Mikroceen (Microcin): Spying backdoor leveraged in high‑profile networks in Central Asia

guest · May 15, 2020

Backdoors in recent espionage attempts link to Microcin malware
May 15, 2020
https://www.bleepingcomputer.com/ne...-espionage-attempts-link-to-microcin-malware/

Antivirus engines foiled an advanced attacker’s attempts to infiltrate a governmental institution and corporate networks of two companies in the telecommunications and gas sector.
Links to known malware
The attacks occurred last fall and were stopped automatically by Avast and ESET antivirus engines. A host of backdoors and tools for lateral movement were later analyzed by malware researchers, who found code similarities with past malware and campaigns attributed to a China-based actor.

Some hints pointing to a Chinese connection are the use of the hosting provider Choopa, LLC, for most of the command and control (C2) servers and the use of Gh0st RAT, attributed to Chinese APTs in the past.
Cisco in a report updated in March described Choopa as “an attractive platform for criminals to host exploit kit domains, phishing, and other gray content.”
Click to expand...

“The samples we analyzed contain links to malware samples and campaigns, such as Microcin, BYEBY, and Vicious Panda” - Avast
Tracking these campaigns goes back to 2017, when Kaspersky published information on Microcin targeting Russian military. A few days later, Palo Alto Network released they analysis on BYEBY targeting the Belarusian government.

Avast and ESET today released reports [1, 2] with technical details about all the tools the threat actor employed for their intrusion attempts.
Click to expand...

Avast: APT Group Planted Backdoors Targeting High Profile Networks in Central Asia
ESET: Mikroceen: Spying backdoor leveraged in high‑profile networks in Central Asia

In this joint blogpost with fellow researchers from Avast, we provide a technical analysis of a constantly developed RAT that has been used in various targeted campaigns against both public and private subjects since late 2017. We observed multiple instances of attacks involving this RAT, and all of them happened in Central Asia. Among the targeted subjects were several important companies in the telecommunications and gas industries, and governmental entities.

We chose the name Mikroceen to cover all instances of the RAT, in acknowledgement of Kaspersky’s initial report on the family. The misspelling is intentional, in order to avoid the established microbiological notion, but also to have at least phonemic agreement.
Click to expand...

guest · Jun 19, 2020

Microcin is here
June 19, 2020
https://securelist.com/microcin-is-here/97353/

In February 2020, we observed a Trojan injected into the system process memory on a particular host. The target turned out to be a diplomatic entity. What initially attracted our attention was the enterprise-grade API-like (application programming interface) programming style. Such an approach is not that common in the malware world and is mostly used by top-notch actors.

Due to control server reuse (Choopa VPS service), target profiling techniques and code similarities, we attribute this campaign with high confidence to the SixLittleMonkeys (aka Microcin) threat actor.
Why we consider the current software architecture interesting
By “enterprise-grade API-like programming style” we mean, firstly, asynchronous work with sockets.
Obviously, however, neither client-side software nor Trojans of this kind need this server-side programming approach. So, it looks to us like the developers have applied some habits from server-side programming. [...]
Click to expand...

To sum up
This time the Microcin campaign has made an interesting step forward, not in terms of a fancy initial infection vector, but as programmers. The API-like network module is much easier to support and update. This improvement is not only about anti-detection or anti-analysis; it’s about software architecture and a step towards a normal non-monolithic framework implementation.
Click to expand...

Log in or Sign up

Mikroceen (Microcin): Spying backdoor leveraged in high‑profile networks in Central Asia

guest Guest

guest Guest

Log in or Sign up

Mikroceen (Microcin): Spying backdoor leveraged in high‑profile networks in Central Asia

guest Guest

guest Guest

Useful Searches