APT27 continues targeting the gambling industry. New APT34 activity. Malicious code in APKPure app store.

Summary

By the CyberWire staff

At a glance.

APT27 continues targeting the gambling industry.
New APT34 activity.
Malicious code in APKPure app store.
Malware campaign abuses contact forms.
New Lazarus backdoor.

New APT34 activity.

Check Point says the Iranian threat actor APT34 (also known as OilRig) has targeted a Lebanese entity with a new backdoor dubbed "SideTwist." The threat actor delivered the malware via a Microsoft Word document that purported to describe job opportunities at a US-based cloud database company. The researchers say the SideTwist malware "provides functionality which is simple and similar to other C based backdoors utilized by the group: DNSpionage and TONEDEAF and TONEDEAF2.0." They add that "APT34’s backdoors DNSpionage and TONEDEAF are known to receive commands from the servers by searching for specific pattern hidden inside the HTML content of a legitimate looking website. In our case the attackers utilized a Flickr lookalike page, while in previous campaigns GitHub, Wikipedia, and Microsoft lookalikes were used."

APT27 continues targeting the gambling industry.

Trend Micro outlines new activity by the Chinese threat actor Iron Tiger (also known as LuckyMouse, Emissary Panda, and APT27). The threat actor targeted a Philippine-based gambling company for eighteen months, as well as "governments, banks, telecommunication providers, and even the energy sector in the Middle East and Southeast Asia." The targeted countries include Afghanistan, India, Jordan, Kuwait, Mongolia, the Philippines, Saudi Arabia, Turkey, and the United Arab Emirates.

Iron Tiger is using an updated version of its SysUpdate malware, as well as a new rootkit that operates at the kernel level. The researchers add that "[t]he different campaigns with different versions of the same tools concurrently being used suggest that there might be subgroups for this threat actor, or multiple groups with access to the builders of these tools."

Malicious code in APKPure app store.

Researchers at Kaspersky discovered malicious code in version 3.17.18 of the popular APKPure app store client. The code functioned as adware, but could also install additional executables and in one case downloaded a Trojan. The researchers explain, "APKPure users with current Android versions mostly risk having paid subscriptions and intrusive ads appear from nowhere. Users of smartphones who do not receive security updates are less fortunate: in outdated versions of the OS, the malware is capable of not only loading additional apps, but installing them on the system partition. This can result in an unremovable Trojan like xHelper getting onto the device."

APKPure quickly fixed the issue after Kaspersky notified them on April 8th. Android users of APKPure are urged to ensure that their app is updated to version. 3.17.19

Malware campaign abuses contact forms.

Researchers at Microsoft are tracking a campaign in which attackers are abusing contact forms on websites to send malicious links to website owners. The attackers use the contact forms to send phony legal threats concerning a copyright claim by a photographer or artist. The messages have a link to a sites.google.com page that will download a malicious ZIP file resulting in the installation of the IcedID banking Trojan. The researchers note, "This campaign is not only successful because it takes advantage of legitimate contact form emails, but the message content also passes as something that recipients would expect to receive. This creates a high risk of attackers successfully delivering email to inboxes, thereby allowing for 'safe' emails that would otherwise be filtered out into spam folders."

They add, "When run, IcedID connects to a command-and-control server to download modules that run its primary function of capturing and exfiltrating banking credentials and other information. It achieves persistence via schedule tasks. It also downloads implants like Cobalt Strike and other tools, which allow remote attackers to run malicious activities on the compromised system, including collecting additional credentials, moving laterally, and delivering secondary payloads."

New Lazarus backdoor.

Researchers at ESET describe "Vyveva," a previously undiscovered backdoor attributed to North Korea's Lazarus Group. The malware was discovered on two servers belonging to a South African freight logistics company and has been in use since 2018, although its delivery mechanism is still unknown.

The researchers explain, "The backdoor features capabilities for file exfiltration, timestomping, gathering information about the victim computer and its drives, and other common backdoor functionality such as running arbitrary code specified by the malware’s operators. This indicates that the intent of the operation is most likely espionage."

ESET attributes the backdoor to Lazarus "with high confidence," stating, "Vyveva shares multiple code similarities with older Lazarus samples that are detected by ESET products as the NukeSped malware family. However, the similarities do not end there: the use of fake TLS in network communication, command line execution chains, and the way of using encryption and Tor services all point towards Lazarus."

Selected Reading

Iran’s APT34 Returns with an Updated Arsenal (Check Point Research) Introduction Check Point Research discovered evidence of a new campaign by the Iranian threat group APT34 (aka OilRig), against what appears to be a Lebanese target, employing a new backdoor variant we dubbed SideTwist. Since the 2019 leak of APT34’s tools by an entity named “Lab Dookhtegan”, the threat group has been actively retooling and... Click to Read More

Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware (Trend Micro) This blog details how Iron Tiger threat actors have updated their toolkit with an updated SysUpdate malware variant that now uses five files in its infection routine instead of the usual three.

Emotet Command and Control Case Study (Unit42) We provide a step-by-step technical analysis of Emotet command and control, based on observations from before Emotet threat actors were disrupted.

Malicious code in APKPure app (Securelist) Malicious code was detected in version 3.17.18 of the APKPure alternative app store for Android. We recommend deleting the infected version and installing APKPure 3.17.19 asap.

A deep dive into Saint Bot, a new downloader (Malwarebytes Labs) Saint Bot is a downloader that has been used to drop stealers. We take a deep look at it and its accompanying panel.

Four Bytes of Power: exploiting CVE-2021-26708 in the Linux kernel (Positive Security) Author : Alexander Popov, Positive Technologies CVE-2021-26708 is assigned to five race condition bugs in the virtual socket implementation...

March 2021 Coordinated Inauthentic Behavior Report (Facebook) We're constantly working to find and stop coordinated campaigns that seek to manipulate public debate across our apps.

Attackers Conducting Cryptojacking Operation Against U.S. Education Organizations (Unit42) Unit 42 researchers spotted cryptojacking operations targetting US educational institutions.

McAfee ATR Threat Report: A Quick Primer on Cuba Ransomware (McAfee Blogs) Executive Summary Cuba ransomware is an older ransomware, that has recently undergone some development. The actors have incorporated the leaking of

Investigating a unique "form" of email delivery for IcedID malware (Microsoft Security) Microsoft threat analysts have been tracking activity where contact forms published on websites are abused to deliver malicious links to enterprises using emails with fake legal threats. The emails instruct recipients to click a link to review supposed evidence behind their allegations, but are instead led to the download of IcedID, an info-stealing malware.

(Are you) afreight of the dark? Watch out for Vyveva, new Lazarus backdoor (WeLiveSecurity) ESET researchers discover a new backdoor that the Lazarus group has deployed against a freight logistics company in South Africa.