Article Content Unit 42 researchers have been tracking Subaat, an attacker, since 2017 Recently Subaat drew our attention due to renewed targeted attack activity Part of monitoring Subaat included realizing the actor was possibly part of a larger crew of individuals responsible for carrying out targeted attacks against worldwide governmental organizations Technical analysis on some of the attacks as well as attribution links with Pakistan actors have been already depicted by 360 and Tuisec, in which they found interesting connections to a larger group of attackers Unit 42 researchers have been tracking, which we are calling Gorgon Group In addition to the numerous targeted attacks, Unit 42 discovered that the group also performed a litany of attacks and operations around the globe, involving both criminal as well as targeted attacks Starting in February 2018, Palo Alto Networks Unit 42 identified a campaign of attacks performed by members of Gorgon Group targeting governmental organizations in the United Kingdom, Spain, Russia, and the United States Additionally, during that time, members of Gorgon Group were also performing criminal operations against targets across the globe, often using shared infrastructure with their targeted attack operations Gorgon Group’s activity is interesting because in addition to traditional command and control (C2) domain utilization, Gorgon Group used common URL shortening services to download payloads; ultimately providing an extensive list of click counts and statistical data Also, interestingly, Gorgon Group has a diverse and active criminal element On much of the C2 infrastructure we identified several crimeware family samples RATs such as NjRat and infostealers like Lokibot were leveraging the same C2 infrastructure as that of the targeted attacks Using numerous decoy documents and phishing emails, both styles of attacks lacked overall sophistication, but the effectiveness of this group and campaign cannot be denied Attack Delivery and Infrastructure Analysis The attack methodology, as well as analysis of several of the “.vbs”, “.doc” and “.exe” samples found hosted in the attacker’s infrastructure has been covered by 360 and Tuisec Both 360 and Tuisec found that the most commonly observed and consistent attack pattern consists of the following stages:  Figure 1 Basic attacker methodology At the initial stage, the phishing attempts are kept very simple and lightweight by using OLE2Link objects that will usually make use of URL shortening services such as Bitly and t2m[.]io Figure 2 OLE2Link content example   While investigating the domains and infrastructure used by the phishing components of Gorgon Group, Unit 42 researchers witnessed several common operational security flaws with Gorgon Group’s actors throughout their many campaigns It was one of these OPSEC failures that gave us an interesting cross-section of malware Gorgon Group is using Additionally, there was a plethora of malware samples that were criminal in nature Figure 3 Examples of domain patterns The Gorgon Group Crew Breakdown Finding accessible directories, in combination with their other operational security failures, made it easy to start connecting the dots on Gorgon Group members 360 and Tuisec already identified some Gorgon Group members In addition to Subaat, we counted an additional four actors performing attacks as part of Gorgon Group While it’s not known if the attackers physically reside in Pakistan, all members of Gorgon Group purport to be in Pakistan based on their online personas fudpages  One member of Gorgon Group- we’re calling ‘fudpages’, was found during this campaign activity based on their utilization of shared infrastructure One specific Microsoft document drew our attention (446e1c80102c8b9662d66d44525cb9f519369061b02446e0d4cd30cd26d79a25) This Microsoft Word document was sent via email to several industries across the US and Switzerland We noticed that this document pulls down additional malware from a C2 also being used in attacks by other Gorgon Group members.  