Mot-clé - malware

Fil des billets

lundi 17 janvier 2022

Delving Deep: An Analysis of Earth Lusca’s Operations

Hey folks,

We just released this one - Delving Deep: An Analysis of Earth Lusca’s Operations

Summary is here

Full paper is here.

Finally, all IOCs are available here.

I hope you'll enjoy this ride into the TTP of that threat actor !

mercredi 10 novembre 2021

Void Balaur and the Rise of the Cybermercenary Industry

It is rare to be able to track the activities of a real cybermercenary threat actor. But we did ;-)

Ladies and gents, please meet Void Balaur.

Full paper here.

Forbes article here, Le Monde here.

mardi 18 février 2020

Operation DRBControl Uncovering a Cyberespionage Campaign Targeting Gambling Companies in Southeast Asia

Quite proud of this new publication done with several extremely talented colleagues, thanks Daniel, Jaromir, Jamz, and Kenney :-)

Operation DRBControl - Uncovering a Cyberespionage Campaign Targeting Gambling Companies in Southeast Asia

Full paper is here:

Hope you will enjoy, and see you soon for another stunning APT research (yes, already working on another... :p) :-)

vendredi 20 décembre 2019

MISC 107 -


Cela faisait longtemps que je n'avais pas contribué à MISC, non pas par manque de temps ou de motivation mais tout simplement par manque de sujet intéressant. Il devient difficile pour moi de trouver des sujets qui n'ont pas déjà été exposés dans MISC, et je dois bien avouer que je ne prends pas forcément le temps non plus de me creuser le caillou pour trouver des sujets.

Celui-ci est plutôt lié à mon actualité professionnelle, puisque depuis de nombreux mois je vois de plus en plus de malwares (notamment en APT) utilisant des plateformes légitimes pour gérer leurs communications.

Je vous invite donc à lire mon nouvel article dans MISC 107 sur ce sujet.

Et bonnes fêtes de fin d'année ! :-)

misc-107.jpg, déc. 2019

jeudi 12 décembre 2019

Drilling Deep: A Look at Cyberattacks on the Oil and Gas Industry

Hi all,

I am very proud to provide you with a new paper I wrote in collaboration with my colleague Feike Hacquebord, entitled "Drilling Deep: A Look at Cyberattacks on the Oil and Gas Industry".

Full paper is here.

I hope you will enjoy it ! :-)

jeudi 14 novembre 2019

More than a Dozen Obfuscated APT33 Botnets Used for Extreme Narrow Targeting

Hello there,

I had the pleasure to work with Feike and Kenney on this blog post which reveals an interesting (hopefully) part of APT33's infrastructure.

Hope you'll like it !

mardi 10 septembre 2019

Interview dans Libération - RETADUP


J'ai récemment été interviewé par Libération à propos de RETADUP.

Le buzz du moment sur Retadup m'a laissé un peu aigri, parce que de nombreux articles écrits par des journalistes non méticuleux indiquent que c'est la société Avast qui a découvert Retadup en Mars 2019, alors que j'ai bloggé en compagnie de mes collègues sur le sujet à plusieurs reprises en 2017:

Ceci n'enlève rien bien sûr à l'excellent travail fourni par le C3N de la Gendarmerie Nationale, et la société Avast. Bravo à eux ! :-)

mardi 16 juillet 2019

The SLUB guys are back !

The SLUB guys are back !

We detected them from another watering hole, and they updated their malware. More about it here.

As a reminder, we first published about them here

jeudi 13 juin 2019

Advanced Targeted Attack Tools Found Being Used to Distribute Cryptocurrency Miners

Hey there :-)

I just contributed to a new blog post about some cybercriminals using advanced tools to spread a cryptocurrency miner.

The full blog post is here.

