Article Content More information about BlackOasis APT is available to customers of Kaspersky Intelligence Reporting Service Contact: intelreports@kaspersky.com Introduction Kaspersky Lab has always worked closely with vendors to protect users As soon as we find new vulnerabilities we immediately inform the vendor in a responsible manner and provide all the details required for a fix The exploit was delivered through a Microsoft Office document and the final payload was the latest version of FinSpy malware We have reported the bug to Adobe who assigned it CVE-2017-11292 and released a patch earlier today: So far only one attack has been observed in our customer base, leading us to believe the number of attacks are minimal and highly targeted Analysis of the payload allowed us to confidently link this attack to an actor we track as “BlackOasis” BlackOasis Background We first became aware of BlackOasis’ activities in May 2016, while investigating another Adobe Flash zero day On May 10, 2016, Adobe warned of a vulnerability (CVE-2016-4117) affecting Flash Player 21.0.0.226 and earlier versions for Windows, Macintosh, Linux, and Chrome OS The vulnerability was actively being exploited in the wild Kaspersky Lab was able to identify a sample exploiting this vulnerability that was uploaded to a multi scanner system on May 8, 2016 Although the exact payload of the attack was no longer in the C&C, the same server was hosting multiple FinSpy installation packages Since the discovery of BlackOasis’ exploitation network, we’ve been tracking this threat actor with the purpose of better understanding their operations and targeting and have seen a couple dozen new attacks Part of injected code in winlogon process The payload calls out to three C2 servers for further control and exfiltration of data We have observed two of them used in the past with other FinSpy payloads Most recently one of these C2 servers was used together with CVE-2017-8759 in the attacks reported by FireEye in September 2017 These IPs and other previous samples tie closely to the BlackOasis APT cluster of FinSpy activity Targeting and Victims BlackOasis’ interests span a wide gamut of figures involved in Middle Eastern politics and verticals disproportionately relevant to the region This includes prominent figures in the United Nations, opposition bloggers and activists, and regional news correspondents During 2016, we observed a heavy interest in Angola, exemplified by lure documents indicating targets with suspected ties to oil, money laundering, and other illicit activities There is also an interest in international activists and think tanks Victims of BlackOasis have been observed in the following countries: Russia, Iraq, Afghanistan, Nigeria, Libya, Jordan, Tunisia, Saudi Arabia, Iran, Netherlands, Bahrain, United Kingdom and Angola Conclusions We estimate that the attack on HackingTeam in mid-2015 left a gap on the market for surveillance tools, which is now being filled by other companies One of these is Gamma International with their FinFisher suite of tools Although Gamma International itself was hacked by Phineas Fisher in 2014, the breach was not as serious as it was in the case of HackingTeam Additionally, Gamma had two years to recover from the attack and pick up the pace We believe the number of attacks relying on FinFisher software, supported by zero day exploits such as the ones described here will continue to grow Additionally, this may break any other necessary resources that rely on Flash and of course, it will not protect against exploits for other third party software Contact: intelreports@kaspersky.com Acknowledgements We would like to thank the Adobe Product Security Incident Response Team (PSIRT) for working with us to identify and patch this vulnerability References  Adobe Bulletin https://helpx.adobe.com/security/products/flash-player/apsb17-32.html  Indicators of compromise 4a49135d2ecc07085a8b7c5925a36c0a 89.45.67[.]107
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content More information about BlackOasis APT is available to customers of Kaspersky Intelligence Reporting Service Contact: intelreports@kaspersky.com Introduction Kaspersky Lab has always worked closely with vendors to protect users As soon as we find new vulnerabilities we immediately inform the vendor in a responsible manner and provide all the details required for a fix The exploit was delivered through a Microsoft Office document and the final payload was the latest version of FinSpy malware We have reported the bug to Adobe who assigned it CVE-2017-11292 and released a patch earlier today: So far only one attack has been observed in our customer base, leading us to believe the number of attacks are minimal and highly targeted Analysis of the payload allowed us to confidently link this attack to an actor we track as “BlackOasis” BlackOasis Background We first became aware of BlackOasis’ activities in May 2016, while investigating another Adobe Flash zero day On May 10, 2016, Adobe warned of a vulnerability (CVE-2016-4117) affecting Flash Player 21.0.0.226 and earlier versions for Windows, Macintosh, Linux, and Chrome OS The vulnerability was actively being exploited in the wild Kaspersky Lab was able to identify a sample exploiting this vulnerability that was uploaded to a multi scanner system on May 8, 2016 Although the exact payload of the attack was no longer in the C&C, the same server was hosting multiple FinSpy installation packages Since the discovery of BlackOasis’ exploitation network, we’ve been tracking this threat actor with the purpose of better understanding their operations and targeting and have seen a couple dozen new attacks Part of injected code in winlogon process The payload calls out to three C2 servers for further control and exfiltration of data We have observed two of them used in the past with other FinSpy payloads Most recently one of these C2 servers was used together with CVE-2017-8759 in the attacks reported by FireEye in September 2017 These IPs and other previous samples tie closely to the BlackOasis APT cluster of FinSpy activity Targeting and Victims BlackOasis’ interests span a wide gamut of figures involved in Middle Eastern politics and verticals disproportionately relevant to the region This includes prominent figures in the United Nations, opposition bloggers and activists, and regional news correspondents During 2016, we observed a heavy interest in Angola, exemplified by lure documents indicating targets with suspected ties to oil, money laundering, and other illicit activities There is also an interest in international activists and think tanks Victims of BlackOasis have been observed in the following countries: Russia, Iraq, Afghanistan, Nigeria, Libya, Jordan, Tunisia, Saudi Arabia, Iran, Netherlands, Bahrain, United Kingdom and Angola Conclusions We estimate that the attack on HackingTeam in mid-2015 left a gap on the market for surveillance tools, which is now being filled by other companies One of these is Gamma International with their FinFisher suite of tools Although Gamma International itself was hacked by Phineas Fisher in 2014, the breach was not as serious as it was in the case of HackingTeam Additionally, Gamma had two years to recover from the attack and pick up the pace We believe the number of attacks relying on FinFisher software, supported by zero day exploits such as the ones described here will continue to grow Additionally, this may break any other necessary resources that rely on Flash and of course, it will not protect against exploits for other third party software Contact: intelreports@kaspersky.com Acknowledgements We would like to thank the Adobe Product Security Incident Response Team (PSIRT) for working with us to identify and patch this vulnerability References  Adobe Bulletin https://helpx.adobe.com/security/products/flash-player/apsb17-32.html  Indicators of compromise 4a49135d2ecc07085a8b7c5925a36c0a 89.45.67[.]107 ### Response: .