Additionally, this document communicates to a relatively new piece of C2 infrastructure- umarguzardijye[.]com, which is hosted on 91[.]234[.]99[.]206 Figure 4 WHOIS information for umarguzardijye[.]com Fudpages, similar to other Gorgon Group members, made many of the same OPSEC failures of his or her fellow Gorgon Group members Figure 5 Open directory of umarguzardijye[.]com The WHOIS record for our new domain, umarguzardijye[.]com, shows that the registrant organization is “fudpages” and the address provided in Pakistan When looking closer at the IP hosting umarguzardijye[.]com, we noticed 91[.]234[.]99[.]206 hosts two additional domains that drew our attention-fudpages[.]ru and fudpage[.]ru Fudpage appears to be a small marketplace selling bulletproof hosting, RDP sessions, fake documents and a litany of additional malicious wares Figure 6 Advertisement website for FUD pages and spamming tools Listed on fudpage’s marketplace are several pieces of contact information, which ultimately led us to an underground persona that was selling, distributing and trading maliciousness across underground forums Figure 7 Underground forum posting for RAT Operating underground since at least 2016, fudpages is also active on streaming sites like Youtube, where they use it as an advertising platform Figure 8 Youtube video posting on how to perform malicious activities Like all of Gorgon Group’s members, Fudpage’s online profile, infrastructure utilization and standardization, connects them back to Gorgon Group This connection to Gorgon Group helps illustrate the seemingly standardized methodologies Gorgon Group most often employs The Tale of Two Intentions: Criminal and Targeted As part of the investigation, Unit 42 researchers were able to identify an interesting characteristic about how the Gorgon Group crew uses shared infrastructure between cybercrime and targeted attacks The crew combines both regular crime and targeted attack objectives using the same domain infrastructure over time, rarely changing their TTPs Starting in mid-February, Unit 42 researchers have been tracking an active campaign sharing a significant portion of infrastructure leveraged by Gorgon Group for criminal and targeted attacks Overlap between infrastructure While looking at the total cluster of Gorgon Group activity, it’s also interesting to look at the total click volume during the campaign’s timeframe Leveraging click counts for the campaign for Bitly, we were able to see Gorgon Group’s activity volume increase throughout April Figure 10 Total clicks performed on Gorgon Group infrastructure over time Looking specifically at one domain used in both cybercrime and targeted attacks, we can see a micro viewpoint into their campaign Between April 1, 2018 and May 30, 2018, we observed the domain stevemike-fireforce[.]info used in a Gorgon Group cybercrime campaign involving more than 2,300 emails and 19 documents in the initial attack This same domain was also used during the same period of time in targeted attacks against several worldwide nation state agencies Analysis of the data allowed Unit 42 researchers to make some interesting conclusions:  Several unique domains are used for both cybercrime and targeted attacks The amount of sessions for cybercrime is higher than targeted, as expected There is no specific pattern on when targeted attacks happen, the domains can initially be used for cybercrime and then quickly utilized in a targeted attack with little warning As a graphical representation, Figure 11, below, indicates the amount of unique sessions observed for this domain over the campaign’s operational time, representing the attack intention in two separate areas It’s interesting to observe on April 24th, this domain delivers a targeted attack aimed at several worldwide governmental bodies, in the middle being of also being used in the delivery of a malspam campaign The subject used in this case of targeted attack was “Pakistan eying Sukhoi-35 figther planes as part of defense deal from Rusia”:    Figure 11 Crimeware activity versus targeted activity against stevemike-fireforce[.]info In order to have a better idea of the volume of unique attacks per date and intention, see the following volume-based representation in Figure 12, where targeted attack volumes are represented in red and crime in green:  Figure 12 Volume of crimeware activity versus targeted attacks using stevemike-fireforce[.]info Focusing on one domain allowed us to quickly understand its usage and better understand how it interconnects to a larger malspam campaign Intention #1: Cybercrime Criminal attacks are not new to this crew, some of which was covered in our previous blog for Gorgon Group member Subaat During the current campaign, Gorgon Group’s criminal enterprises netted 132,840 Bitly clicks from mid-February to the present Targeting a large cross-section of industries, there was little in terms of targeting during their criminal activity Figure 13 Criminal Attacks Bitly Link Clicks Worldwide A majority of the crimeware distribution was done via standard malspam campaigns leveraging well-known “Purchase Order” and “SWIFT” lures Most of the filenames included a variance of filenames like:  SWIFT {Date}.doc SWIFT COPY.doc PURCHASE ORDER {Random Value}.doc DHL_RECEIPT {Random Value}.doc SHIPPING RECEIPT {Date}.doc  The tools used by the crew do not really differ in general crime vs more targeted attacks, in both instances they related to several