Anomali Cyber Watch: Cozy Bear Employs New Downloaders, RTM Locker Ransomware Seeks Privacy, Vice Society Automated Selective Exfiltration

Trending Cyber News and Threat Intelligence

QBot Banker Delivered through Business Correspondence

(published: April 17, 2023)

In early April 2023, an increased volume of malspam utilizing business-email thread hijacking was detected delivering the QBot (QakBot, QuackBot, Pinkslipbot) banking trojan. The observed lures in English, German, Italian, and French were targeting various countries with the top three being Germany, Argentina, and Italy, in that order. The attackers were spoofing a name in the hijacked conversation to prompt the target to open an attached PDF file. The target is then faced with a button, a password, and an instruction to download, unpack and execute a malicious Windows Script File (WSF) within a password-protected archive. User execution is followed by automated deobfuscation of a contained JScript producing an encoded PowerShell script aimed at downloading a QBot DLL from a compromised website and running it with the help of rundll32. QBot steals credentials, profiles systems to identify prospects for additional high-value targeting, and steals locally-stored emails for further proliferation via thread hijacking malspam.
Analyst Comment: The spoofing of the sender’s name from the previous letters in the ‘From’ field can be identified in this campaign because it uses a sender’s fraudulent email address different from that of the real correspondent. Users should be cautious with password-protected archives and suspicious file types such as WSF. Network and host-based indicators associated with this QBot campaign are available in the Anomali platform and customers are advised to block these on their infrastructure.
MITRE ATT&CK: [MITRE ATT&CK] T1566 – Phishing | [MITRE ATT&CK] T1204 – User Execution | [MITRE ATT&CK] T1207 – Rogue Domain Controller | [MITRE ATT&CK] T1140 – Deobfuscate/Decode Files Or Information | [MITRE ATT&CK] T1059.001: PowerShell | [MITRE ATT&CK] T1218.011 – Signed Binary Proxy Execution: Rundll32 | [MITRE ATT&CK] T1090 – Proxy | [MITRE ATT&CK] T1114.001 – Email Collection: Local Email Collection | [MITRE ATT&CK] T1555 – Credentials From Password Stores | [MITRE ATT&CK] T1539 – Steal Web Session Cookie | [MITRE ATT&CK] T1105 – Ingress Tool Transfer
Tags: malware:QBot, malware-type:Banking trojan, malware:QakBot, malware:QuackBot, malware:Pinkslipbot, detection:Trojan-Banker.Win32.Qbot, target-country:Germany, target-country:DE, target-country:Argentina, target-country:AR, target-country:Italy, target-country:IT, campaign:Obama249, abused:PowerShell, file-type:WSF, file-type:DLL, file-type:PDF, file-type:ZIP, JScript, technique:Email thread hijacking, technique:Conversation hijacking, technique:Compromised website, abused:Base64, abused:rundll32, target-system:Windows

Espionage Campaign Linked to Russian Intelligence Services

(published: April 13, 2023)

