Lazarus Group Recent Trends Recently Observed Campaigns The following list contains recent campaigns observed by CYFIRMA Threat Intelligence (CTI) that are attributed to the Lazarus Group and or its affiliates in 2022. • UNC038 • UNC050 • UNC048 • UNC047 • guarantee price • MUD NATIONALS • UNC042 • UNC039 • UNC035 • UNC030 • […]

Phishing Analysis A new phishing campaign by TA578 is uncovered that utilizes thread hijacked emails to deploy the BumbleBee malware which is followed by Cobalt Strike. Earlier, the TA578 threat actor used to deploy Urnsif, IcedID, KPOT Stealer, Buer Loader, and BazaLoader malware. The BumbleBee malware supports commands as listed below. Shellcode injection DLL injection […]

Onyx Ransomware Report Suspected Malware: onyx Ransomware Function: Ransomware Risk Score: 8 Confidence Level: High Threat actor Associations: Unknown Executive Summary: The activity of new ransomware named “Onyx” was first observed in the second half of April 2022. This ransomware group has seven victims listed on its data leak page[.onion site of the group till […]

Phishing Campaign related to the On-going Russia-Ukraine Conflict A new phishing campaign related to threat actor “Armageddon” was noticed earlier this month. The threat actor “Armageddon” was observed to be sending phishing emails to various Ukraine government organizations. The email carried the subject line “Інформація щодо військових злочинців РФ (Information on Russian war criminals)”. EML […]

Hermetic Wiper Malware Report Date: 04-April-22 Author: Dilpreet Singh Bajwa (Cyfirma-Malware Research Team) Suspected Malware: Hermetic Wiper Function: Wiper Risk Score: 8 Confidence Level: High Threat actor Associations: Unknown – Pro Russian First Seen: Feb 2022 DeCyfir presence: Yes Executive Summary: The HermeticWiper is related to one of the early malware attacks against Ukraine during […]

Doublezero Wiper Malware Report Date: 04-April-22 Author: Manoj Kumar (Cyfirma-Malware Research Team) Suspected Malware: Doublezero wiper Malware Function: Destructor Risk Score: 8 Confidence Level: High Threat actor Associations: Unknown First Seen: March 2022 DeCyfir presence: Yes Executive Summary: Doublezero is a data wiper malware, which destroys files, registry keys, and trees on the Victim machine. […]

ShadowPad Malware Report Suspected Malware: ShadowPad Malware Function: Backdoor Risk Score: 8 Confidence Level: High Threat actor Associations: China-Based Threat Actors (like Tick, APT41) Used in Campaigns: CCleaner, NetSarang, ShadowHammer First Seen: 2015   Executive Summary ShadowPad is a modular backdoor considered to be the successor of PlugX. ShadowPad constitutes various plugins having specific functionality […]

Emerging Cyber Threats in the Ongoing Russia-Ukraine Conflict Geopolitical Advisory [10 May 2022, Version 13, NEW] Docker Images Used by Pro-Ukraine Hackers to DDoS Russian Websites This week researchers observed a plethora of distributed denial-of-service (DDoS) attacks on Russian and Belarusian websites. The targeted websites are managed by either the respective governments of these two […]

Out-of-Band Report – Tracking DangerousPassword Campaign by Lazarus Group   Attack Type: Social Engineering, Spear-Phishing, Malware Implant, Persistence, Defense Evasion, Vulnerabilities & Exploits Objective: Financial Gain Target Industry: Finance, Cryptocurrency Target technology: Email, Windows Business Impact: Financial Loss, Data Loss, Customer trust and reputation damage   Summary Tracking of a large-scale spear-phishing campaign dubbed “DangerousPasword” […]

Risk Score: 8 Confidence Level: High. Suspected Malware: TimeTime Malware. Function: Ransomware. Threat actor Associations: Unknown First Seen: Dec 2021.   Brief Introduction: TimeTime ransomware is currently trending. It is written in C#.Net (C# is a general-purpose, multi-paradigm programming language) and not obfuscated in any way. After encryption, the “.timetime” extension is added to encrypted […]

