level: Tactical | Source: CheckPoint

A threat operation, discovered by Check Point, identified information-stealing malware targeting 14 German organizations, primarily those in the automotive industry including dealerships and manufacturers. The campaign was tracked back to at least July 2021. German automotive businesses were used for the disguise of this campaign, with the attackers hosting domains imitating the businesses to distribute emails and host malware. The phishing email contains an ISO file to bypass NTFS Mark-of-the-Web trust control (MOTW) with an HTA within. The HTA file then spawns Mshta.exe with either VBScript or PowerShell being executed to download additional payloads or to modify the registry. Payload delivered would include various information-stealing malware such as Raccoon, AZORult, and BitRAT. Information compromised would include personal, and credit card information. The attribution of the campaign is currently unclear, hosted infrastructure was identified in Iran, but doesn’t provide any definitive evidence of attribution. Additionally, the attacker’s exact motives remain undetermined, despite obtaining personal and financial information, a larger play of espionage or business fraud is a potential.

Anvilogic Scenario:

• Malicious Document Delivering Malware

Anvilogic Use Cases:

• MSHTA.exe execution
• BITSadmin Execution
• Modify Registry Key
• Invoke-WebRequest Command
• Output to File

Bitter APT Targets Bangladesh

Industry: N/A | Level: Tactical | Source: CiscoTalos

Cisco Talos found threat activity from Bitter APT group targeting the Bangladesh government dating back to August 2021. Historically the threat group has targeted Asian entities in China, Pakistan, and Saudi Arabia, making the shift to Bangladesh new. The campaign is initiated through spear-phishing masquerading as “regular operational tasks” with emails containing a malicious Word document to abuse Microsoft vulnerabilities, such as Equation Editor, CVE-2017-11882. Software used to send emails include Zimbra and JavaMail. An embedded object in the weaponized Excel document configures a scheduled task. Once initial access is obtained the threat actor’s trojan, named “ZxxZ” by Cisco Talos, is deployed providing capabilities such as remote code execution, disguising itself as a Windows Security update. System information discovery is initiated along with identifying defensive tools such as Windows Defender or known antivirus software. The group’s main objective is to conduct cyber espionage.

Anvilogic Scenario:

• Bitter APT – Infection Chain with Equation Editor

Anvilogic Use Cases:

• Abuse EQNEDT32.EXE CVE-2017-11882
• Create/Modify Schtasks
• Executable File Written to Disk
• Invoke-WebRequest Command
• Query Registry
• Executable Process from Suspicious Folder
• Network Connection with Suspicious Folder
• Remote Thread from Suspicious Folder

Phishing with World Health Organization Themes

Industry: N/A | Level: Tactical | Source: ProofPoint

Research from ProofPoint has identified the distribution of Nerbian remote access trojan (RAT), through phishing emails using COVID-19 and World Health Organization themes. The threat campaign was traced back to getting its start April 26th, 2022, with emails targeting entities located in Italy, Spain, and the United Kingdom. Emails delivered contain either a malicious document or a compressed archive containing a malicious document. The process flow upon the execution of the embedded macro is, CMD calls PowerShell to download a BAT file, the BAT file launches the PowerShell to download additional payloads including the malicious RAT. The RAT establishes persistence and has the capabilities to download additional payloads as needed. There is currently no attribution placed on the Nerbian RAT.

Anvilogic Scenario:

• Nerbian RAT Infection Chain from Malicious Document

Anvilogic Use Cases:

• Malicious Document Execution
• Compressed File Execution
• Suspicious Executable by CMD.exe
• Executable Create Script Process
• Invoke-WebRequest Command
• Executable File Written to Disk
• Suspicious Executable by Powershell
• Executable Process from Suspicious Folder
• Network Connection with Suspicious Folder
• Create/Modify Schtasks

Linux Backdoor, BPFDoor

Industry: Education, Government, Logistics, Telecommunications | Level: Tactical| Source: SandFlySecurity

BPFDoor, an evasive Linux backdoor, to be utilized by Chinese Red Menshen threat actors. has been researched by Kevin Beaumont, PricewaterhouseCoopers (PwC), and The Sandfly Security Team.  The stealth capabilities of the tool make it ideal for espionage and persistent attacks. Utilizing the Berkeley Packet Filter sniffer, BPFDoor is capable of monitoring network traffic and sending network packets. Operating at the network layer level, the malware is unhindered by firewall rules and does not require any open ports. The malware once downloaded, requires root permissions for execution and will be set up as an in-memory implant. Persistence for the malware is set up with scripts or a crontab scheduled task. Attackers are able to control the implant once the backdoor modifies firewall configurations, “Upon receiving a special packet, it will modify the local firewall to allow the attacker IP address to access resources such as a spawned shell or connect back bindshell.” Additionally, attackers are able to control the implant through a “magic” password as identified by security researcher Kevin Beaumont. Targets by Red Menshen are organizations in verticals for education, government, logistics, and telecommunication. Geographically targets are in Asia and the Middle East.

Anvilogic Scenario:

• Unix File Download, Modified, Executed

Anvilogic Use Cases:

• Linux Malware – BPFDoor
• Sudoers Misconfiguration PrivEsc
• Crontab Job Scheduling (Unix)
• File Download (Unix)
• File Modified for Execution
• File Execution (Unix)