In this week’s ShadowTalk, we discuss the Robert Mueller indictment against 12 Russian individuals for alleged US election interference. However, rather than dwell on issues of attribution and geopolitics, we focus on the detailed tactics, techniques and procedures laid out in the indictment. Katie Nickels, a member of the MITRE team, joins Rafael Amado and Richard Gold us to discuss the ATT&CK™ framework in greater detail, as well as the key lessons that organizations can takeaway.

 

APT-28 shifts focus to Italian defense sector with new X-Agent variant

A new variant of the “X-Agent” backdoor malware was identified in a campaign targeting defense entities in Italy. The highlyprogrammable malware has been associated with APT-28 (aka Fancy Bear, Sofacy, Pawn Storm, Sednit), and was previously observed in attacks targeting the Democratic National Committee in 2016.

Banking trojans distributed via Google Play store

Malware distributors used downloaders hosted on the Google Play store to target Turkish-speaking Android users with variants of the Marcher and BankBot Anubis banking trojans. Placing downloaders on an app store rather than the malware is a tactic adopted by cyber criminals as downloaders are less likely to trigger the app store’s security measures, as they appear innocuous. This campaign was potentially part of a cybercrime-as-a-service offering, as significant resources were invested in to the fraudulent apps that masked the downloaders. Official download stores remain a prized target for malware distributors, as they offer a wider audience of potential victims, and abuses the trust users place in the legitimate download resource.

 

Theft at cryptocurrency exchange raises questions over regulations

An unknown threat actor has stolen approximately USD 13.5 million from Israeli cryptocurrency exchange, Bancor. Although no details about the attacker’s tactics have been released, some security researchers have alleged that the attackers exploited permissioned backdoors used by Bancor to freeze and control transactions. This has highlighted the lack of regulation of exchanges, something which is likely to continue to drive criminal attacks against the sector, which they perceive to be a low-risk high-reward target.

 

Sub-group of Lazarus Group observed conducting reconnaissance against South Korean government entities

Trend Micro identified reconnaissance activity which was likely a prelude to a watering hole attack targeting government entities in South Korea. The activity was attributed to a branch of the Lazarus Group, known as “Andariel Group”, and aligns with previous Lazarus Group activity. The attackers sought information on specific ActiveX objects, including two software programs known to be used by South Korean government institutions. The group were previously observed conducting similar reconnaissance in January 2017, following which, a targeted watering hole attack using a zero-day exploit was conducted in April 2017.

 

To stay up to date with the latest Digital Shadows (now ReliaQuest) threat intelligence and news, subscribe to our threat intelligence emails here.