remote access and data stealing malware families The top five malware families identified as criminal in nature so far have been the following:  NjRAT: NjRAT is a remote-access Trojan commonly used and witnessed in attacks that are both criminal and targeted attacks since as early as 2013 RevengeRAT : RevengeRAT is a remote-access Trojan that was released for free on underground forums in 2016 While RevengeRAT could be used in targeted attack campaigns, it is commonly witnessed in criminal malspam campaigns LokiBot: LokiBot is a commodity malware sold on underground sites which is designed to steal private data from infected machines, and then submit that info to a command and control host via HTTP POST RemcosRAT: RemcosRAT is a remote-access Trojan that first appeared in underground forums in July of 2016 The RemcosRAT has a feature-rich builder, which allows for the creation of Microsoft Word documents with malicious macros NanoCoreRAT: Generally delivered via phishing, NanocoreRAT is a remote-access Trojan that opens a back door and steals information from the compromised computer One interesting note about the criminal activity of Gorgon Group is their usage of Bitly Similar to that of their targeted attacks, Gorgon Group leveraged Bitly for distribution and shortening of C2 domains Using the same techniques across both their criminal and targeted activity, made it easier for us to cluster Gorgon Group infrastructure and activity Figure 14 Clicks on Bitly links in criminal attacks Overall, in spite of the lack of sophistication in Gorgon Group’s activity, they were still relatively successful; once again proving that simple attacks on individuals without proper protections, work Intention #2: Targeted Attacks Beginning in early March 2018, Unit 42 started observing targeted attacks against Russian, Spanish and United States government agencies operating in Pakistan As we continued to investigate, it became apparent that Gorgon Group had been consistently targeting worldwide governmental organizations operating within Pakistan While Gorgon Group has been making minor changes in their methodologies, they are still actively involved in both targeted and criminal attacks This Gorgon Group campaign leveraged spear phishing emails with Microsoft Word documents exploiting CVE-2017-0199 The spear phishing emails involved in this campaign would most often originate from Gmail accounts masquerading as legitimate individuals, such as a prominent Lt Col in the Pakistani military The subjects of the spear phishing emails were also interesting, often contained subject matter related to terrorist groups, military activity, or political topics Acting FOREIGN Minister of Pakistan Invitation to lady wives of H.E Ambassador/High Commissioner from lady wife of H.E The popular NanoCoreRAT, QuasarRAT, and NJRAT variants were used heavily In a number of these attacks, the popular third-party URL shortening service Bitly was used to ultimately deliver the payloads for these attacks So, while having this click information is valuable, it’s only one small piece of a larger picture related to targeting Figure 15 Bitly Click Information Related to a Gorgon Group C2 Domain The heaviest concentration of Bitly URL interaction came from Pakistan, which at 410 clicks accounted for 39% of all clicks The United States amassed 194 clicks, accounting for 19% Figure 16 Clicks on Bitly links in targeted attacks The attacks took place primarily in March, late April, and early May of this year Conclusion Gorgon Group isn’t the first actor group we’ve witnessed dabble in both nation state level and criminal attacks What makes Gorgon Group unique is, that despite the group’s operational security failures, they still remained particularly effective Looking closer at the actors participating in Gorgon Group gave us a unique perspective into the inner workings of an attack Leveraging the same infrastructure for targeted attacks and criminal enterprises made for an interesting cross-section of mixed intentions Ultimately, this lead us to the conclusion that several of Gorgon Group’s members have a nexus in Pakistan While Gorgon Group remains active, Palo Alto Networks customers are protected from this threat in the following ways:  WildFire detects all current Gorgon Group files with malicious verdicts AutoFocus customers can track these samples with the Gorgon Group actor tag In some instances, we have also seen the RemcosRAT malware family delivered as the final payload The infection process not only downloads and executes a payload, but it also downloads and opens a decoy document to lower the recipient’s suspicions of the entire process Additionally, the process attempts to lower the overall security of the system by