company logo

Product

Our Product

We are Reshaping the way Developers find and fix vulnerabilities before they get exploited.

Solutions

By Industry

BFSI

Healthcare

Education

IT & Telecom

Government

By Role

CISO/CTO

DevOps Engineer

Resources

Resource Library

Get actionable insight straight from our threat Intel lab to keep you informed about the ever-changing Threat landscape.

Subscribe to Our Weekly Threat Digest

Company

Contact Us

Have queries, feedback or prospects? Get in touch and we shall be with you shortly.

loading..
loading..
loading..
Loading...

Malware

loading..
loading..
loading..

Latrodectus Malware: Advanced Successor to IcedID Unveiled

Discover the sophisticated Latrodectus malware, the advanced successor to IcedID, in our latest research. Explore its capabilities, evolution, and technical ana...

23-May-2024
7 min read

Related Articles

loading..

Cyberespionage

APT

Unfading Sea Haze, a new cyberespionage group, targets South China Sea nations...

Unfading Sea Haze, a newly identified threat actor, has been targeting high-level organizations in South China Sea countries since at least 2018. Our investigation has revealed sophisticated tactics, techniques, and procedures (TTPs) consistent with state-sponsored cyber espionage. This detailed [Threat Research](https://www.secureblink.com/threat-research) dissects their operations, highlighting their persistence, advanced methodologies, and potential alignment with Chinese interests. ## Background "Unfading Sea Haze" first surfaced to the attention of cybersecurity researchers in late 2023. The group is believed to be state-sponsored, with initial indicators pointing towards possible affiliations with East Asian cyber-espionage units. Their primary targets include government agencies, defense contractors, and critical infrastructure organizations. ## Historical Context and Evolution ### Discovery and Attribution Our investigation revealed no prior documentation of Unfading Sea Haze, indicating their successful evasion of detection for over five years. Their focus on military and government entities in the South China Sea suggests alignment with Chinese geopolitical interests. The use of Gh0st RAT variants, a tool popular within Chinese cyber espionage circles, supports this attribution. ### Geopolitical Targeting and Tool Sharing Unfading Sea Haze's targets and tactics indicate a sophisticated and possibly state-sponsored group. Their use of the Gh0st RAT framework and the SharpJSHandler tool resembles methods used by other Chinese threat actors, such as APT41. However, no direct connections to previously known groups were found, suggesting either a new actor or an evolution of existing capabilities within the Chinese cyber ecosystem. ## Threat Actor Profile ### Attribution While concrete attribution is challenging, "Unfading Sea Haze" exhibits characteristics consistent with state-sponsored cyber-espionage groups. Indicators suggest potential links to actors operating out of East Asia, particularly those with interests in maritime dominance and geopolitical influence in contested waters. ### Motivation and Objectives The primary motivation appears to be geopolitical, with objectives including: **Espionage:** Gathering intelligence on maritime operations, trade routes, and military movements. **Disruption:** Impairing maritime infrastructure to weaken economic and military capabilities. **Influence:** Exerting control or creating leverage in territorial disputes and economic negotiations. ## Technical Analysis of Attacks ### Initial Compromise and Regaining Access While the initial infiltration methods remain unknown due to the age of the breaches, spear-phishing emerged as a key technique for regaining access. Malicious LNK files within ZIP archives were used extensively. The attackers employed lengthy, obfuscated command lines within these files to evade detection. For example, a command line executed a series of tasks to avoid ESET Kernel Service detection, download a payload, and execute it using MSBuild. ### In-Memory Execution and Fileless Techniques Unfading Sea Haze leveraged MSBuild.exe for fileless attacks, specifying remote SMB shares as working directories. This technique allows the execution of malicious code in memory, reducing forensic artifacts on the victim's machine. A typical command might use PowerShell to initiate MSBuild with a project file from a remote server, executing entirely in memory and bypassing traditional security measures. ### Persistence Mechanisms Scheduled tasks and DLL sideloading were primary methods for persistence. The attackers mimicked legitimate Windows processes, using harmless programs to load malicious DLLs. For instance, they renamed mspaint.exe to clipsvc.exe and placed it in a directory with a malicious DLL, ensuring the legitimate program would load the attacker's code. Another example involved the Windows Perception Simulation Service, where attackers placed a malicious hid.dll in a specific directory to be loaded by the service. ### Custom Malware and Tools Unfading Sea Haze developed and deployed multiple custom malware strains. The Gh0st RAT family included SilentGh0st, TranslucentGh0st, and InsidiousGh0st, each evolving to add new features and evade detection. More recent variants like FluffyGh0st and EtherealGh0st are modular, allowing dynamic functionality via plugins. Ps2dllLoader was a key component, loading .NET or PowerShell payloads directly in memory, further obfuscating their presence. ### SharpJSHandler and Web Shell Alternatives SharpJSHandler acted as a web shell alternative, capable of executing encoded JavaScript via HTTP requests. Variants also used cloud storage services for communication, complicating detection. By avoiding traditional web shell methods and using platforms like Dropbox and OneDrive, Unfading Sea Haze demonstrated a high level of operational security. ## Data Collection and Exfiltration ### Espionage Focus The primary objective of Unfading Sea Haze appears to be espionage. Custom