Post

More from @ESETresearch

ESET Research

@ESETresearch

Sep 26

By analyzing thousands of samples, #ESETresearch has conducted a comprehensive technical analysis of the toolset the 🇷🇺Russia-aligned #Gamaredon #APTgroup used in 2022 and 2023 to spy on Ukraine🇺🇦 . 1/9welivesecurity.com/en/eset-resear…

This most active APT group in Ukraine doesn’t try to be stealthy and relies on extensive obfuscation, constant switching between C&C servers, and regular updates of its arsenal with new malware and other tools at a rapid pace, as depicted in the image below. 2/9

#Gamaredon’s initial attack involves #spearphishing and then, for lateral movement, custom malware weaponizes existing and new Word documents and USB drives, which are hoped to be shared among potential victims. Word docs are weaponized either by #PteroTemplate or #PteroDoc. 3/9

Read 9 tweets

ESET Research

@ESETresearch

Jul 18

#ESETresearch discovered a signed, vulnerable, ad-injecting driver from a mysterious Chinese company. This threat, which we dubbed HotPage, comes self-contained in an executable that installs its main driver and injects libraries into Chromium-based browsers. 1/7

Using Windows’ notification callbacks, the driver component monitors new browsers or tabs being opened. Under certain conditions, the adware will use various techniques to inject shellcode into browser processes to load network-tampering libraries. 2/7

Using Microsoft’s Detours hooking library, the injected code filters HTTP(S) requests and responses. The malware can replace the content of the current page, redirect the user, or simply open a new tab to a website full of gaming ads. 3/7

Read 7 tweets

ESET Research

@ESETresearch

Aug 30, 2023

#ESETresearch identified two GREF campaigns targeting #Android users with @signalapp and @telegram apps trojanized into cyberespionage tools .
@LukasStefanko

1/9 welivesecurity.com/en/eset-resear…

Signal Plus Messenger and FlyGram were built by merging the BadBazaar espionage code, previously used to target #Uyghurs and other #Turkic minorities, into the respective base app’s code. 2/9

The purpose of both apps is data exfiltration. Signal Plus Messenger presents the first documented case of spying on a victim’s Signal communications by secretly autolinking the compromised device to the attacker’s Signal device. 3/9

Read 9 tweets

ESET Research

@ESETresearch

May 10, 2023

https://twitter.com/jbradley89/status/1649434597309005824

#ESETResearch warns about a CPIO archive named “Jump Crypto Investment ” uploaded to VirusTotal from the USA 🇺🇸. It is another malicious PDF viewer distributed by #Lazarus #APT for #macOS @pkalnai @michalmalik 1/7 Agreement.zip

https://twitter.com/jbradley89/status/1649434597309005824

@pkalnai @michalmalik The archive contains a fully functional – but malicious – PDF viewer, and a crafted “locked” PDF file. When the file is opened in the viewer, the malicious code is triggered. The functionality is very similar to the malware reported by @JamfSoftware. 2/7 jamf.com/blog/bluenorof…

@pkalnai @michalmalik @JamfSoftware First, the malicious PDF viewer decrypts a decoy document embedded inside the original PDF file, and displays it to the target. 3/7

Read 7 tweets

ESET Research

@ESETresearch

Apr 20, 2023

#ESETResearch confirms Lazarus is linked to the recent #3CX supply-chain attacks. Based on code similarities and network infrastructure, we connect the 3CX incident with a Linux case of DreamJob, a long-term Lazarus operation using job offer as lures. 1/6 welivesecurity.com/2023/04/20/lin…

First, let’s look at the timeline. It shows that the trojanized macOS version of the 3CX Desktop App was ready two months prior to the distribution of the Windows version. Also interesting is that the attack was in preparation as early as December 2022. 2/6

It was reported that Mandiant has found Mac malware they call SIMPLESEA inside the 3CX network. While we do not have the sample, their description of this malware overlaps with second-stage Linux malware we found while investigating a recent Operation DreamJob case. 3/6

Read 6 tweets

ESET Research

@ESETresearch

Mar 14, 2023

@0xfmz

#ESETResearch discovered an attack by APT group Tick against a data-loss prevention (DLP) company in East Asia and found a previously unreported tool used by the group. welivesecurity.com/2023/03/14/slo… @0xfmz 1/6

In 2021, in the DLP company’s network, the attackers introduced trojanized installers of the legitimate application Q-dir, part of a toolkit used by the company. When executed, the installer dropped the open-source ReVBShell backdoor and ran the original Q-dir application. 2/6

Subsequently, in 2022, on customers of the DLP company’s software, the trojanized Q-dir installers were deployed using remote support tools. Our hypothesis is that this occurred while the DLP company provided technical support to their customers. 3/6

Read 6 tweets

Share this page!

Enter URL or ID to Unroll

ESET Research

Try unrolling a thread yourself!

More from @ESETresearch

ESET Research

ESET Research

ESET Research

ESET Research

ESET Research

ESET Research

Did Thread Reader help you today?

Don't want to be a Premium member but still want to support us?

Send Email!