Article Content In early February, several financial organizations reported malware infection on their workstations, apparently coming from legitimate websites The attacks turned out to be part of a large-scale campaign to compromise trusted websites in order to infect the systems of targeted enterprises across various industries The strategy is typically known as a “watering hole” attack It was all sparked by a spate of recent malware attacks on Polish banks entailing a reportedly unknown malware in their own terminals and servers, along with the presence of dubious, encrypted programs/executables, and more prominently, suspicious network activity More malware are delivered to the affected systems which were seen connecting to unusual and far-flung locations worldwide, possibly where company data are exfiltrated to The malware in question: RATANKBA Not only was it tied to malware attacks against banks in Poland, but also in a string of similar incidents involving financial institutions in Mexico, Uruguay, the United Kingdom, and Chile How did it infect their victims? Were there other malware involved? Does the campaign really have ties with a Russian cybercriminal group? Based on the odd wording choices (in Russian) we saw used as commands within the malware, we construe that it is just a decoy—a tactic to obfuscate the attackers’ trails Banks weren’t the only targets; among them are also enterprises in telecommunications, management consulting, information technology, insurance, aviation, and education Also, the campaign wasn’t just confined to North America and Europe, as we also observed a number of affected organizations in the APAC region, notably Taiwan, Hong Kong, and China Here we provide further analysis and insights that can complement other ongoing research into this threat Figure 1 One of the possible infection flows involving RATANKBA Infection Flow The campaign, like what we saw in affected Polish banks, has many attack chains The tools and techniques employed are typical in targeted attacks due to elements of lateral movement and reconnaissance These websites were injected with malicious JavaScript code that fingerprints browser components and loads vulnerability exploits from their malware and exploit kit-hosting systems, some of which were also likely compromised The infection is multistage and involves a variety of malware, with the final payload delivered only to their targets of interest Different command and control (C&C) servers were used Some were also compromised machines that proxied connections to the attackers’ infrastructure The domain also serves as one of the campaign’s platform for C&C communication The threat actor uses RATANKBA to survey the lay of the land as it looks into various aspects of the host machine where it has been initially downloaded—the machine that has been victim of the watering hole attack Information such as the running tasks, domain, shares, user information, if the host has default internet connectivity, and so forth Figure 2 RATANKBA looking at different aspects of the machine It would be worthwhile to note that RATANKBA has also been seen looking at specific IP ranges of interest:  Figure 3 Figure 4 Commandline instructions of the hack tool Upon successful connection, this hack tool will try to copy the calc.exe of the attacker’s machine to the targeted computer’s network share (C$) to test if file propagation via network share is successful and would most likely succeed if the credentials used would have administrative privileges A log of it is then dumped to the directory where the file was initially executed With the combination of the information from RATANKBA and success/failure results from HKTL_NBTSCAN, the threat actor is now free to deploy final payloads to interesting hosts A banking Trojan (TSPY_BANKER.NTE) is among RATANKBA’s final payloads Some of the compromised sites used by attacker host several malware and suspicious/malicious files include:  An information-stealing backdoor (detected by Trend Micro as BKDR_DESTOVER.ADU), A similarly named Flash file (swf, detected as SWF_EXPLOYT.YYRQ) A Silverlight (.xap) file containing several files: an App Manifest (AppManifest.xaml), and DLLs Shell_siver.dll (TROJ_CVE20130074.B), and System.Xml.Linq.dll, which when repacked form a runtime remote code execution exploit for Silverlight (CVE-2016-0034, patched last January 12, 2016) A Trojan (TROJ64_KLIPODLDR.ZHEB-A) that drops an encrypted module (BKDR64_KLIPODENC.ZHEB-A) containing a banking spyware (TSPY64_BANKER.YWNQD), used as a Windows service persistence mechanism DLL Impact There were actually more victims than what was initially gauged Feedback from our Smart Protection Network™ revealed that apart from attacks in North America (mainly the