disabling security features in Microsoft Office and Windows Defender The payloads themselves are rather interesting, as the developer wraps the malicious code with legitimate source code freely available online This blanket approach to kill the appropriate process suggests that the actor does not change this command within their macro across delivery documents they created within these Microsoft Office applications The command does not just attempt to kill the Windows Defender process, but also attempts to clear the detection definitions to not trigger an antivirus alert It appears the author of this downloader used the source code from an open source tool called “Sales System Application”, which is freely available at hxxp://www.a1vbcode[.]com/app-2999.asp We believe the author of the downloader uses this Sales System Application to provide a legitimate look to their malicious payload The malware author adds their own code to the application to run their malicious code before calling the legitimate functions that display the graphical user interface The ETransaksi.gsgjIDJIGJIGJIGJIFDOSpl method obtains a resource named “fgjfaieSDFAOKEfj.GSrdofjksrgj”, which is decrypted in the ETransaksi.FJaioefgkaoeK method using a multibyte XOR cipher with the following key:byte[] array = new byte[]     {         19,         129,         43,         37,         56,         65,         255,         75,         111,         19,         211,         120,         0,         49,         126,         248     };The resulting cleartext is another .NET assembly, which the payload will load within its own process space An unknown programmatic builder tool appears to have created this Trojan, as the code shows multiple configuration options for additional functionality that were not enabled within this specific sample While the Trojan was configured to carry out this activity, the actor did not embed a payload within the “B” resource, so this functionality does not carry out any activities, rather it just causes an exception and continues running Another configuration option encountered by this Trojan is a check for ‘%STARTUPON%’ This sample was not configured to execute with this option enabled, however, should this option be enabled, the Trojan would attempt to install itself to the system at a specific location by writing its contents in base64-encoded format to the following file:   %APPDATA%\Microsoft\Windows\DsvHelper\%DECRY%.txt   The Trojan then reads the contents of the %DECRY%.txt file, decode them and write the decoded data to the following file: %USERPROFILE%\APPDATA\Roaming\Microsoft\Windows\DsvHelper\@RANDOM@.exe The Trojan would then create a new process using the @RANDOM@.exe file The embedded payload written to process memory exists in the “R” resource and called function in the new payload is named “RPe.Test.Work” The R payload will create a process using the supplied path using the CreateProcessA API function The payload then finds the base address of the newly created process using the GetThreadContext API function, and then calls NtUnmapViewOfSection to hollow the process Embedded Downloader Trojan The M payload (referenced previously along with the R payload, above) injected and executed within the memory space of the other process is a downloader Trojan This specific downloader appears to have been created using a VB2Exe tool, as the functional code that carries out the downloading functionality exists as a VBScript embedded within the payload The payload extracts this VBScript from a resource and saves it to a file that it extracts from another resource The filename used to save the VBScript is “khm.vbs”, which is eventually run using “wscript” The payload is downloaded from the following location and saved to “%PUBLIC%\svchost32.exe”: hxxp://lokipanelhostingpanel[.]gq/work/kh/1s.exe The decoy document is downloaded from hxxp://lokipanelhostingpanel[.]gq/work/kh/1.docx and saved to “%PUBLIC%\svchost32.docx” When opened, the decoy document shows the following content, which contains the image and copied text from a news article titled “Top civil-military body rejects Nawaz’s controversial statement on Mumbai attacks,” as seen in the following screenshot:  Figure 16 Decoy document downloaded by malware Final Payload The final payload is a dropper Trojan that installs the NanoCore RAT The author of this payload (SHA256: 690fc694b0840dbabb462ae46eb836777420b3354e53a6944a2e169b965b0bec) appears to have used an open source tool called “Saransh Email System” as a basis of this tool, which was likely downloaded from hxxp://www.a1vbcode[.]com/app-4601.asp The post The Gorgon Group: Slithering Between Nation State and Cybercrime appeared first on Palo Alto Networks Blog 
