company logo


Our Product

We are Reshaping the way Developers find and fix vulnerabilities before they get exploited.


By Industry




IT & Telecom


By Role


DevOps Engineer


Resource Library

Get actionable insight straight from our threat Intel lab to keep you informed about the ever-changing Threat landscape.

Subscribe to Our Weekly Threat Digest


Contact Us

Have queries, feedback or prospects? Get in touch and we shall be with you shortly.





Raspberry Robin: Advanced Worm Exploits 1-Day, Discord Distribution

Raspberry Robin malware aggressively targets unpatched systems with new 1-day exploits, deploying ransomware and stealing sensitive data.

11 min read

Related Articles




PixPirate analysis reveals advanced Android banking trojan. Accessibility abuse,...

PixPirate is a highly sophisticated financial remote access trojan (RAT) malware that poses a grave threat to the security of banking systems, particularly in Brazil. Developed by skilled threat actors, PixPirate employs advanced anti-research techniques, making it exceptionally elusive and challenging to detect. ## Technical Analysis ### Infection Vector PixPirate employs a two-pronged approach for infection, comprising a downloader and a droppee. This unique strategy allows the malware to operate stealthily and execute fraudulent activities seamlessly. The downloader, often disguised as a legitimate authentication app, lures victims into installing the malware. Once initiated, the droppee is deployed to execute malicious operations, facilitated by the downloader. ![PixPirate-infection-flow-1536x353.png]( ***Attack Flow*** ### Evasion Techniques To evade detection, PixPirate leverages innovative hiding techniques. Unlike traditional malware, PixPirate does not have a main activity, rendering its icon absent from the victim's device. Instead, the downloader triggers the droppee to run through a custom service, circumventing traditional detection methods. ### Malicious Capabilities PixPirate boasts a wide array of malicious functionalities, including: - Manipulating and controlling applications - Keylogging - Collecting installed app lists - Installing and removing apps - Locking and unlocking device screens - Accessing phone accounts and contact lists - Tracking device location - Implementing anti-VM and anti-debugging measures - Maintaining persistence after reboot - Spreading through messaging apps like WhatsApp - Reading, editing, and deleting SMS messages - Disabling Google Play Protect ### Fraud Modus Operandi Primarily targeting Brazilian banks and leveraging the Pix payment platform, PixPirate executes fraudulent transactions seamlessly. By abusing the accessibility service, the malware intercepts banking credentials and initiates unauthorized Pix transactions. Additionally, PixPirate can manipulate transaction details, facilitating fund diversion to malicious actors' accounts. ### Code Analysis PixPirate's codebase exhibits sophistication, utilizing frameworks like Auto.js for automation and obfuscation techniques to hinder analysis. Modular scripts tailored for each targeted bank streamline the theft of credentials and execution of fraudulent transactions. Encryption routines further complicate code analysis, emphasizing the malware authors' commitment to evasion. ### Communication and C2 Infrastructure PixPirate communicates with its command and control (C2) server via HTTP, exchanging data in JSON format. The use of certificate pinning enhances communication security, thwarting interception attempts. A web-based management system facilitates remote control and monitoring of infected devices, providing threat actors with comprehensive oversight. Identifying C2 infrastructure is crucial for disrupting malware communication and preventing further attacks. Here's a deeper look at potential methods PixPirate might employ: #### **Domain Generation Algorithms (DGAs):** PixPirate could leverage algorithms to dynamically generate C2 domain names, making them difficult to blacklist. Analysis of the malware code (if a sample is available) might reveal the DGA logic, including the seed value and character permutation techniques used. #### **Fast Flux DNS:** C2 servers could be constantly changing their IP addresses through a pool managed by the attacker. This makes it challenging to pinpoint and block specific server locations. Network traffic monitoring for rapid DNS requests or suspicious domain resolutions could be indicative of this technique. #### **Steganography:** Data exfiltration or C2 communication might be hidden within seemingly innocuous files like images or audio. Advanced memory forensics or network traffic analysis tools with steganography detection capabilities would be necessary to uncover such techniques. #### **Peer-to-Peer (P2P) Networks:** The malware could utilize P2P communication protocols to establish C2 channels. This decentralization makes it harder to take down the C2 infrastructure as there's no single server point of failure. Monitoring for unusual network activity patterns associated with P2P protocols might be a red flag. #### **Communication