LuckyMouse hits national data center to organize country-level waterholing campaign

Minimalist · Jun 14, 2018

In March 2018 we detected an ongoing campaign targeting a national data center in the Central Asia that we believe has been active since autumn 2017. The choice of target made this campaign especially significant – it meant the attackers gained access to a wide range of government resources at one fell swoop. We believe this access was abused, for example, by inserting malicious scripts in the country’s official websites in order to conduct watering hole attacks.

The operators used the HyperBro Trojan as their last-stage in-memory remote administration tool (RAT). The timestamps for these modules are from December 2017 until January 2018. The anti-detection launcher and decompressor make extensive use of Metasploit’s shikata_ga_nai encoder as well as LZNT1 compression.

Kaspersky Lab products detect the different artifacts used in this campaign with the following verdicts: Trojan.Win32.Generic, Trojan-Downloader.Win32.Upatre and Backdoor.Win32.HyperBro. A full technical report, IoCs and YARA rules are available from our intelligence reporting service (contact us intelligence@kaspersky.com).
Click to expand...

https://securelist.com/luckymouse-hits-national-data-center

Minimalist · Jun 16, 2018

This Chinese hacking group pwned a bunch of Mongolian government sites

A Chinese hacking group broke into a national data center in Mongolia late last year in an expansive cyber-espionage campaign that allowed the attackers to quietly plant malware into government websites, according to a new research report by Kaspersky Lab and supplemental analysis provided to CyberScoop.

According to Kaspersky’s latest research, a known Chinese hacking group used watering hole-style attacks and spear phishing emails to breach specific employees of the Mongolian data center. After gaining individual access, they leveraged those accounts to gain additional control over the facility’s infrastructure.
Click to expand...

https://www.cyberscoop.com/apt27-mongolia-kaspersky/

guest · Sep 10, 2018

LuckyMouse signs malicious NDISProxy driver with certificate of Chinese IT company
September 10, 2018
https://securelist.com/luckymouse-ndisproxy-driver/87914/

Since March 2018 we have discovered several infections where a previously unknown Trojan was injected into the lsass.exe system process memory. These implants were injected by the digitally signed 32- and 64-bit network filtering driver NDISProxy. Interestingly, this driver is signed with a digital certificate that belongs to Chinese company LeagSoft, a developer of information security software based in Shenzhen, Guangdong.

We assess with high confidence that NDISProxy is a new tool used by LuckyMouse. Kaspersky Lab products detect the described artefacts

This digitally signed driver is the most interesting artefact used in this campaign. The network filtering modules serve two purposes: first they decrypt and inject the RAT; second, they set its communication channel through RDP port 3389.

The communication between the user-mode in-memory Trojan and the driver goes through the custom control codes used by the DeviceIoControl() Windows API function.
Click to expand...

itman · Sep 10, 2018

NDISProxy works as a network traffic filter engine, filtering the traffic going through RDP port 3389 (the port number is hardcoded) and injecting messages into it.
Click to expand...

Time everyone just block in/out port 3389 traffic with your router firewall.

Log in or Sign up

LuckyMouse hits national data center to organize country-level waterholing campaign

Minimalist Registered Member

Minimalist Registered Member

guest Guest

itman Registered Member

Log in or Sign up

LuckyMouse hits national data center to organize country-level waterholing campaign

Minimalist Registered Member

Minimalist Registered Member

guest Guest

itman Registered Member

Useful Searches