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content Unit 42 researchers have been tracking Subaat, an attacker, since 2017 Recently Subaat drew our attention due to renewed targeted attack activity Part of monitoring Subaat included realizing the actor was possibly part of a larger crew of individuals responsible for carrying out targeted attacks against worldwide governmental organizations Technical analysis on some of the attacks as well as attribution links with Pakistan actors have been already depicted by 360 and Tuisec, in which they found interesting connections to a larger group of attackers Unit 42 researchers have been tracking, which we are calling Gorgon Group In addition to the numerous targeted attacks, Unit 42 discovered that the group also performed a litany of attacks and operations around the globe, involving both criminal as well as targeted attacks Starting in February 2018, Palo Alto Networks Unit 42 identified a campaign of attacks performed by members of Gorgon Group targeting governmental organizations in the United Kingdom, Spain, Russia, and the United States Additionally, during that time, members of Gorgon Group were also performing criminal operations against targets across the globe, often using shared infrastructure with their targeted attack operations Gorgon Group’s activity is interesting because in addition to traditional command and control (C2) domain utilization, Gorgon Group used common URL shortening services to download payloads; ultimately providing an extensive list of click counts and statistical data Also, interestingly, Gorgon Group has a diverse and active criminal element On much of the C2 infrastructure we identified several crimeware family samples RATs such as NjRat and infostealers like Lokibot were leveraging the same C2 infrastructure as that of the targeted attacks Using numerous decoy documents and phishing emails, both styles of attacks lacked overall sophistication, but the effectiveness of this group and campaign cannot be denied Attack Delivery and Infrastructure Analysis The attack methodology, as well as analysis of several of the “.vbs”, “.doc” and “.exe” samples found hosted in the attacker’s infrastructure has been covered by 360 and Tuisec Both 360 and Tuisec found that the most commonly observed and consistent attack pattern consists of the following stages:  Figure 1 Basic attacker methodology At the initial stage, the phishing attempts are kept very simple and lightweight by using OLE2Link objects that will usually make use of URL shortening services such as Bitly and t2m[.]io Figure 2 OLE2Link content example   While investigating the domains and infrastructure used by the phishing components of Gorgon Group, Unit 42 researchers witnessed several common operational security flaws with Gorgon Group’s actors throughout their many campaigns It was one of these OPSEC failures that gave us an interesting cross-section of malware Gorgon Group is using Additionally, there was a plethora of malware samples that were criminal in nature Figure 3 Examples of domain patterns The Gorgon Group Crew Breakdown Finding accessible directories, in combination with their other operational security failures, made it easy to start connecting the dots on Gorgon Group members 360 and Tuisec already identified some Gorgon Group members In addition to Subaat, we counted an additional four actors performing attacks as part of Gorgon Group While it’s not known if the attackers physically reside in Pakistan, all members of Gorgon Group purport to be in Pakistan based on their online personas fudpages  One member of Gorgon Group- we’re calling ‘fudpages’, was found during this campaign activity based on their utilization of shared infrastructure One specific Microsoft document drew our attention (446e1c80102c8b9662d66d44525cb9f519369061b02446e0d4cd30cd26d79a25) This Microsoft Word document was sent via email to several industries across the US and Switzerland We noticed that this document pulls down additional malware from a C2 also being used in attacks by other Gorgon Group members.  