U.S.), Europe, and South America, the campaign also noticeably affected enterprises in Taiwan, Hong Kong, China, and Bahrain Affected organizations also included those in Luxembourg, France, the Philippines, Japan, Spain, Malaysia, Norway, and Romania The targeted industries were consistent with other analyses: telecommunications (including internet service providers) and banking We also saw a miscellany of targets whose industries comprise internet-related services (such as data center operations), management consulting, information technology, pharmaceutics, insurance, even aviation and education In the case of Taiwan, we’ve seen the compromised website diverting its visitors to another malware-hosting site that also acts as platform for C&C communication: sap[.]misapor[.]ch We saw the affected websites of financial institutions in Uruguay and Mexico redirecting victims to the same URL While the URL acts similarly to how eye-watch[.]in:443 delivers payloads, we also saw the URL leveraging and exploiting security flaws in Flash: CVE-2015-8651, CVE-2016-1019, and CVE-2016-4117 Figure 5 Screenshot of the malware’s code showing commands in Russian A False Flag? The campaign notably bears similarities with activities that seem to point the finger to Russian perpetrators Is there really a Russian connection? Delving into the malware, we found that it indeed uses commands in Russian—transliterated from Cyrillic script to Latin alphabet, in particular The verbs used were in their infinitive form, however, which is awkward for a command switch Case in point: the use of “ustanavlivat” (“to install”) instead of the more command-like “ustanovit” (“do install”), which gives the impression that the malware operator lifted it from a dictionary or source where words are typically listed in default form Additionally, using verbs as commands is peculiar, especially for Russian cybercriminals or malware programmers who ironically eschew using Russian language in favor of broken English Majority—if not all—of Russian programmers know that “connect” is keyed in as “connect”, because there’s already an API call (Application Program Interface) under that name If you really have to use Russian, you’d rather use words like “vykhod” (“quit”) than “vikhodit” (“to exit”) Another example is the use of “klyent2podklychit” we found within the sample we analyzed The only intelligible part of it was “2”, which can be taken as “to” given how there’s an API call name for it (client2connect) In Russian, it’s practically gibberish, with the words wrongly ordered; it makes much more sense if “podkluchit_klienta” was used instead Indeed, with the awkward use of Russian language within the malware, we’re inclined to surmise it as more of a false flag, intentionally inserted in the code to flummox threat research and attribution attempts It’s an uncommon tactic, but one that’s already been observed in other malware and cyberattacks Were the attacks carried out by cybercriminal group Lazarus? While there is ambivalence if they were indeed their handiwork, our analysis indicates that the malware codes and techniques employed resembled those used by Lazarus Malicious web injections, for instance, leverage exploits that enable attackers to gain footholds into the system An organization’s best defense is to regularly apply the latest patches, as well as routinely scan and examine traffic that goes through the enterprise’s network, which enables prompt incident response and remediation Hardening the endpoints is critical, as bad guys can use these to enter the company network Implementing the apt restrictions/permissions policies on end user systems and employing application control can help prevent unwanted and suspicious applications and processes from being executed Disabling unnecessary—or unused—components in the system such as third-party plugins and extensions helps reduce the system’s attack surface Employing firewalls and intrusion detection systems on top of proactive network monitoring can help mitigate incursions into the organization End users can help by practicing and fostering security habits, such as prudence against dubious and socially engineered links, emails, and websites Updated on February 27, 2017, 5:55 PM (UTC-7): We updated the wording that cited affected organizations in several countries Updated on February 27, 2017, 11:08 PM (UTC-7): We updated the section of the article that mentioned cybercriminal group Lazarus Updated on March 1, 2017, 09:15 PM (UTC-7): An updated version of the appendix containing Indicators of Compromise (IoCs) and other technical details has been uploaded Post from: Trendlabs Security Intelligence Blog - by Trend Micro RATANKBA: Delving into Large-scale Watering Holes against Enterprises