Ports:** Non-standard ports like 8080 or 4445 are often used to evade detection by security measures that typically focus on monitoring common ports (e.g., port 80 for HTTP traffic). Analyzing network traffic logs for connections to these non-standard ports would be a crucial step in identifying C2 communication. #### **Traffic Patterns:** Short, intermittent bursts of network traffic are characteristic of beaconing or data exfiltration. Security solutions with traffic analysis capabilities can be configured to identify such patterns and trigger alerts. ### Payload Analysis HTTP POSTs are the exfiltration method due to their widespread use and ability to blend in with legitimate application traffic. Payload Obfuscation: Here are some techniques PixPirate might leverage to conceal exfiltrated data within HTTP POST requests: **Base64 Encoding:** A common method for transforming binary data (e.g., stolen credentials) into a printable format suitable for embedding within a URL or HTTP POST body. Decoding with Base64 would be required to reveal the original data. **Custom Encryption:** The malware might implement its own encryption algorithm to further obscure the data. Reverse engineering the malware code would be necessary to understand the custom encryption scheme and decrypt the payload. **Steganography Techniques:** Data can be hidden within seemingly harmless image or audio files using steganographic techniques. Forensic analysis tools with steganography detection capabilities would be crucial for uncovering such methods. **Packed or Compressed Data:** Techniques like ZIP or custom compression could be used to reduce the size of the exfiltrated data before transmission. Decompression or unpacking would be required to analyze the content. #### Identifying Specific Data Exfiltrated: Here's what to look for in the exfiltrated data: **Banking Credentials:** Usernames, passwords, and session tokens used for accessing financial applications. SMS Messages: Particularly those containing one-time passwords (OTPs) used for multi-factor authentication. **Device Information:** IMEI, phone number, and other identifiers that could be used for fingerprinting the victim's device. **Network Traffic Analysis Considerations:** **Examining the content-type header of HTTP POST requests:** It might reveal indicators of obfuscation, such as application/octet-stream for binary data or custom content types defined by the malware. **Correlating network traffic with application activity:** Monitoring spikes in network traffic coinciding with user interactions within banking apps could be a red flag. ### Disassembly Insights (Speculative - Sample Required) #### Obfuscation Mechanisms: **String Encryption:** Algorithms like XOR, RC4, or custom ciphers are likely to be employed to mask API calls and configuration data. **Junk Code Insertion:** Expect meaningless instructions or misleading control flow to complicate reverse engineering. **Dynamic Packing:** The malware might contain a self-unpacking routine to reveal core functionality only at execution time. #### Core Functionality **Keystroke Logging:** **Targeted APIs:** `AccessibilityService`, `InputMethodManager`, or potential overlays for keystroke interception. **Accessibility Abuse:** **Likely API Misuse:** `AccessibilityEvent` monitoring, `performAction()`, or `getText()` for UI manipulation and sensitive data extraction. **Financial Fraud Logic:** **Targeted Apps:** API calls specific to Brazilian banking applications expected. **Transaction Manipulation:** Potential modifications to EditText fields, simulated button presses within the victim's banking app. #### Evasion Techniques **Anti-Debugging:** **Debug Flag Checks:** May look for `android.os.Debug.isDebuggerConnected()`. **Emulator Detection:** Verification of device properties (IMEI, Build properties, etc.) suggestive of a sandbox environment. **Anti-Security Tools:** **Process Tampering:** Attempts to kill or disable security software processes by name or signature. Hook Evasion: Obfuscation of key API calls used by security tools to avoid analysis. **Runtime Obfuscation:** **Code Repackaging:** Dynamic loading of DEX files or native libraries to conceal functionality until executed. **Reflection:** API calls made indirectly to hinder static analysis. ### Key Capabilities - **Accessibility Service Abuse:** PixPirate leverages Android's Accessibility Service in a malicious manner to manipulate the user interface and steal sensitive data from banking applications. Here's a deeper look at the potential technical aspects of this abuse: - **Accessibility Service Permission Request:** The malware likely presents a rationale to the user requesting Accessibility Service permissions. This request could be disguised as a seemingly legitimate need for enhanced app functionality, tricking the user into granting extensive control over their device. - **AccessibilityEvent Monitoring:** Once Accessibility Service permissions are granted, PixPirate can monitor various AccessibilityEvents fired by the system and targeted banking applications. These events provide granular