Additionally, this document communicates to a relatively new piece of C2 infrastructure- umarguzardijye[.]com, which is hosted on 91[.]234[.]99[.]206 Figure 4 WHOIS information for umarguzardijye[.]com Fudpages, similar to other Gorgon Group members, made many of the same OPSEC failures of his or her fellow Gorgon Group members Figure 5 Open directory of umarguzardijye[.]com The WHOIS record for our new domain, umarguzardijye[.]com, shows that the registrant organization is “fudpages” and the address provided in Pakistan When looking closer at the IP hosting umarguzardijye[.]com, we noticed 91[.]234[.]99[.]206 hosts two additional domains that drew our attention-fudpages[.]ru and fudpage[.]ru Fudpage appears to be a small marketplace selling bulletproof hosting, RDP sessions, fake documents and a litany of additional malicious wares Figure 6 Advertisement website for FUD pages and spamming tools Listed on fudpage’s marketplace are several pieces of contact information, which ultimately led us to an underground persona that was selling, distributing and trading maliciousness across underground forums Figure 7 Underground forum posting for RAT Operating underground since at least 2016, fudpages is also active on streaming sites like Youtube, where they use it as an advertising platform Figure 8 Youtube video posting on how to perform malicious activities Like all of Gorgon Group’s members, Fudpage’s online profile, infrastructure utilization and standardization, connects them back to Gorgon Group This connection to Gorgon Group helps illustrate the seemingly standardized methodologies Gorgon Group most often employs The Tale of Two Intentions: Criminal and Targeted As part of the investigation, Unit 42 researchers were able to identify an interesting characteristic about how the Gorgon Group crew uses shared infrastructure between cybercrime and targeted attacks The crew combines both regular crime and targeted attack objectives using the same domain infrastructure over time, rarely changing their TTPs Starting in mid-February, Unit 42 researchers have been tracking an active campaign sharing a significant portion of infrastructure leveraged by Gorgon Group for criminal and targeted attacks Overlap between infrastructure While looking at the total cluster of Gorgon Group activity, it’s also interesting to look at the total click volume during the campaign’s timeframe Leveraging click counts for the campaign for Bitly, we were able to see Gorgon Group’s activity volume increase throughout April Figure 10 Total clicks performed on Gorgon Group infrastructure over time Looking specifically at one domain used in both cybercrime and targeted attacks, we can see a micro viewpoint into their campaign Between April 1, 2018 and May 30, 2018, we observed the domain stevemike-fireforce[.]info used in a Gorgon Group cybercrime campaign involving more than 2,300 emails and 19 documents in the initial attack This same domain was also used during the same period of time in targeted attacks against several worldwide nation state agencies Analysis of the data allowed Unit 42 researchers to make some interesting conclusions:  Several unique domains are used for both cybercrime and targeted attacks The amount of sessions for cybercrime is higher than targeted, as expected There is no specific pattern on when targeted attacks happen, the domains can initially be used for cybercrime and then quickly utilized in a targeted attack with little warning As a graphical representation, Figure 11, below, indicates the amount of unique sessions observed for this domain over the campaign’s operational time, representing the attack intention in two separate areas It’s interesting to observe on April 24th, this domain delivers a targeted attack aimed at several worldwide governmental bodies, in the middle being of also being used in the delivery of a malspam campaign The subject used in this case of targeted attack was “Pakistan eying Sukhoi-35 figther planes as part of defense deal from Rusia”:    Figure 11 Crimeware activity versus targeted activity against stevemike-fireforce[.]info In order to have a better idea of the volume of unique attacks per date and intention, see the following volume-based representation in Figure 12, where targeted attack volumes are represented in red and crime in green:  Figure 12 Volume of crimeware activity versus targeted attacks using stevemike-fireforce[.]info Focusing on one domain allowed us to quickly understand its usage and better understand how it interconnects to a larger malspam campaign Intention #1: Cybercrime Criminal attacks are not new to this crew, some of which was covered in our previous blog for Gorgon Group member Subaat During the current campaign, Gorgon Group’s criminal enterprises netted 132,840 Bitly clicks from mid-February to the present Targeting a large cross-section of industries, there was little in terms of targeting during their criminal activity Figure 13 Criminal Attacks Bitly Link Clicks Worldwide A majority of the crimeware distribution was done via standard malspam campaigns leveraging well-known “Purchase Order” and “SWIFT” lures Most of the filenames included a variance of filenames like:  SWIFT {Date}.doc SWIFT COPY.doc PURCHASE ORDER {Random Value}.doc DHL_RECEIPT {Random Value}.doc SHIPPING RECEIPT {Date}.doc  The tools used by the crew do not really differ in general crime vs more targeted attacks, in both instances they