The administrator of your personal data will be Threatpost, Inc., 500 Unicorn Park, Woburn, MA 01801. Detailed information on the processing of personal data can be found in the privacy policy. In addition, you will find them in the message confirming the subscription to the newsletter.
Microsoft on Friday disclosed a potential connection between the Raspberry Robin USB-based worm and an infamous Russian cybercrime group tracked as Evil Corp.
The tech giant said it observed the FakeUpdates (aka SocGholish) malware being delivered via existing Raspberry Robin infections on July 26, 2022.
Raspberry Robin, also called QNAP Worm, is known to spread from a compromised system via infected USB devices containing malicious a .LNK files to other devices in the target network.
The campaign, which was first spotted by Red Canary in September 2021, has been elusive in that no later-stage activity has been documented nor has there any concrete link tying it to a known threat actor or group.
The disclosure, therefore, marks the first evidence of post-exploitation actions carried out by the threat actor upon leveraging the malware to gain initial access to a Windows machine.
“The DEV-0206-associated FakeUpdates activity on affected systems has since led to follow-on actions resembling DEV-0243 pre-ransomware behavior,” Microsoft noted.
DEV-0206 is Redmond’s moniker for an initial access broker that deploys a malicious JavaScript framework called FakeUpdates by enticing targets into downloading fake browser updates in the form of ZIP archives.
The malware, at its core, acts as a conduit for other campaigns that make use of this access purchased from DEV-0206 to distribute other payloads, primarily Cobalt Strike loaders attributed to DEV-0243, which is also known as Evil Corp.
Referred to as Gold Drake and Indrik Spider, the financially motivated hacking group has historically operated the Dridex malware and has since switched to deploying a string of ransomware families over the years, including most recently LockBit.
“The use of a RaaS payload by the ‘EvilCorp’ activity group is likely an attempt by DEV-0243 to avoid attribution to their group, which could discourage payment due to their sanctioned status,” Microsoft said.
It’s not immediately clear what exact connections Evil Corp, DEV-0206, and DEV-0243 may have with one another.
Katie Nickels, director of intelligence at Red Canary, said in a statement shared with The Hacker News that the findings, if proven to be correct, fill a “major gap” with Raspberry Robin’s modus operandi.
“We continue to see Raspberry Robin activity, but we have not been able to associate it with any specific person, company, entity, or country,” Nickels said.
“Ultimately, it’s too early to say if Evil Corp is responsible for, or associated with, Raspberry Robin. The Ransomware-as-a-Service (RaaS) ecosystem is a complex one, where different criminal groups partner with one another to achieve a variety of objectives. As a result, it can be difficult to untangle the relationships between malware families and observed activity.”
A Microsoft logo is seen at a pop-up site at Roosevelt Field in Garden City, New York July 29, 2015. REUTERS/Shannon Stapleton
LONDON, July 29 (Reuters) – An Austrian firm which Microsoft (MSFT.O) said created malicious software that was detected on the computer systems of some of its clients in at least three countries has said its spying tool “Subzero” was for official use in EU states only.
On Wednesday, Microsoft said the firm, DSIRF, had deployed the spying software, or spyware — capable of accessing confidential information such as passwords or logon credentials — at an unspecified number of unidentified banks, law firms and strategic consultancies. read more
“Subzero is a software of the Austrian DSIRF GesmbH, which has been developed exclusively for official use in states of the EU. It is neither offered, sold nor made available for commercial use,” DSIRF said in an emailed statement.
“In view of the facts described by Microsoft, DSIRF resolutely rejects the impression that it has misused Subzero software,” it added.
It was not clear which EU member state governments, if any, were using the tool. DSIRF did not respond to requests for further comment.
Austria’s interior ministry told local news agency APA on Friday that it was investigating the Microsoft claims. The ministry did not respond to requests from Reuters for comment.
Spyware tools have come into increased focus in Europe and the United States after Pegasus, spyware developed by Israel’s NSO, was found to have been used by governments to spy on journalists and dissidents.
DSIRF said they had commissioned an independent expert to investigate the issues raised by Microsoft, and had reached out to the U.S. tech giant for “collaboration on the issue”.
Microsoft declined to offer further comment.
In its Thursday blog post, the company said DSIRF had developed four so-called “zero-day exploits”, serious software flaws of great value to both hackers and spies because they work even when software is up to date.
