APT Group’s Worldwide Targeting of Small and Medium Businesses Revealed

guest · Aug 24, 2020

APT Group’s Worldwide Targeting of Small and Medium Businesses Revealed
August 24, 2020
https://www.infosecurity-magazine.com/news/apt-worldwide-targeting-small/

A detailed analysis of the APT group DeathStalker has been published today by Kaspersky, highlighting the scale of its operations throughout the world, from Europe to Latin America.

The ‘hacker-for-hire’ organization is known to have been active since at least 2012, primarily focusing on small and medium firms in the financial sector through commercial cyber-espionage campaigns.
Kaspersky said the research demonstrates that small and medium sized companies, as well as larger businesses and government organizations, must be prepared to deal with the threats posed by APT actors such as DeathStalker.
Click to expand...

DeathStalker’s main method of attack is to deliver archives containing malicious files through tailored spear-phishing emails. A malicious script is executed and further components are downloaded from the internet when a user clicks the shortcut, which gives the attackers control of the victim’s machine.

Kaspersky added that in its Powersing campaigns, DeathStalker has become adept at evading detection by placing dead drop resolvers on legitimate social media, blogging and messaging services.
Once infected, victims would reach out to and be redirected by these resolvers, which hides the communication chain.
Click to expand...

Kaspersky: Lifting the veil on DeathStalker, a mercenary triumvirate

DeathStalker first came to our attention through a PowerShell-based implant called Powersing. By unraveling this thread, we were able to identify activities dating back to 2018, and possibly even 2012.
Summary
Powersing, Janicab and Evilnum are three scripting language-based toolchains exhibiting the following similarities:
[...]
While none of these points on their own are sufficient in our eyes to draw a conclusion, we feel that together they allow us to assess with medium confidence that Powersing, Evilnum and Janicab are operated by the same group. Additional data shared with us by industry partners that we can’t disclose at the moment also supports this conclusion.
Click to expand...

We advise defenders to pay close attention to any process creation related to native Windows interpreters for scripting languages, such as powershell.exe and cscript.exe. Wherever possible, these utilities should be made unavailable. We also recommend that future awareness trainings and security product assessments include infection chains based on LNK files.
Click to expand...

guest · Dec 4, 2020

DeathStalker APT Spices Things Up with PowerPepper Malware
A raft of obfuscation techniques turn the heat up for the hacking-for-hire operation
December 3, 2020
https://threatpost.com/deathstalker-apt-powerpepper-malware/161867/

The DeathStalker advanced persistent threat (APT) group has a hot new weapon: A highly stealthy backdoor that researchers have dubbed PowerPepper, used to spy on targeted systems.

“DeathStalker has leveraged several malware strains and delivery chains across the years, from the Python and VisualBasic-based Janicab, to the PowerShell-based Powersing, passing by the JavaScript-based Evilnum,” researchers said in a Thursday posting.
“DeathStalker also consistently leveraged anti-detection and antivirus evasion techniques, as well as intricate delivery chains, that would drop lots of files on target’s file systems.”
This particular malware stands out, though, for upping the heat level on its evasion tactics.
Click to expand...

Peppering Companies with Espionage
PowerPepper was cultivated to execute remote shell commands sent by DeathStalker operators, which are aimed at stealing sensitive business information.

PowerPepper is typically spread via spearphishing emails with the malicious files delivered via the email body or within a malicious link, as is typical for DeathStalker.

“PowerPepper is already the fourth malware strain affiliated with the actor, and we have discovered a potential fifth strain. Even though they are not particularly sophisticated, DeathStalker’s malware has proven to be quite effective.”
Click to expand...

Kaspersky: What did DeathStalker hide between two ferns?

DeathStalker is a threat actor who has been active starting 2012 at least, and we exposed most of its past activities in a previous article, as well as during a GREAT Ideas conference in August 2020. The actor caught our attention in 2018, because of distinctive attacks characteristics that did not fit the usual cybercrime or state-sponsored activities, making us believe that DeathStalker is a “hack-for-hire” company.

DeathStalker definitely is a threat to feel concerned about, as victimology for its various malware strains shows that any corporation or individual in the world could be targeted by their malicious activities, provided someone decided there is interest to, and passed them the word.
Click to expand...

Log in or Sign up

APT Group’s Worldwide Targeting of Small and Medium Businesses Revealed

guest Guest

guest Guest

Log in or Sign up

APT Group’s Worldwide Targeting of Small and Medium Businesses Revealed

guest Guest

guest Guest

Useful Searches