details about UI changes, element focus, and text input, allowing the malware to understand the current context and user interactions within the banking app. - **User Interaction Simulation:** By leveraging the Accessibility Service API, PixPirate can programmatically simulate user interactions. This could involve injecting clicks on specific buttons, modifying text fields (e.g., entering fraudulent payee information), or even swiping gestures used for navigation within the banking app. - **Content Extraction (Text & Data):** The AccessibilityService API grants access to the content of views and windows. PixPirate can exploit this functionality to steal sensitive data displayed on the screen, such as account balances, transaction details, or even one-time passwords (OTPs) used for multi-factor authentication. - **Potential Implementation Techniques:** **Android Framework APIs:** AccessibilityService APIs like AccessibilityNodeInfo.getText() or performAction() are likely used to interact with UI elements and extract data. **Custom View Groups/Overlays:** The malware might create custom views or overlays that lie on top of legitimate banking app screens. User interactions with the underlying banking app would be captured by the overlay, allowing PixPirate to steal input details. **Impact:** Accessibility Service abuse grants PixPirate extensive control over the user's device, enabling it to bypass user interaction requirements and manipulate banking applications for fraudulent purposes. - **Credential Theft:** PixPirate employs a multi-pronged approach to steal banking credentials, significantly increasing the likelihood of success. Here are some potential techniques the malware might leverage: **Keystroke Logging:** PixPirate can monitor keystrokes entered by the user on the device. This includes capturing login credentials, PINs, and any other sensitive information typed within the banking app or other financial platforms. **Phishing:** The malware might integrate phishing tactics within its functionality. Deceptive web pages or overlays resembling legitimate login screens could be displayed to the user, tricking them into surrendering their credentials unknowingly. **Accessibility Service Abuse:** As mentioned previously, Accessibility Service permissions can be exploited to read content displayed on the screen. This grants PixPirate access to any credentials or sensitive data entered by the user within the banking app interface. - **Fraudulent Transactions:** PixPirate's primary goal is to manipulate the Pix payment system, a popular Brazilian instant payment platform, within the victim's banking applications to initiate unauthorized fund transfers. Once it gains control through Accessibility Service abuse or stolen credentials, PixPirate can leverage its ability to simulate user interactions to automate the Pix transfer process. Here's a breakdown of the potential manipulative techniques: **Modifying Payee Information:** PixPirate can alter the payee details within the banking app interface. This could involve injecting malicious recipient names or bank accounts for fraudulent transactions. **Tampering with Transfer Amounts:** The malware can manipulate the transfer amount field to initiate unauthorized high-value transactions. **Bypassing Confirmation Screens:** Accessibility Service abuse allows PixPirate to automate confirmation screens typically presented during Pix transactions. The malware can bypass these safeguards with simulated clicks or actions, pushing through fraudulent transfers without the user's knowledge or consent. **SMS Interception:** This capability allows bypassing SMS-based two-factor authentication mechanisms. **Evasion and Concealment:** PixPirate uniquely disguises itself as a two-part malware ("downloader" and "droppee") and hides its launcher icon. This is likely supplemented with code obfuscation to hinder detection. ### Attack Chain - Victim is tricked into downloading the malware, potentially disguised as a legitimate application. - PixPirate's "downloader" component installs the core "droppee" payload. - The malware hides its icon to evade the user's notice. - May request Accessibility Service permissions under a false pretense or via social engineering. - Monitors banking app usage and steals credentials through Accessibility Service abuse (keystroke logging, UI content reading). - Intercepts incoming SMS messages to potentially obtain and bypass two-factor authentication codes. - C2 Communication May send stolen credentials and other sensitive data to attacker-controlled servers. - PixPirate programmatically manipulates the compromised banking app to initiate unauthorized fund transfers. ## End Note PixPirate represents a significant advancement in malware sophistication, posing a grave threat to the security of financial institutions, particularly in Latin America. Its multifaceted evasion techniques, coupled with automated fraud capabilities, underscore the urgency for robust cybersecurity measures. Security researchers must remain vigilant and collaborate to combat evolving threats like PixPirate effectively.