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content In early February, several financial organizations reported malware infection on their workstations, apparently coming from legitimate websites The attacks turned out to be part of a large-scale campaign to compromise trusted websites in order to infect the systems of targeted enterprises across various industries The strategy is typically known as a “watering hole” attack It was all sparked by a spate of recent malware attacks on Polish banks entailing a reportedly unknown malware in their own terminals and servers, along with the presence of dubious, encrypted programs/executables, and more prominently, suspicious network activity More malware are delivered to the affected systems which were seen connecting to unusual and far-flung locations worldwide, possibly where company data are exfiltrated to The malware in question: RATANKBA Not only was it tied to malware attacks against banks in Poland, but also in a string of similar incidents involving financial institutions in Mexico, Uruguay, the United Kingdom, and Chile How did it infect their victims? Were there other malware involved? Does the campaign really have ties with a Russian cybercriminal group? Based on the odd wording choices (in Russian) we saw used as commands within the malware, we construe that it is just a decoy—a tactic to obfuscate the attackers’ trails Banks weren’t the only targets; among them are also enterprises in telecommunications, management consulting, information technology, insurance, aviation, and education Also, the campaign wasn’t just confined to North America and Europe, as we also observed a number of affected organizations in the APAC region, notably Taiwan, Hong Kong, and China Here we provide further analysis and insights that can complement other ongoing research into this threat Figure 1 One of the possible infection flows involving RATANKBA Infection Flow The campaign, like what we saw in affected Polish banks, has many attack chains The tools and techniques employed are typical in targeted attacks due to elements of lateral movement and reconnaissance These websites were injected with malicious JavaScript code that fingerprints browser components and loads vulnerability exploits from their malware and exploit kit-hosting systems, some of which were also likely compromised The infection is multistage and involves a variety of malware, with the final payload delivered only to their targets of interest Different command and control (C&C) servers were used Some were also compromised machines that proxied connections to the attackers’ infrastructure The domain also serves as one of the campaign’s platform for C&C communication The threat actor uses RATANKBA to survey the lay of the land as it looks into various aspects of the host machine where it has been initially downloaded—the machine that has been victim of the watering hole attack Information such as the running tasks, domain, shares, user information, if the host has default internet connectivity, and so forth Figure 2 RATANKBA looking at different aspects of the machine It would be worthwhile to note that RATANKBA has also been seen looking at specific IP ranges of interest:  Figure 3 Figure 4 Commandline instructions of the hack tool Upon successful connection, this hack tool will try to copy the calc.exe of the attacker’s machine to the targeted computer’s network share (C$) to test if file propagation via network share is successful and would most likely succeed if the credentials used would have administrative privileges A log of it is then dumped to the directory where the file was initially executed With the combination of the information from RATANKBA and success/failure results from HKTL_NBTSCAN, the threat actor is now free to deploy final payloads to interesting hosts A banking Trojan (TSPY_BANKER.NTE) is among RATANKBA’s final payloads Some of the compromised sites used by attacker host several malware and suspicious/malicious files include:  An information-stealing backdoor (detected by Trend Micro as BKDR_DESTOVER.ADU), A similarly named Flash file (swf, detected as SWF_EXPLOYT.YYRQ) A Silverlight (.xap) file containing several files: an App Manifest (AppManifest.xaml), and DLLs Shell_siver.dll (TROJ_CVE20130074.B), and System.Xml.Linq.dll, which when repacked form a runtime remote code execution exploit for Silverlight (CVE-2016-0034, patched last January 12, 2016) A Trojan (TROJ64_KLIPODLDR.ZHEB-A) that drops an encrypted module (BKDR64_KLIPODENC.ZHEB-A) containing a banking spyware (TSPY64_BANKER.YWNQD), used as a Windows service persistence mechanism DLL Impact There were actually more victims than what was initially gauged Feedback from our Smart Protection Network™ revealed that apart from attacks in North America (mainly