keyloggers, browser data stealers, and tools targeting portable devices were used extensively. For instance, xkeylog was strategically placed to capture keystrokes, while browser stealers extracted data from major browsers like Chrome and Edge. ### Exfiltration Techniques Initially, data exfiltration was performed using a custom tool, DustyExfilTool, which transmitted files via TLS. From 2022, attackers shifted to using curl and FTP, later adopting more dynamic credential management to enhance security. The use of rar.exe for archiving and transferring files, along with targeted data extraction from messaging apps like Telegram and Viber, highlighted their methodical approach to data theft. ## Attack Vectors and Techniques ### Social Engineering "Unfading Sea Haze" employs targeted social engineering tactics, including spear-phishing and fake communication channels, to gain initial access. These tactics often exploit human vulnerabilities, leveraging current events or operational details specific to the maritime industry. ### Advanced Persistent Threats (APTs) The campaign utilizes APTs to establish and maintain prolonged access to targeted networks. These threats are characterized by their stealth, persistence, and ability to adapt to defensive measures. Key techniques include: **Phishing and Spear-Phishing:** Crafting convincing emails and messages to lure victims into divulging credentials or downloading malicious software. **Exploitation of Zero-Day Vulnerabilities:** Utilizing unknown or unpatched vulnerabilities to infiltrate systems. **Lateral Movement:** Once inside, moving laterally across networks to compromise additional systems and data. ### Coordinated Attacks "Unfading Sea Haze" conducts coordinated attacks on maritime navigation and communication systems. These attacks can disrupt shipping routes, interfere with GPS signals, and compromise communication between vessels and control centers. Methods include: **Signal Jamming:** Disrupting GPS and communication signals to create navigational hazards. **Data Exfiltration:** Stealing sensitive information related to maritime operations and strategies. **Malware Deployment:** Installing malware that can disrupt or control navigation and communication systems. ## Detailed Analysis of "Unfading Sea Haze" ### 1. Tactics, Techniques, and Procedures (TTPs)** **Reconnaissance:** Extensive use of open-source intelligence (OSINT) to gather information about potential targets. **Initial Access:** Spear-phishing emails with malicious attachments or links, exploiting zero-day vulnerabilities. **Execution:** Deployment of malware to establish a foothold within the target network. **Persistence:** Use of legitimate credentials and creating backdoors to ensure long-term access. **Privilege Escalation:** Exploiting vulnerabilities to gain administrative privileges. **Defense Evasion:** Techniques such as obfuscation, encryption, and the use of legitimate tools to blend in with normal network traffic. **Credential Access:** Harvesting credentials using keyloggers, credential dumping tools, and network sniffing. **Discovery:** Mapping the internal network to identify critical assets and data. **Lateral Movement:** Moving across the network using remote desktop protocols and lateral tools like PsExec. **Collection:** Gathering and staging data for exfiltration. **Exfiltration:** Using encrypted channels to send data back to command and control (C2) servers. **Impact:** Data theft and potential for destructive actions if detected. ### 2. Tools and Malware **SeaMist:** A modular malware platform that allows for dynamic updates and the addition of new capabilities. **HazeRAT:** A remote access tool that provides the group with full control over compromised systems. **Custom Exploits:** Developed or acquired zero-day exploits tailored for high-value targets. ### 3. Infrastructure **Command and Control (C2):** Use of compromised legitimate websites and custom-built C2 servers to manage operations. **Communication:** Encrypted communications channels to avoid detection by network security tools. ### 4. Affected Sectors **Government Agencies:** Targets include departments dealing with national security, foreign affairs, and intelligence. **Defense Contractors:** Organizations involved in the development of military technologies and defense systems. **Critical Infrastructure:** Sectors such as energy, telecommunications, and transportation are at risk due to the potential for significant disruption. ## Case Studies **Case Study 1:** Breach of a National Defense Contractor In early 2024, "Unfading Sea Haze" successfully infiltrated a major national defense contractor. Using spear-phishing emails containing malicious PDF attachments, the group gained initial access. They then exploited a zero-day vulnerability in a widely used enterprise application to escalate privileges. Over the course of several months, the group exfiltrated sensitive data related to defense technologies. **Case Study 2:** Compromise of a Government Agency A government agency responsible for foreign affairs fell victim to a sophisticated attack by "Unfading Sea Haze." The attackers used social engineering to compromise an employee's email account. From there, they moved laterally within the network, gaining access to confidential diplomatic communications. The breach remained undetected for nearly a year, highlighting the group's ability to maintain persistence. ## Conclusion Unfading Sea Haze represents a sophisticated and persistent cyber threat, employing advanced techniques and custom tools to achieve their espionage objectives. Their ability to remain undetected for over five years underscores the critical importance of robust cybersecurity practices. Enhanced credential hygiene, timely patching, and vigilant monitoring are essential to countering such advanced threats. This research aims to equip the security community with the knowledge to detect and disrupt Unfading Sea Haze's operations, contributing to a more secure digital landscape.