loading..   04-Apr-2024
loading..   1 min read



Uncover the latest tactics of Russia's Turla APT. This technical report analyze...

Turla, a Russian state-sponsored Advanced Persistent Threat (APT) group, conducts sophisticated cyberespionage against government institutions, NGOs, and organizations aligned with Russian interests. This [Threat Research]( provides a detailed analysis of Turla's historical context, recent operations named "Turla Wields," and a thorough technical analysis of their tools and techniques. ### Origins and Historical Context Turla, also known as Snake, Uroburos, Waterbug, and Venomous Bear, emerged in the late 1990s, targeting governments and militaries globally. Their operations align with Russia's geopolitical interests, focusing on nations bordering Russia and former Soviet states. Turla is adept at evading detection, preferring long-term intelligence gathering over disruptive attacks. ### Turla Wields: Recent Attack Trends and Targeting Recent campaigns target NGOs, particularly those supporting Ukrainian causes. Turla exploits legacy infections like Andromeda botnet, employs spear-phishing with weaponized PDFs, and constantly evolves its toolkit, including TinyTurla-NG and TurlaPower-NG. Motives range from military intelligence gathering to destabilizing opposition parties and supporting hybrid warfare. ### Technical Analysis of Turla Techniques Turla's initial infection vectors include spear-phishing, zero-day vulnerabilities, and compromised websites. They establish persistence using TinyTurla-NG, leveraging DLL loading and file masquerading. Communication with command and control servers is disguised within regular web traffic, employing redundant C2s for resilience. ### Data Exfiltration Techniques Turla employs custom tools like TurlaPower-NG to target password managers and browser history databases. Data exfiltration involves file archiving and staged uploads, obscuring their activities over time. ### "Living off the Land" Approach Turla increasingly relies on PowerShell for operations, employing obfuscation techniques and disabling command history recording to evade detection. ### Countermeasures and Defense Considerations Patching vulnerabilities, especially zero-days, is crucial. Endpoint Detection and Response (EDR) platforms with behavioral baselining and anomaly detection can spot Turla's subtle activities. Application and script whitelisting, along with security awareness training, enhance defenses. Web infrastructure hardening and intrusion detection systems are also recommended. ## Technical Analysis: Evolving Toolset Breakdown ### TinyTurla-NG and TurlaPower-NG Deep Dive #### TinyTurla-NG - Network Protocols: HTTP/HTTPS with custom headers and unusual User-Agent strings. - C2 Commands: Task scheduling logic and data encoding for exfiltration. - Persistence: Registry hiding, DLL hijacking methods, and boot-time execution. #### TurlaPower-NG - Target Files: Focus on password managers and browser history SQLite databases. - Data Extraction Logic: Parsing methods and obfuscation techniques. - Archiving: Compression and encryption methods used for file uploads. ### Obfuscation and Anti-Forensics Turla employs meaningless variable names, packed executables, and sandbox evasion techniques to hinder analysis. They ensure minimal forensic traces by cleaning temporary files and overwriting disk images. ### Historical Malware Progression Turla's tools have evolved from executable-based to PowerShell-based, leveraging trusted Windows programs for stealth and adaptability. Staged exfiltration and variable beaconing remain consistent features across toolsets. ## Victim Profiling & Targeting Patterns ### Target Industries & Organizations Turla targets a range of industries, including defense, technology, government, diplomacy, and NGOs. Specific organizations and job titles vary, with a focus on technical staff for network compromise and decision-makers for policy insight. ### Geographic Shifts & Geopolitical Correlation Turla's targeting intensifies around geopolitical events involving Russia, such as elections and conflicts. Analysis reveals patterns of intelligence gathering preceding significant actions, indicating strategic alignment with Russian interests. ## Code Snippets for Detection The following are representative indicators based on open-sourced reports on TinyTurla-NG and similar C2 mechanisms Turla often uses. Use with caution – APTs evolve, so these patterns may change in future samples: `Registry Modification (Possible Turla DLL Loading)` HKEY_CURRENT_USER\Software\Classes\CLSID\{<unusual-looking-GUID>} –Suspicious values within this key can point to persistence via COM object loading `Unusual HTTP Beaconing Traffic Patterns` # Example YARA-like Pattern – simplified - targeting WordPress C2 traffic rule turla_wp_beacon { meta: description = "Possible Turla compromise of WordPress sites for C2" author = "<Your Org Name>" date = "2024-02-27" strings: $http_header = {Content-Type: multipart/form-data;} $beacon_id = /page=[0-9]{8}/ condition: $http_header and $beacon_id and all of them } `PowerShell Obfuscation Techniques (Simplified Examples)` PowerShell # Base64 Encoding to Conceal Commands $cmd = "iex <base64 encoded command>" Invoke-Expression $cmd # Modifying Command Execution Flow $var = 'Something'; $var[3..1] -join '' # Reconstructs a hidden string # PowerShell History Evasion Set-PSReadLineOption -HistorySaveStyle SaveNothing ## Conclusion Turla's persistence and adaptability make them a formidable threat to global security. Understanding their techniques and motivations is crucial for developing effective defense strategies. By implementing rigorous countermeasures and leveraging threat intelligence, organizations can mitigate the risk posed by Turla's cyberespionage activities.

loading..   21-Feb-2024
loading..   1 min read



Explore ColdRiver's Spica malware in this detailed threat analysis. Uncover Russ...

