Mr. Wang trail deepens

More breadcrumbs..........

In summary, Zeng Xiaoyong, a well-known Chinese hacker using the handles ‘envymask’ and ‘EMM’ worked for RealSOI. RealSOI was closely associated with the MSS front companies identified in previous articles and Zeng knew Wang Qingwei, having worked as an InfoSec trainer with him. 

#youknowwherethisleads

APT trends report Q2 2019

https://securelist.com/apt-trends-report-q2-2019/91897/

In April, we published our report on TajMahal, a previously unknown APT framework that has been active for the last five years. This is a highly sophisticated spyware framework that includes backdoors, loaders, orchestrators, C2 communicators, audio recorders, keyloggers, screen and webcam grabbers, documents, and cryptography key stealers; and even its own file indexer for the victim’s computer. We discovered up to 80 malicious modules stored in its encrypted Virtual File System – one of the highest numbers of plugins we have ever seen in an APT toolset. The malware features its own indexer, emergency C2s, the ability to steal specific files from external drives when they become available again, and much more. There are two different packages, self-named ‘Tokyo’ and ‘Yokohama’ and the targeted computers we found include both packages. We think the attackers used Tokyo as the first stage infection, deploying the fully functional Yokohama package on interesting victims, and then leaving Tokyo in place for backup purposes. So far, our telemetry has revealed just a single victim, a diplomatic body from a country in Central Asia. This begs the question, why go to all that trouble for just one victim? We think there may be other victims that we haven’t found yet. This theory is supported by the fact that we couldn’t see how one of the files in the VFS was used by the malware, opening the door to the possibility of additional versions of the malware that have yet to be detected.

Will the real Mr. Wang please stand up

I have started looking at this blog in the past few months, and am really enjoying it more and more these days.

In summary, Wang Qingwei, an IT security expert, advertised jobs at Jinan Fanglang using two online profiles and was also listed as the company’s official representative. He is directly linked to likely MSS Officer Guo Lin, travelling with him on multiple occasions.

#theyknowwherethisleads

KPOT v2.0 stealer silently steals credentials

New KPOT v2.0 stealer

Turla renews its arsenal with Topinambour

https://securelist.com/turla-renews-its-arsenal-with-topinambour/91687/

https://www.nytimes.com/2019/05/06/us/politics/china-hacking-cyber.html
https://www.symantec.com/blogs/threat-intelligence/buckeye-windows-zero-day-exploit

Windows zero day was exploited by Buckeye alongside Equation Group tools during 2016 attacks. Exploit and tools continued to be used after Buckeye's apparent disappearance in 2017.

Key Findings

• The Buckeye attack group was using Equation Group tools to gain persistent access to target organizations at least a year prior to the Shadow Brokers leak.
• Variants of Equation Group tools used by Buckeye appear to be different from those
  released by Shadow Brokers, potentially indicating that they didn't originate from that leak.
• Buckeye's use of Equation Group tools also involved the exploit of a previously unknown Windows zero-day vulnerability. This zero day was reported by Symantec to Microsoft in September 2018 and patched in March 2019.
• While Buckeye appeared to cease operations in mid-2017, the Equation Group tools it used continued to be used in attacks until late 2018. It is unknown who continued to use the tools. They may have been passed to another group or Buckeye may have continued operating longer than supposed.

Iran has its turn in limelight

A Mystery Agent Is Doxing Iran's Hackers and Dumping Their Code
https://www.wired.com/story/iran-hackers-oilrig-read-my-lips

Russian VPNfilter Malware Was A Swiss Army Hacking Knife

https://packetstormsecurity.com/news/view/29349/Russian-VPNfilter-Malware-Was-A-Swiss-Army-Hacking-Knife.html

Rootkit Tricks

a few links:
https://msdn.microsoft.com/en-us/library/windows/desktop/ms682489(v=vs.85).aspx
http://stackoverflow.com/questions/4021307/enumprocesses-vs-createtoolhelp32snapshot
https://books.google.com/books?id=ifQPC86G66sC&pg=PA437&lpg=PA437&dq=CreateToolhelp32Snapshot()
https://msdn.microsoft.com/en-us/library/windows/desktop/ms682631(v=vs.85).aspx



A few other windows things:
https://msdn.microsoft.com/en-us/library/windows/desktop/ms724947(v=vs.85).aspx
https://msdn.microsoft.com/en-us/library/windows/desktop/ms646293(v=vs.85).aspx

Nation State Attribution

http://carnal0wnage.attackresearch.com/2016/11/on-nation-states-and-sophistication.html?m=1

Windows DLL Injection

the basics

metasploit




Tools:
DueDLLigence