loading..   11-Jun-2024
loading..   1 min read
loading..

ransomware

StopCrypt ransomware is back with a vengeance! This analysis dives into its mult...

The ever-evolving threat landscape of ransomware demands constant vigilance and in-depth analysis. StopCrypt ransomware, a particularly nasty strain, has garnered significant attention due to its recent resurgence and concerning capabilities. Our Threat Intel Lab at Secure Blink categorically captures the underlying nuances of this StopCrypt ransomware variant showcasing advanced evasion tactics and a sophisticated multi-stage execution process. #### Infection Cycle Upon execution, the ransomware begins by loading the msim32.dll library using the LoadLibrary function, although the significance of this action remains obscure. It then employs a protracted time-delaying loop, iterating over a large number of iterations to artificially prolong execution time. This strategy aims to thwart time-sensitive sandboxes and security mechanisms, complicating detection efforts. Additionally, the malware utilizes techniques such as LocalAlloc and VirtualProtect to manipulate memory permissions, potentially facilitating its malicious activities while evading detection. #### First Stage Payload During the initial stage of execution, the ransomware dynamically resolves essential APIs vital for its operation. Rather than employing straightforward API calls, it constructs API function calls directly on the stack. This method enhances obfuscation and complicates analysis by security tools. The malware meticulously resolves the addresses of critical APIs, including GlobalAlloc, VirtualAlloc, SetLastError, and others. This process ensures the ransomware's ability to allocate memory and execute its malicious routines without relying on fixed API calls that could be easily identified and intercepted. #### Second Stage Payload In the subsequent stage, the ransomware focuses on process hollowing—a technique used to inject malicious code into a legitimate process while maintaining its functionality. Similar to the first stage, API function names are dynamically created on the stack, enhancing obfuscation. The malware resolves the addresses of numerous APIs necessary for process hollowing, including MessageBoxA, WinExec, CreateProcessA, and many others. This comprehensive approach enables the ransomware to effectively manipulate processes and execute its payload while evading detection. #### Final Payload After successfully executing the second stage, the ransomware proceeds to its final payload. It launches a resumed process with specific parameters, creates a new directory to store its binary, and utilizes the icacls.exe utility to deny permissions, thwarting attempts to modify or delete the ransomware. Furthermore, the ransomware schedules tasks to execute its payload at regular intervals, ensuring persistence and continued malicious activity. ![Fig_18_(1).png](https://sb-cms.s3.ap-south-1.amazonaws.com/Fig_18_1_14c84b11c5.png) ***StopCrypt Ransomware Note [Sonicwall](https://blog.sonicwall.com/en-us/2024/03/new-multi-stage-stopcrypt-ransomware/)*** #### Update A subsequent analysis confirmed the presence of a new variant of StopCrypt ransomware, further underscoring the ongoing evolution and adaptation of these malicious threats.

loading..   30-Apr-2024
loading..   1 min read
loading..

