Inception Attackers Target Europe with Year-old Office Vulnerability

guest · Nov 5, 2018

Inception Attackers Target Europe with Year-old Office Vulnerability
November 5, 2018
https://researchcenter.paloaltonetw...-target-europe-year-old-office-vulnerability/

This blog describes attacks against European targets observed in October 2018, using CVE-2017-11882 and a new PowerShell backdoor we’re calling POWERSHOWER due to the attention to detail in terms of cleaning up after itself, along with the malware being written in PowerShell.
Remote Templates are Great
Remote templates are a feature of Microsoft Word which allow a document to load a template to be used in a document – this template can be externally hosted, either on a file share, or on the internet.

When opened, the documents display decoy content and attempts to fetch a malicious remote payload via HTTP.
POWERSHOWER – Malware that Cleans up After Itself
The dropped payload, POWERSHOWER, acts as an initial reconnaissance foothold and is almost certainly used to download and execute a secondary payload with a more complete set of features. By only using this simple backdoor to establish a foothold, the attacker can hold back their most sophisticated and complex malware for later stages, making them less likely to be detected. [...]
Click to expand...

guest · Aug 12, 2019

Recent Cloud Atlas activity
August 12, 2019
https://securelist.com/recent-cloud-atlas-activity/92016/

Also known as Inception, Cloud Atlas is an actor that has a long history of cyber-espionage operations targeting industries and governmental entities. We first reported Cloud Atlas in 2014 and we’ve been following its activities ever since.
Cloud Atlas hasn’t changed its TTPs (Tactic Tools and Procedures) since 2018 and is still relying on its effective existing tactics and malware in order to compromise high value targets.

Previously, Cloud Atlas dropped its “validator” implant named “PowerShower” directly, after exploiting the Microsoft Equation vulnerability (CVE-2017-11882) mixed with CVE-2018-0802.
This malware has been used since October 2018 by Cloud Atlas as a validator and now as a second stage. The differences in the two versions reside mostly in anti-forensics features for the validator version of PowerShower.
And his new friend, VBShower
During its recent campaigns, Cloud Atlas used a new “polymorphic” infection chain relying no more on PowerShower directly after infection, but executing a polymorphic HTA hosted on a remote server, which is used to drop three different files on the local system.
This “polymorphic” infection chain allows the attacker to try to prevent IoC-based defence, as each code is unique by victim so it can’t be searched via file hash on the host.
Click to expand...

Final words
Cloud Atlas remains very prolific in Eastern Europe and Central Asia. The actor’s massive spear-phishing campaigns continue to use its simple but effective methods in order to compromise its targets.

Unlike many other intrusion sets, Cloud Atlas hasn’t chosen to use open source implants during its recent campaigns, in order to be less discriminating. More interestingly, this intrusion set hasn’t changed its modular backdoor, even five years after its discovery.
Click to expand...

Log in or Sign up

Inception Attackers Target Europe with Year-old Office Vulnerability

guest Guest

guest Guest

Log in or Sign up

Inception Attackers Target Europe with Year-old Office Vulnerability

guest Guest

guest Guest

Useful Searches