Supersuso is a ransomware intended to encrypt sensitive data in order to restrict access to it. During the encryption process, this malware sample adds the extension .ICQ_SUPERSUSO to mark inaccessible files. When the encryption process ends, Supersuso malware creates a ransom note #Decrypt#.txt Malicious Sample Analysis: MD5:CCFACEE2EBA9FCDB7FDDD4E9D7B846FF SHA256: 8C142BFDA0D07A7E62C1D761CB9DF9B3F99F19479431DFC3F778408FE113F4C8 File Type: Windows PE-32 Executable Subsystem: GUI Compilation Time: […]

BigLock is a ransomware discovered in 2020 and also known as “corona-lock.” It encrypts files on the victim system with chacha and AES encryption as specified by the ransomware authors in the ransom note. All encrypted files are appended with “.corona-lock” extension. The malware took advantage of the corona pandemic period by tricking people to […]

EXECUTIVE SUMMARY   A critical Remote Code Execution Vulnerability tracked as CVE-2021-44228 in Apache Log4j has been found to be exploited in the wild. Upon analysis of the associated Indicators of Compromise (IOCs), we observed indicators predominantly linked to Russian Threat Actor dubbed Fancy Bear. In addition, some of the indicators were also found associated […]

Makop Ransomware Analysis Brief Introduction: Makop ransomware is the latest malware and is trending currently. It instructs the users/victims to contact the malware authors via Tox, a P2P instant messaging protocol. The malware encrypts all the files in each folder and added extension .makop to each file. The format of the encrypted file is “Original_name_of_the_file.Original_extension_of_file.[Unique/random […]

KARMA Leak Ransomware Technical Analysis   Risk Score: 8 Confidence Level: High Suspected Malware: Karma Leak Malware. Function: Ransomware. Tactic Used: Data Encryption. Other Malwares related to Karma: GangBang, Milihpen, JSWorm First Seen: June 2021 Target Industry: Multiple   Brief Introduction: “Karma Leak” was first been detected in June 2021 and is a new ransomware. […]

Malware Analysis related to APT41 – STEALTHVECTOR Risk Score: 8. Confidence Level: High. Suspected Malware: Trojan.Win64.STEALTHVECTOR.SMZTID-B   Malicious Loader Sample Analysis: MD5: b3f3de10b3c1c15491c53223f1b5979f SHA256: 91aa05e3666c7e2443fc1f0f0142f1829f5ec51e289c95b10811531da50eb2b3 File Details: As shown in Figure1, following are the details related to the malware. File Type: Windows PE-64 Executable Subsystem: GUI Compilation Time: Oct 2020. Figure 1 Figure 2   […]

Ongoing analysis of Gh0st RAT Blacklisted IP: 23[.]225.73.110 Risk Score: 10 Confidence Level: High Associated Malware: Gh0st RAT Function: Gh0st RAT C&C ITW Associations: EMISSARY PANDA, Hurricane Panda, Lazarus Group, Leviathan, Stone Panda Associated Hash (MD5): c61470df88115bd1c14540652f48ef49 File Name: svchsot.exe DeCyfir presence: Yes About Gh0st RAT: Gh0st RAT is a unique example of a RAT […]

Overview Risk Score: 8 Confidence Level: High Suspected Malware: FormBook Malware/Trojan Function: Information Stealing, Credential Harvesting and download/drops stealthier malware Tactic Used: Process Injection/Process Hollowing Threat actor Associations: ng-Code Other Malware related to FormBook: XLoader First Seen: July 2016 Latest Seen: Nov 2021 Target Industry: Multiple Target Countries: Multiple/Global Effect but predominately the US Relevancy: […]

Malware Research on AtomSilo Ransomware AtomSilo is a new Ransomware recently seen in September 2021 during one of their attacks by exploiting a recently revealed vulnerability (CVE-2021-26084) in Atlassian’s Confluence Collaboration Software for initial access. The Ransomware used the double extortion method which is gaining popularity among ransomware threat actors where they first, exfiltrate the […]

By CYFIRMA Research First Published on 6 August 2021 EXECUTIVE SUMMARY REvil ransomware has set a price for decrypting all systems locked during the Kaseya supply-chain attack and has exploited zero-day vulnerability CVE-2021-30116. As several organizations, leverage Managed Service Providers (MSPs) as part of operational procedures and having third-party vendors as part of the organization’s […]