Android

Trojan

PixPirate analysis reveals advanced Android banking trojan. Accessibility abuse,...

PixPirate is a highly sophisticated financial remote access trojan (RAT) malware that poses a grave threat to the security of banking systems, particularly in Brazil. Developed by skilled threat actors, PixPirate employs advanced anti-research techniques, making it exceptionally elusive and challenging to detect. ## Technical Analysis ### Infection Vector PixPirate employs a two-pronged approach for infection, comprising a downloader and a droppee. This unique strategy allows the malware to operate stealthily and execute fraudulent activities seamlessly. The downloader, often disguised as a legitimate authentication app, lures victims into installing the malware. Once initiated, the droppee is deployed to execute malicious operations, facilitated by the downloader. ![PixPirate-infection-flow-1536x353.png](https://sb-cms.s3.ap-south-1.amazonaws.com/Pix_Pirate_infection_flow_1536x353_b5d6e10e0e.png) ***Attack Flow*** ### Evasion Techniques To evade detection, PixPirate leverages innovative hiding techniques. Unlike traditional malware, PixPirate does not have a main activity, rendering its icon absent from the victim's device. Instead, the downloader triggers the droppee to run through a custom service, circumventing traditional detection methods. ### Malicious Capabilities PixPirate boasts a wide array of malicious functionalities, including: - Manipulating and controlling applications - Keylogging - Collecting installed app lists - Installing and removing apps - Locking and unlocking device screens - Accessing phone accounts and contact lists - Tracking device location - Implementing anti-VM and anti-debugging measures - Maintaining persistence after reboot - Spreading through messaging apps like WhatsApp - Reading, editing, and deleting SMS messages - Disabling Google Play Protect ### Fraud Modus Operandi Primarily targeting Brazilian banks and leveraging the Pix payment platform, PixPirate executes fraudulent transactions seamlessly. By abusing the accessibility service, the malware intercepts banking credentials and initiates unauthorized Pix transactions. Additionally, PixPirate can manipulate transaction details, facilitating fund diversion to malicious actors' accounts. ### Code Analysis PixPirate's codebase exhibits sophistication, utilizing frameworks like Auto.js for automation and obfuscation techniques to hinder analysis. Modular scripts tailored for each targeted bank streamline the theft of credentials and execution of fraudulent transactions. Encryption routines further complicate code analysis, emphasizing the malware authors' commitment to evasion. ### Communication and C2 Infrastructure PixPirate communicates with its command and control (C2) server via HTTP, exchanging data in JSON format. The use of certificate pinning enhances communication security, thwarting interception attempts. A web-based management system facilitates remote control and monitoring of infected devices, providing threat actors with comprehensive oversight. Identifying C2 infrastructure is crucial for disrupting malware communication and preventing further attacks. Here's a deeper look at potential methods PixPirate might employ: #### **Domain Generation Algorithms (DGAs):** PixPirate could leverage algorithms to dynamically generate C2 domain names, making them difficult to blacklist. Analysis of the malware code (if a sample is available) might reveal the DGA logic, including the seed value and character permutation techniques used. #### **Fast Flux DNS:** C2 servers could be constantly changing their IP addresses through a pool managed by the attacker. This makes it challenging to pinpoint and block specific server locations. Network traffic monitoring for rapid DNS requests or suspicious domain resolutions could be indicative of this technique. #### **Steganography:** Data exfiltration or C2 communication might be hidden within seemingly innocuous files like images or audio. Advanced memory forensics or network traffic analysis tools with steganography detection capabilities would be necessary to uncover such techniques. #### **Peer-to-Peer (P2P) Networks:** The malware could utilize P2P communication protocols to establish C2 channels. This decentralization makes it harder to take down the C2 infrastructure as there's no single server point of failure. Monitoring for unusual network activity patterns associated with P2P protocols might be a red flag. #### **Communication Ports:** Non-standard ports like 8080 or 4445 are often used to evade detection by security measures that typically focus on monitoring common ports (e.g., port 80 for HTTP traffic). Analyzing network traffic logs for connections to these non-standard ports would be a crucial step in identifying C2 communication. #### **Traffic Patterns:** Short, intermittent bursts of network traffic are characteristic of