the U.S.), Europe, and South America, the campaign also noticeably affected enterprises in Taiwan, Hong Kong, China, and Bahrain Affected organizations also included those in Luxembourg, France, the Philippines, Japan, Spain, Malaysia, Norway, and Romania The targeted industries were consistent with other analyses: telecommunications (including internet service providers) and banking We also saw a miscellany of targets whose industries comprise internet-related services (such as data center operations), management consulting, information technology, pharmaceutics, insurance, even aviation and education In the case of Taiwan, we’ve seen the compromised website diverting its visitors to another malware-hosting site that also acts as platform for C&C communication: sap[.]misapor[.]ch We saw the affected websites of financial institutions in Uruguay and Mexico redirecting victims to the same URL While the URL acts similarly to how eye-watch[.]in:443 delivers payloads, we also saw the URL leveraging and exploiting security flaws in Flash: CVE-2015-8651, CVE-2016-1019, and CVE-2016-4117 Figure 5 Screenshot of the malware’s code showing commands in Russian A False Flag? The campaign notably bears similarities with activities that seem to point the finger to Russian perpetrators Is there really a Russian connection? Delving into the malware, we found that it indeed uses commands in Russian—transliterated from Cyrillic script to Latin alphabet, in particular The verbs used were in their infinitive form, however, which is awkward for a command switch Case in point: the use of “ustanavlivat” (“to install”) instead of the more command-like “ustanovit” (“do install”), which gives the impression that the malware operator lifted it from a dictionary or source where words are typically listed in default form Additionally, using verbs as commands is peculiar, especially for Russian cybercriminals or malware programmers who ironically eschew using Russian language in favor of broken English Majority—if not all—of Russian programmers know that “connect” is keyed in as “connect”, because there’s already an API call (Application Program Interface) under that name If you really have to use Russian, you’d rather use words like “vykhod” (“quit”) than “vikhodit” (“to exit”) Another example is the use of “klyent2podklychit” we found within the sample we analyzed The only intelligible part of it was “2”, which can be taken as “to” given how there’s an API call name for it (client2connect) In Russian, it’s practically gibberish, with the words wrongly ordered; it makes much more sense if “podkluchit_klienta” was used instead Indeed, with the awkward use of Russian language within the malware, we’re inclined to surmise it as more of a false flag, intentionally inserted in the code to flummox threat research and attribution attempts It’s an uncommon tactic, but one that’s already been observed in other malware and cyberattacks Were the attacks carried out by cybercriminal group Lazarus? While there is ambivalence if they were indeed their handiwork, our analysis indicates that the malware codes and techniques employed resembled those used by Lazarus Malicious web injections, for instance, leverage exploits that enable attackers to gain footholds into the system An organization’s best defense is to regularly apply the latest patches, as well as routinely scan and examine traffic that goes through the enterprise’s network, which enables prompt incident response and remediation Hardening the endpoints is critical, as bad guys can use these to enter the company network Implementing the apt restrictions/permissions policies on end user systems and employing application control can help prevent unwanted and suspicious applications and processes from being executed Disabling unnecessary—or unused—components in the system such as third-party plugins and extensions helps reduce the system’s attack surface Employing firewalls and intrusion detection systems on top of proactive network monitoring can help mitigate incursions into the organization End users can help by practicing and fostering security habits, such as prudence against dubious and socially engineered links, emails, and websites Updated on February 27, 2017, 5:55 PM (UTC-7): We updated the wording that cited affected organizations in several countries Updated on February 27, 2017, 11:08 PM (UTC-7): We updated the section of the article that mentioned cybercriminal group Lazarus Updated on March 1, 2017, 09:15 PM (UTC-7): An updated version of the appendix containing Indicators of Compromise (IoCs) and other technical details has been uploaded Post from: Trendlabs Security Intelligence Blog - by Trend Micro RATANKBA: Delving into Large-scale Watering Holes against Enterprises ### Response: .