Cheers !

jeudi 7 mars 2019

New SLUB Backdoor Uses GitHub, Communicates via Slack

So here is a new blog post. It was a great collaborative work with several of my highly skilled colleagues :-)

It is all about a new malware we discovered recently, used in an APT, and sitting on an interesting watering hole.

lundi 11 décembre 2017

Untangling the Patchwork Cyberespionage Group

Hi guys,

We released a new technical paper about a known APT threat actor named "Patchwork".

The blog entry is here, while the full paper is there.

Cheers ! :-)

jeudi 21 septembre 2017

New RETADUP Variants Hit South America, Turn To Cryptocurrency Mining

Hi all,

I have written this blog post in collab with my good friends Kenney and Lenart... ;-)

Available HERE.

jeudi 20 juillet 2017

Android Backdoor GhostCtrl can Silently Record Your Audio, Video, and More

Some days ago we published this blog post. It seems that some cybercriminals are heavily using it at the moment to spy audio conversations. I guess it's pretty interesting.

mercredi 22 mars 2017

Winnti Abuses GitHub for C&C Communications

Hi folks,

I've published a new blog post today on Trend Micro's blog. This is once again about some APT campaign, this time showing some of the new modus operandi from a threat actor named Winnti.

It is available here.

lundi 5 septembre 2016

MISC 87 - Business E-Mail Compromise

Hello à tous/toutes,

Je vous avais promis un article MISC qui pour une fois ne parlerait pas d' APT, c'est chose faite dans MISC 87.


Vous y trouverez un article que j'ai écrit sur le phénomène du "Business e-mail compromise". J'espère qu'il vous plaira ! :-)

Je suis un peu sec pour de nouveaux sujets MISC en ce moment, si vous avez des idées n'hésitez pas à me solliciter ! ;-)

jeudi 17 septembre 2015

Operation Iron Tiger

I have published a new report about an APT threat actor known as "Emissary Panda" which originates from China. The blog entry is here, while the full paper is here. There is also an appendix here.

This research paper involved a lot of work with my great colleagues from CSS/Trend Micro. It was a great pleasure to write it :-)

I hope you will enjoy this long (more than 50 pages) paper ! :-)

mardi 1 septembre 2015

New Rocket Kitten research paper

Following my first research paper about the Rocket Kitten APT threat actor, I have released another one, this time as a collaboration work with one researcher from ClearSky.

The blog post is here: Rocket Kitten Spies Target Iranian Lecturer and InfoSec Researchers in New Modus

The full paper is here: The Spy Kittens Are Back : Rocket Kitten 2

mardi 31 mars 2015

Fake Judicial Spam Leads to Backdoor with Fake Certificate Authority

Here is the link to a new blog post I wrote with friends Kenney Lu and Dark Luo from Trend Micro.

It has several interesting aspects, in my mind:

  • The fact that there is an ongoing campaign against french people, using french material, which is rare enough to be worth mentioning;
  • The fact that there is a kit used to drop different payloads: Gootkit, CryptoWall, some banking trojan...;
  • The fact that it uses an innovating method to infect the victims computers.

Hope you will enjoy the read ! :-)

mercredi 18 mars 2015

Operation Woolen GoldFish

Hi all,

Here is my first research paper done for my new employer, Trend Micro.

I hope you'll enjoy it ! :-)

The blog summary I wrote about the paper is here, while the complete paper can be found here.

jeudi 29 août 2013

More on the G20 Summit Espionage Operation

On a recent blog post, Claudio Guarnieri analyzes an APT attack campaign launched by the "Calc Group".

This group of attackers used the soon-coming "G20 Summit" to spear phish their targets. which are mostly financial institutions and governments. The attack in itself is really not sophisticated, it is just made of an archive file (.ZIP) containing a malicious executable file (.EXE).