ColdRiver, a Russia-backed advanced persistent threat (APT) group, has advanced cyber espionage tactics by introducing a custom malware named "Spica." This marks a substantial departure from their traditional long-con credential phishing methods. Google's Threat Analysis Group (TAG) has been actively instrumental in tracking ColdRiver's activities, highlighting their ever-evolving techniques. This [Threat Research]( aims to extend this analysis of ColdRiver, dissecting and scrutinizing the critical underlying aspects of its Spica malware, emphasizing the threat landscape and potential countermeasures. ## Contextual Background ColdRiver, also known as Blue Charlie, Callisto, Star Blizzard, or UNC4057, primarily targets high-profile individuals in NGOs, former intelligence and military officials, and NATO governments. Historically focused on credential phishing, the group has now extended its capabilities to deliver malware, specifically using PDFs as lure documents. ## Evolution of Tactics The progression from traditional phishing to malware delivery is a strategic transition [observed]( by TAG. ColdRiver employs impersonation accounts, posing as experts or individuals affiliated with the target, to establish trust. Recent findings reveal an intricate tactic where benign PDFs, presented as op-eds or articles, are delivered to targets. If the target cannot decipher the encrypted content, a link to a "decryption" utility is sent, introducing the Spica backdoor. ## Spica Malware Analysis ### Infiltration and Execution Spica, written in Rust, utilizes JSON over websockets for command and control (C2). Upon execution, it decodes an embedded PDF, serving as a decoy while establishing persistence and connecting to the C2 server. The malware deploys an obfuscated PowerShell command, creating a scheduled task named "CalendarChecker" for persistence. ### Functional Capabilities Spica functions as a versatile tool, executing arbitrary shell commands, stealing cookies from various browsers, uploading and downloading files, perusing the filesystem, and enumerating documents for exfiltration. The presence of multiple variants suggests a continuous evolution of the backdoor. ### Timeline and Persistence TAG first observed Spica in September 2023, but they believe its usage dates back to November 2022. The malware, identified as "Proton-decrypter.exe," was likely active around August and September 2023. TAG notes the potential existence of multiple Spica versions, each with distinct embedded decoy documents. ## Implications and Targets ColdRiver's strategic shift indicates a desire for broader capabilities, allowing them to conduct operations beyond conventional phishing. The targets include Ukraine, NATO countries, academic institutions, and NGOs. While specific victim profiles remain undisclosed, TAG emphasizes the limited and targeted use of Spica, aligning with ColdRiver's established tactics. ## Defensive Measures To counter the ColdRiver threat, TAG emphasizes proactive security measures. All identified domains, websites, and files associated with the threat are added to Safe Browsing blocklists. Gmail and Workspace users targeted by government-backed attackers receive alerts, encouraging them to enable Enhanced Safe Browsing for Chrome and ensure device updates. ## Code and Technical Insights ### Spica Backdoor Code TAG provides a YARA rule for detecting the Spica backdoor, outlining specific strings and patterns indicative of its presence. This code analysis aids cybersecurity professionals in identifying and mitigating potential threats. ```yara rule SPICA__Strings { meta: author = “Google TAG” description = "Rust backdoor using websockets for C2 and embedded decoy PDF" hash = "37c52481711631a5c73a6341bd8bea302ad57f02199db7624b580058547fb5a9" strings: $s1 = "os_win.c:%d: (%lu) %s(%s) - %s" $s2 = "winWrite1" $s3 = "winWrite2" $s4 = "DNS resolution panicked" $s5 = "struct Dox" $s6 = "struct Telegram" $s8 = "struct Download" $s9 = "spica" $s10 = "Failed to open the subkey after setting the value." $s11 = "Card Holder: Bull Gayts" $s12 = "Card Number: 7/ 3310 0195 4865" $s13 = "CVV: 592" $s14 = "Card Expired: 03/28" $a0 = "agent\\src\\" $a1 = "agent\\src\\" $a2 = "agent\\src\\" $a3 = "agent\\src\\command\\" $a4 = "agent\\src\\command\\" $a5 = "agent\\src\\command\\" $a6 = "agent\\src\\command\\" $a7 = "agent\\src\\command\\" $a8 = "agent\\src\\command\\cookie\\" $a9 = "agent\\src\\command\\cookie\\browser\\" $a10 = "agent\\src\\command\\cookie\\browser\\" condition: 7 of ($s*) or 5 of ($a*) }. ``` ## Conclusion ColdRiver's adoption of the Spica malware turned out to be a calculated evolution in their threat evolution. This extended analysis presented here offers a thorough breakdown of these tactics and techniques, Spica's technical intricacies, and recommended defensive measures.

loading..   31-Jan-2024
loading..   1 min read