beaconing or data exfiltration. Security solutions with traffic analysis capabilities can be configured to identify such patterns and trigger alerts. ### Payload Analysis HTTP POSTs are the exfiltration method due to their widespread use and ability to blend in with legitimate application traffic. Payload Obfuscation: Here are some techniques PixPirate might leverage to conceal exfiltrated data within HTTP POST requests: **Base64 Encoding:** A common method for transforming binary data (e.g., stolen credentials) into a printable format suitable for embedding within a URL or HTTP POST body. Decoding with Base64 would be required to reveal the original data. **Custom Encryption:** The malware might implement its own encryption algorithm to further obscure the data. Reverse engineering the malware code would be necessary to understand the custom encryption scheme and decrypt the payload. **Steganography Techniques:** Data can be hidden within seemingly harmless image or audio files using steganographic techniques. Forensic analysis tools with steganography detection capabilities would be crucial for uncovering such methods. **Packed or Compressed Data:** Techniques like ZIP or custom compression could be used to reduce the size of the exfiltrated data before transmission. Decompression or unpacking would be required to analyze the content. #### Identifying Specific Data Exfiltrated: Here's what to look for in the exfiltrated data: **Banking Credentials:** Usernames, passwords, and session tokens used for accessing financial applications. SMS Messages: Particularly those containing one-time passwords (OTPs) used for multi-factor authentication. **Device Information:** IMEI, phone number, and other identifiers that could be used for fingerprinting the victim's device. **Network Traffic Analysis Considerations:** **Examining the content-type header of HTTP POST requests:** It might reveal indicators of obfuscation, such as application/octet-stream for binary data or custom content types defined by the malware. **Correlating network traffic with application activity:** Monitoring spikes in network traffic coinciding with user interactions within banking apps could be a red flag. ### Disassembly Insights (Speculative - Sample Required) #### Obfuscation Mechanisms: **String Encryption:** Algorithms like XOR, RC4, or custom ciphers are likely to be employed to mask API calls and configuration data. **Junk Code Insertion:** Expect meaningless instructions or misleading control flow to complicate reverse engineering. **Dynamic Packing:** The malware might contain a self-unpacking routine to reveal core functionality only at execution time. #### Core Functionality **Keystroke Logging:** **Targeted APIs:** `AccessibilityService`, `InputMethodManager`, or potential overlays for keystroke interception. **Accessibility Abuse:** **Likely API Misuse:** `AccessibilityEvent` monitoring, `performAction()`, or `getText()` for UI manipulation and sensitive data extraction. **Financial Fraud Logic:** **Targeted Apps:** API calls specific to Brazilian banking applications expected. **Transaction Manipulation:** Potential modifications to EditText fields, simulated button presses within the victim's banking app. #### Evasion Techniques **Anti-Debugging:** **Debug Flag Checks:** May look for `android.os.Debug.isDebuggerConnected()`. **Emulator Detection:** Verification of device properties (IMEI, Build properties, etc.) suggestive of a sandbox environment. **Anti-Security Tools:** **Process Tampering:** Attempts to kill or disable security software processes by name or signature. Hook Evasion: Obfuscation of key API calls used by security tools to avoid analysis. **Runtime Obfuscation:** **Code Repackaging:** Dynamic loading of DEX files or native libraries to conceal functionality until executed. **Reflection:** API calls made indirectly to hinder static analysis. ### Key Capabilities - **Accessibility Service Abuse:** PixPirate leverages Android's Accessibility Service in a malicious manner to manipulate the user interface and steal sensitive data from banking applications. Here's a deeper look at the potential technical aspects of this abuse: - **Accessibility Service Permission Request:** The malware likely presents a rationale to the user requesting Accessibility Service permissions. This request could be disguised as a seemingly legitimate need for enhanced app functionality, tricking the user into granting extensive control over their device. - **AccessibilityEvent Monitoring:** Once Accessibility Service permissions are granted, PixPirate can monitor various AccessibilityEvents fired by the system and targeted banking applications. These events provide granular details about UI changes, element focus, and text input, allowing the malware to understand the current context and user interactions within the banking app. - **User Interaction Simulation:** By leveraging the Accessibility Service