DSIRF listed a handful of previous, commercial, clients as references in an internal presentation promoting Subzero that was published by German news website Netzpolitik last year.
Two of the companies that were named in that presentation, SIGNA Retail and Dentons, told Reuters they had not used the spyware and had not consented to be a reference for the company.
DSIRF did not respond to a request for comment on the matter.
Reporting by James Pearson
Additional reporting by Michael Shields in Zurich; Editing by Kirsten Donovan
Our Standards: The Thomson Reuters Trust Principles.
In the age of EDR, red team operators cannot get away with using pre-compiled payloads anymore. As such, malware development is becoming a vital skill for any operator. Getting started with maldev may seem daunting, but is actually very easy. This workshop will show you all you need to get started!
This repository contains the slides and accompanying exercises for the ‘MalDev for Dummies’ workshop that will be facilitated at Hack in Paris 2022 (additional conferences TBA). The exercises will remain available here to be completed at your own pace – the learning process should never be rushed! Issues and pull requests to this repo with questions and/or suggestions are welcomed.
Disclaimer: Malware development is a skill that can -and should- be used for good, to further the field of (offensive) security and keep our defenses sharp. If you ever use this skillset to perform activities that you have no authorization for, you are a bigger dummy than this workshop is intended for and you should skidaddle on out of here.
With antivirus (AV) and Enterprise Detection and Response (EDR) tooling becoming more mature by the minute, the red team is being forced to stay ahead of the curve. Gone are the times of execute-assembly and dropping unmodified payloads on disk – if you want your engagements to last longer than a week you will have to step up your payload creation and malware development game. Starting out in this field can be daunting however, and finding the right resources is not always easy.
This workshop is aimed at beginners in the space and will guide you through your first steps as a malware developer. It is aimed primarily at offensive practitioners, but defensive practitioners are also very welcome to attend and broaden their skillset.
During the workshop we will go over some theory, after which we will set you up with a lab environment. There will be various exercises that you can complete depending on your current skillset and level of comfort with the subject. However, the aim of the workshop is to learn, and explicitly not to complete all the exercises. You are free to choose your preferred programming language for malware development, but support during the workshop is provided primarily for the C# and Nim programming languages.
During the workshop, we will discuss the key topics required to get started with building your own malware. This includes (but is not limited to):
To get started with malware development, you will need a dev machine so that you are not bothered by any defensive tooling that may run on your host machine. I prefer Windows for development, but Linux or MacOS will do just as fine. Install your IDE of choice (I use VS Code for almost everything except C#, for which I use Visual Studio, and then install the toolchains required for your MalDev language of choice:
Don’t forget to disable Windows Defender or add the appropriate exclusions, so your hard work doesn’t get quarantined!
Note: Oftentimes, package managers such as apt or software management tools such as Chocolatey can be used to automate the installation and management of dependencies in a convenient and repeatable way. Be conscious however that versions in package managers are often behind on the real thing! Below is an example Chocolatey command to install the mentioned tooling all at once.
choco install -y nim choosenim go rust vscode visualstudio2019community dotnetfx
Both C# and Nim are compiled languages, meaning that a compiler is used to translate your source code into binary executables of your chosen format. The process of compilation differs per language.
C# code (.cs files) can either be compiled directly (with the csc utility) or via Visual Studio itself. Most source code in this repo (except the solution to bonus exercise 3) can be compiled as follows.
Note: Make sure you run the below command in a “Visual Studio Developer Command Prompt” so it knows where to find
csc, it is recommended to use the “x64 Native Tools Command Prompt” for your version of Visual Studio.
csc filename.exe /unsafe
You can enable compile-time optimizations with the /optimize flag. You can hide the console window by adding /target:winexe as well, or compile as DLL with /target:library (but make sure your code structure is suitable for this).
Nim code (.nim files) is compiled with the nim c command. The source code in this repo can be compiled as follows.
nim c filename.nim
If you want to optimize your build for size and strip debug information (much better for opsec!), you can add the following flags.
nim c -d:release -d:strip --opt:size filename.nim
Optionally you can hide the console window by adding --app:gui as well.
Most Nim programs depend on a library called “Winim” to interface with the Windows API. You can install the library with the Nimble package manager as follows (after installing Nim):
nimble install winim
The workshop slides reference some resources that you can use to get started. Additional resources are listed in the README.md files for every exercise!