The names of the zip files are:

  • G20 Briefing
  • G20 Summit

These archives contains the following files:

  • G20 Discussion Paper.exe
  • GPFI Work Plan 2013.exe
  • G20 Summit Improving global confidence and support the globa.EXE
  • Improving global confidence and support.pdf.exe
  • The list of NGOs representatives accredited at the Press Center of The G20 Leaders' Summit 2013.pdf.exe

One might be surprised that people really do open such zip files and click on these executables, but believe me, some people still do. Once again, it shows us that it is not necessary to deploy brilliant strategies to infect people with targeted malware.

Claudio makes a great analyse of these attacks in his blog post, so I won't write about it and let you read it instead. Now what I wanted to know was what happened next. I was especially interested in the second attack, because it had been submitted to Virus Total (VT) from France.

To summarize Claudio's analysis, the attack scheme goes like this :

  • The victim gets the zip file, opens it, and executes the malicious executable.
  • The executable shows a decoy document (PDF) about the G20 or such.
  • The executable starts keylogging and downloads more malware.

This last point is very important to me: what malware is downloaded, and why? (the "why" can be expected though...)

To quote Claudio, "these samples are just an initial stage of a larger suite of malware, possibly including Aumlib and Ixeshe, which it will try to download from a fixed list of URLs embedded in the binary".

Luckily enough, the second stage malware was still available and I could download it for analysis. It turns out that it is not an "AumLib" or an "Ixeshe", but a variant of a less known malware, called "Bisonha" by the malware researcher's community.

To bypass anti-virus and IDS/IPS products, it is downloaded "upside down" (the first byte becomes the last byte, etc.) and written locally as a regular executable once it is downloaded successfully, then executed.

The file shows a "Java" icon, to try to look more "legitimate" to users. At the time of writing, the sample I downloaded had not been submitted to Virus Total, so I did. The detection rate for this sample is 12/46.

This malware has no persistence mechanism (the first stage downloader makes it persistent), and once executed starts communicating with an IP address on port 443:

/300100000000F0FD1F003746374637433731333433363334333600484F4D45000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070155736572000000000000000000000000000000000000000000000000000000000000000000006444000000000000000000000000000000000000000000 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Connection: Keep-Alive
Cache-Control: no-cache

As you can see, the network traffic is on port 443 (HTTPS) but it is definitely no HTTPS traffic, rather hex-encoded data:

0000000: 0000 0000 f0fd 1f00 3746 3746 3743 3731  ........7F7F7C71
0000010: 3334 3336 3334 3336 0048 4f4d 4500 0000  34363436.HOME...
0000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000040: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000050: 0000 0000 0000 0000 0007 0155 7365 7200  ...........User.
0000060: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000070: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000080: 0064 4400 0000 0000 0000 0000 0000 0000  .dD.............
0000090: 0000 0000 0000 0000                      ........

My reverse engineering rockstar friend Fabien Perigaud had a closer look at the malware and provided me with more information:

Offset: 0x4: RAM size in kilobytes
Offset: 0x8: Hard-drive ID, xored with the machine name then hex-encoded
Offset: 0x19: Machine name
Offset: 0x59: Operating system version (in malware author's writing)
Offset: 0x60: Number of processors
Offset: 0x61: User name
Offset: 0x81: A unique identifier (probably used as a campaign identifier?) - Here it is "dD" but other two characters identifiers have been witnessed in the wild.

The commands which can be sent to the malware are sent in answer:

3004: File writing
3005: File reading
3006: Writing and execution of a file

3115 : provide a shell

3222 : write a new ID in %APPDATA%\recycle.ini 
3223 : auto deletion of the malware
3224 : update

This quick analysis shows us that no matter how deep your knowledge is about an attacker, you're never safe from seeing him change his methods completely. That is why APT attacks attribution is such a hard task.

Thanks to Fabien, Jesse, Brian and Ned for the help while writing this small post ;-)

EDIT: (2013/09/04) Satnam Narang from Symantec just posted interesting material about the same APT campaign. You can read it here. In few words, Poison Ivy RAT is also in the game ;)

- page 1 de 3