A new cyberespionage campaign attributed to Russia-sponsored group Cozy Bear (APT29, Nobelium) has been targeting NATO and European Union member countries, and to a lesser extent, Africa. An embassy-themed spearphishing link leads to a compromised website with a custom ​​EnvyScout script utilizing the HTML Smuggling technique. Three new downloaders were unique to this campaign: SnowyAmber, used since October 2022, QuarterRig, used since March 2023, and ​​HalfRig, used since February 2023. The final observed payload was an attack framework beacon, either Cobalt Strike or Brute Ratel.
Analyst Comment: Many advanced attacks start with a spearphishing email. It is important to teach your users basic online hygiene and phishing awareness. indicators associated with this Cozy Bear campaign are available in the Anomali platform and customers are advised to block these on their infrastructure. Network defenders can use the Polish government’s YARA rules identifying the custom backdoors associated with this campaign.
MITRE ATT&CK: [MITRE ATT&CK] T1583.003 – Acquire Infrastructure: Virtual Private Server | [MITRE ATT&CK] T1583.006 – Acquire Infrastructure: Web Services | [MITRE ATT&CK] T1584 – Compromise Infrastructure | [MITRE ATT&CK] T1566 – Phishing | [MITRE ATT&CK] T1566.001 – Phishing: Spearphishing Attachment | [MITRE ATT&CK] T1566.002 – Phishing: Spearphishing Link | [MITRE ATT&CK] T1204 – User Execution | [MITRE ATT&CK] T1204.002 – User Execution: Malicious File | [MITRE ATT&CK] T1547.001 – Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder | [MITRE ATT&CK] T1574.001 – Hijack Execution Flow: Dll Search Order Hijacking | [MITRE ATT&CK] T1574.002 – Hijack Execution Flow: Dll Side-Loading | [MITRE ATT&CK] T1027.006 – Obfuscated Files or Information: Html Smuggling | [MITRE ATT&CK] T1140 – Deobfuscate/Decode Files Or Information | [MITRE ATT&CK] T1553.005 – Subvert Trust Controls: Mark-Of-The-Web Bypass | [MITRE ATT&CK] T1574.001 – Hijack Execution Flow: Dll Search Order Hijacking | [MITRE ATT&CK] T1574.002 – Hijack Execution Flow: Dll Side-Loading | [MITRE ATT&CK] T1102 – Web Service | [MITRE ATT&CK] T1102.003 – Web Service: One-Way Communication
Signatures: APT29 HalfRig Obfuscation. YARA by CERT Polska | APT29 QuarterRig. YARA by CERT Polska | APT29 SnowyAmber downloader. YARA by CERT Polska
Tags: actor:Cozy Bear, actor:Nobelium, mitre-group:APT29, target-region:NATO, target-region:European Union, target-region:Africa, source-country:Russia, source-country:RU, technique:HTML smuggling, malware:​​EnvyScout, malware:SnowyAmber, malware:QuarterRig, malware:​​HalfRig, malware:​​Cobalt Strike, malware:​​Brute Ratel, abused:NOTION collaboration service, target-system:Windows

Read The Manual Locker: A Private RaaS Provider

(published: April 13, 2023)

The Read The Manual (RTM) Locker group is a new ransomware-as-a-service (RaaS) provider with likely connections to the Commonwealth of Independent States. The group operates Windows-targeting ransomware with a focus on double-extortion attacks on corporate environments. The RTM Locker malware requires an affiliate to provide administrative privileges in the compromised network. To increase the effect of encryption, the locker tries to mount all unmounted partitions to unused drives until all 26 drive letters are in use. RTM Locker uses Input/Output Completion Ports to enable multiple threads to work with the same file at the same time. The RTM Locker group avoids direct spreading via malspam, marks its builds to discourage premature leaks, clears the logs and removes the locker after the system is encrypted. Additionally, the group employs strict rules for its affiliates to adhere to targeting rules and be removed for unexcused inactivity of over 10 days.
Analyst Comment: Multi-threading allows RTM Locker for fast encryption. Ransomware is a constantly evolving threat, and the most fundamental defense is having proper backup and restore processes in place that allows recovery without any need to decrypt the affected data. Data theft is containable through segmentation, encrypting data at rest, and limiting the storage of personal and sensitive data.
MITRE ATT&CK: [MITRE ATT&CK] T1057 – Process Discovery | [MITRE ATT&CK] T1070.001 – Indicator Removal on Host: Clear Windows Event Logs | [MITRE ATT&CK] T1070.004 – Indicator Removal on Host: File Deletion | [MITRE ATT&CK] T1106: Native API | [MITRE ATT&CK] T1134.002 – Access Token Manipulation: Create Process With Token | [MITRE ATT&CK] T1486: Data Encrypted for Impact | [MITRE ATT&CK] T1489 – Service Stop
Tags: actor:RTM Locker, malware:RTM Locker, malware-type:RaaS, malware-type:Ransomware, detection:RTMLocker, abused:TOX, abused:IOCP, source-region:Commonwealth of Independent States, source-region:CIS, target-system:Windows