API, PixPirate can programmatically simulate user interactions. This could involve injecting clicks on specific buttons, modifying text fields (e.g., entering fraudulent payee information), or even swiping gestures used for navigation within the banking app. - **Content Extraction (Text & Data):** The AccessibilityService API grants access to the content of views and windows. PixPirate can exploit this functionality to steal sensitive data displayed on the screen, such as account balances, transaction details, or even one-time passwords (OTPs) used for multi-factor authentication. - **Potential Implementation Techniques:** **Android Framework APIs:** AccessibilityService APIs like AccessibilityNodeInfo.getText() or performAction() are likely used to interact with UI elements and extract data. **Custom View Groups/Overlays:** The malware might create custom views or overlays that lie on top of legitimate banking app screens. User interactions with the underlying banking app would be captured by the overlay, allowing PixPirate to steal input details. **Impact:** Accessibility Service abuse grants PixPirate extensive control over the user's device, enabling it to bypass user interaction requirements and manipulate banking applications for fraudulent purposes. - **Credential Theft:** PixPirate employs a multi-pronged approach to steal banking credentials, significantly increasing the likelihood of success. Here are some potential techniques the malware might leverage: **Keystroke Logging:** PixPirate can monitor keystrokes entered by the user on the device. This includes capturing login credentials, PINs, and any other sensitive information typed within the banking app or other financial platforms. **Phishing:** The malware might integrate phishing tactics within its functionality. Deceptive web pages or overlays resembling legitimate login screens could be displayed to the user, tricking them into surrendering their credentials unknowingly. **Accessibility Service Abuse:** As mentioned previously, Accessibility Service permissions can be exploited to read content displayed on the screen. This grants PixPirate access to any credentials or sensitive data entered by the user within the banking app interface. - **Fraudulent Transactions:** PixPirate's primary goal is to manipulate the Pix payment system, a popular Brazilian instant payment platform, within the victim's banking applications to initiate unauthorized fund transfers. Once it gains control through Accessibility Service abuse or stolen credentials, PixPirate can leverage its ability to simulate user interactions to automate the Pix transfer process. Here's a breakdown of the potential manipulative techniques: **Modifying Payee Information:** PixPirate can alter the payee details within the banking app interface. This could involve injecting malicious recipient names or bank accounts for fraudulent transactions. **Tampering with Transfer Amounts:** The malware can manipulate the transfer amount field to initiate unauthorized high-value transactions. **Bypassing Confirmation Screens:** Accessibility Service abuse allows PixPirate to automate confirmation screens typically presented during Pix transactions. The malware can bypass these safeguards with simulated clicks or actions, pushing through fraudulent transfers without the user's knowledge or consent. **SMS Interception:** This capability allows bypassing SMS-based two-factor authentication mechanisms. **Evasion and Concealment:** PixPirate uniquely disguises itself as a two-part malware ("downloader" and "droppee") and hides its launcher icon. This is likely supplemented with code obfuscation to hinder detection. ### Attack Chain - Victim is tricked into downloading the malware, potentially disguised as a legitimate application. - PixPirate's "downloader" component installs the core "droppee" payload. - The malware hides its icon to evade the user's notice. - May request Accessibility Service permissions under a false pretense or via social engineering. - Monitors banking app usage and steals credentials through Accessibility Service abuse (keystroke logging, UI content reading). - Intercepts incoming SMS messages to potentially obtain and bypass two-factor authentication codes. - C2 Communication May send stolen credentials and other sensitive data to attacker-controlled servers. - PixPirate programmatically manipulates the compromised banking app to initiate unauthorized fund transfers. ## End Note PixPirate represents a significant advancement in malware sophistication, posing a grave threat to the security of financial institutions, particularly in Latin America. Its multifaceted evasion techniques, coupled with automated fraud capabilities, underscore the urgency for robust cybersecurity measures. Security researchers must remain vigilant and collaborate to combat evolving threats like PixPirate effectively.

loading..   04-Apr-2024
loading..   1 min read