related to several remote access and data stealing malware families The top five malware families identified as criminal in nature so far have been the following:  NjRAT: NjRAT is a remote-access Trojan commonly used and witnessed in attacks that are both criminal and targeted attacks since as early as 2013 RevengeRAT : RevengeRAT is a remote-access Trojan that was released for free on underground forums in 2016 While RevengeRAT could be used in targeted attack campaigns, it is commonly witnessed in criminal malspam campaigns LokiBot: LokiBot is a commodity malware sold on underground sites which is designed to steal private data from infected machines, and then submit that info to a command and control host via HTTP POST RemcosRAT: RemcosRAT is a remote-access Trojan that first appeared in underground forums in July of 2016 The RemcosRAT has a feature-rich builder, which allows for the creation of Microsoft Word documents with malicious macros NanoCoreRAT: Generally delivered via phishing, NanocoreRAT is a remote-access Trojan that opens a back door and steals information from the compromised computer One interesting note about the criminal activity of Gorgon Group is their usage of Bitly Similar to that of their targeted attacks, Gorgon Group leveraged Bitly for distribution and shortening of C2 domains Using the same techniques across both their criminal and targeted activity, made it easier for us to cluster Gorgon Group infrastructure and activity Figure 14 Clicks on Bitly links in criminal attacks Overall, in spite of the lack of sophistication in Gorgon Group’s activity, they were still relatively successful; once again proving that simple attacks on individuals without proper protections, work Intention #2: Targeted Attacks Beginning in early March 2018, Unit 42 started observing targeted attacks against Russian, Spanish and United States government agencies operating in Pakistan As we continued to investigate, it became apparent that Gorgon Group had been consistently targeting worldwide governmental organizations operating within Pakistan While Gorgon Group has been making minor changes in their methodologies, they are still actively involved in both targeted and criminal attacks This Gorgon Group campaign leveraged spear phishing emails with Microsoft Word documents exploiting CVE-2017-0199 The spear phishing emails involved in this campaign would most often originate from Gmail accounts masquerading as legitimate individuals, such as a prominent Lt Col in the Pakistani military The subjects of the spear phishing emails were also interesting, often contained subject matter related to terrorist groups, military activity, or political topics Acting FOREIGN Minister of Pakistan Invitation to lady wives of H.E Ambassador/High Commissioner from lady wife of H.E The popular NanoCoreRAT, QuasarRAT, and NJRAT variants were used heavily In a number of these attacks, the popular third-party URL shortening service Bitly was used to ultimately deliver the payloads for these attacks So, while having this click information is valuable, it’s only one small piece of a larger picture related to targeting Figure 15 Bitly Click Information Related to a Gorgon Group C2 Domain The heaviest concentration of Bitly URL interaction came from Pakistan, which at 410 clicks accounted for 39% of all clicks The United States amassed 194 clicks, accounting for 19% Figure 16 Clicks on Bitly links in targeted attacks The attacks took place primarily in March, late April, and early May of this year Conclusion Gorgon Group isn’t the first actor group we’ve witnessed dabble in both nation state level and criminal attacks What makes Gorgon Group unique is, that despite the group’s operational security failures, they still remained particularly effective Looking closer at the actors participating in Gorgon Group gave us a unique perspective into the inner workings of an attack Leveraging the same infrastructure for targeted attacks and criminal enterprises made for an interesting cross-section of mixed intentions Ultimately, this lead us to the conclusion that several of Gorgon Group’s members have a nexus in Pakistan While Gorgon Group remains active, Palo Alto Networks customers are protected from this threat in the following ways:  WildFire detects all current Gorgon Group files with malicious verdicts AutoFocus customers can track these samples with the Gorgon Group actor tag In some instances, we have also seen the RemcosRAT malware family delivered as the final payload The infection process not only downloads and executes a payload, but it also downloads and opens a decoy document to lower the recipient’s suspicions of the entire process Additionally, the process attempts to lower the overall security of the