Vice Society: A Tale of Victim Data Exfiltration via PowerShell, aka Stealing off the Land

(published: April 13, 2023)

A new PowerShell data exfiltration script was detected in use by the Vice Society ransomware group. The attackers get access to the target’s Domain Controller, which allows them to deploy this script to any endpoint within the network. It is started with the parameter to bypass Execution Policy restrictions and starts by ​​identifying mounted drives on the system via Windows Management Instrumentation. The script proceeds to automatically identify and process directory names for all directories on each mounted volume that do not match the ignore list. It then uses additional keywords and parameters to select which directories and files to pass to exfiltrate via HTTP POST requests to the threat actor’s web server. The script implements rate limiting to avoid overwhelming the host’s resources.
Analyst Comment: The use of the living off the land binaries and scripts (LOLBAS) methods, such as PowerShell scripts and WMI creates difficulties for detection. Network defenders can check Windows Event Logs (WEL) Event IDs 400, 600, 800, 4103 and 4104. Monitor for HTTP POST events to /upload endpoints on unknown remote HTTP servers, and HTTP activity direct to external IP addresses. Use Palo Alto Networks YARA signature to detect this malicious PowerShell exfiltration activity.
MITRE ATT&CK: [MITRE ATT&CK] T1059.001: PowerShell | [MITRE ATT&CK] T1020 – Automated Exfiltration | [MITRE ATT&CK] T1083 – File And Directory Discovery | [MITRE ATT&CK] T1005: Data from Local System
Signatures: Vice Society PS Exfil Script. YARA by PaloAltoNetworks
Tags: actor:Vice Society, malware-type:ransomware, malware-type:Exfiltration tool, Data exfiltration, abosed:PowerShell, technique:Living off the land binaries and scripts, technique:LOLBAS, technique:Rate limiting, Windows Event Log, target-system:Windows

Goldoson: Privacy-Invasive and Clicker Android Adware Found in Popular Apps in South Korea

(published: April 12, 2023)

A malicious Android library dubbed Goldoson has been found targeting predominantly South Korean users. McAfee researchers detected it in applications downloaded more than 100 million times from Google Play, and 8 million from the ONE store, an app store popular in South Korea. Goldoson collects information about users’ locations, connection history, and installed applications. The library either gets the permissions from the app or specifically asks the user to allow the location permission. Additionally, Goldoson produces hidden fraudulent traffic by loading HTML code and injecting it into a customized and hidden WebView and visiting the URLs recursively.
Analyst Comment: All the identified affected applications were either updated or removed from the official stores. Users are advised to regularly review the list of installed applications to remove those that are no longer needed. Pay attention to signs of malicious resource utilizations such as device overheating and faster battery drain. Do not grant unnecessarily permissions such as location permission unless you know it is needed for the application to produce desired functionality. Network indicators associated with the Goldoson adware are available in the Anomali platform and customers are advised to block these on their infrastructure.
MITRE ATT&CK: [MITRE ATT&CK] T1474.001 – Supply Chain Compromise: Compromise Software Dependencies And Development Tools | [MITRE ATT&CK] T1406 – Obfuscated Files Or Information | [MITRE ATT&CK] T1430 – Location Tracking | [MITRE ATT&CK] T1424 – Process Discovery | [MITRE ATT&CK] T1646 – Exfiltration Over C2 Channel | [MITRE ATT&CK] T1643 – Generate Traffic From Victim
Tags: malware:Goldoson, malware-type:Clicker, malware-type:Adware, Supply-chain, target-country:South Korea, target-country:KR, malware-type:Compromised app, malware-type:Malicious library, target:Mobile, abused:Google Play, abused:ONE store, target-system:Android