system by disabling security features in Microsoft Office and Windows Defender The payloads themselves are rather interesting, as the developer wraps the malicious code with legitimate source code freely available online This blanket approach to kill the appropriate process suggests that the actor does not change this command within their macro across delivery documents they created within these Microsoft Office applications The command does not just attempt to kill the Windows Defender process, but also attempts to clear the detection definitions to not trigger an antivirus alert It appears the author of this downloader used the source code from an open source tool called “Sales System Application”, which is freely available at hxxp://www.a1vbcode[.]com/app-2999.asp We believe the author of the downloader uses this Sales System Application to provide a legitimate look to their malicious payload The malware author adds their own code to the application to run their malicious code before calling the legitimate functions that display the graphical user interface The ETransaksi.gsgjIDJIGJIGJIGJIFDOSpl method obtains a resource named “fgjfaieSDFAOKEfj.GSrdofjksrgj”, which is decrypted in the ETransaksi.FJaioefgkaoeK method using a multibyte XOR cipher with the following key:byte[] array = new byte[]     {         19,         129,         43,         37,         56,         65,         255,         75,         111,         19,         211,         120,         0,         49,         126,         248     };The resulting cleartext is another .NET assembly, which the payload will load within its own process space An unknown programmatic builder tool appears to have created this Trojan, as the code shows multiple configuration options for additional functionality that were not enabled within this specific sample While the Trojan was configured to carry out this activity, the actor did not embed a payload within the “B” resource, so this functionality does not carry out any activities, rather it just causes an exception and continues running Another configuration option encountered by this Trojan is a check for ‘%STARTUPON%’ This sample was not configured to execute with this option enabled, however, should this option be enabled, the Trojan would attempt to install itself to the system at a specific location by writing its contents in base64-encoded format to the following file:   %APPDATA%\Microsoft\Windows\DsvHelper\%DECRY%.txt   The Trojan then reads the contents of the %DECRY%.txt file, decode them and write the decoded data to the following file: %USERPROFILE%\APPDATA\Roaming\Microsoft\Windows\DsvHelper\@RANDOM@.exe The Trojan would then create a new process using the @RANDOM@.exe file The embedded payload written to process memory exists in the “R” resource and called function in the new payload is named “RPe.Test.Work” The R payload will create a process using the supplied path using the CreateProcessA API function The payload then finds the base address of the newly created process using the GetThreadContext API function, and then calls NtUnmapViewOfSection to hollow the process Embedded Downloader Trojan The M payload (referenced previously along with the R payload, above) injected and executed within the memory space of the other process is a downloader Trojan This specific downloader appears to have been created using a VB2Exe tool, as the functional code that carries out the downloading functionality exists as a VBScript embedded within the payload The payload extracts this VBScript from a resource and saves it to a file that it extracts from another resource The filename used to save the VBScript is “khm.vbs”, which is eventually run using “wscript” The payload is downloaded from the following location and saved to “%PUBLIC%\svchost32.exe”: hxxp://lokipanelhostingpanel[.]gq/work/kh/1s.exe The decoy document is downloaded from hxxp://lokipanelhostingpanel[.]gq/work/kh/1.docx and saved to “%PUBLIC%\svchost32.docx” When opened, the decoy document shows the following content, which contains the image and copied text from a news article titled “Top civil-military body rejects Nawaz’s controversial statement on Mumbai attacks,” as seen in the following screenshot:  Figure 16 Decoy document downloaded by malware Final Payload The final payload is a dropper Trojan that installs the NanoCore RAT The author of this payload (SHA256: 690fc694b0840dbabb462ae46eb836777420b3354e53a6944a2e169b965b0bec) appears to have used an open source tool called “Saransh Email System” as a basis of this tool, which was likely downloaded from hxxp://www.a1vbcode[.]com/app-4601.asp The post The Gorgon Group: Slithering Between Nation State and Cybercrime appeared first on Palo Alto Networks Blog  ### Response: .