MONSOON – ANALYSIS OF AN APT CAMPAIGN

Recommendations

Info

Forcepoint Security Labs | Special Investigations Figure 1 – Word-Cloud of Lure Document Titles “Our MONSOON investigation has uncovered what is clearly a concerted and persistent campaign to steal sensitive data from a variety of critical sources. The use of both current and topical themes [illustrated above] as lures, not only indicates the precision level of targeting but also the targeting decision process itself.” Andy Settle Head of Special Investigations MONSOON – ANALYSIS OF AN APT CAMPAIGN Revision: 1.07 | TLP-WHITE | 1/57
Forcepoint Security Labs | Special Investigations TABLE OF CONTENTS Executive Summary ...................................................................................................................................... 4 Acknowledgements ................................................................................................................................... 4 Summary of Observations ............................................................................................................................ 5 Key Features ............................................................................................................................................. 5 Adversary. ............................................................................................................................................. 5 Intent. .................................................................................................................................................... 5 Infrastructure ......................................................................................................................................... 5 Capability .............................................................................................................................................. 5 Victims ................................................................................................................................................... 5 Victims of Interest .................................................................................................................................. 5 Victim of Opportunity ............................................................................................................................. 5 Timeframe ............................................................................................................................................. 5 Technical Analysis ........................................................................................................................................ 6 Initial Discovery ......................................................................................................................................... 6 Pivoting via VirusTotal ........................................................................................................................... 6 Cyber Crime Bill. ................................................................................................................................... 6 Pivoting by Author. ................................................................................................................................ 6 Distribution Mechanism ......................................................................................................................... 9 E-Mail Lures & Malware Distribution ........................................................................................................ 10 Email Lures ......................................................................................................................................... 10 Topical News Lures ................................................................................................................................. 12 News Site ............................................................................................................................................ 12 Google Plus. ........................................................................................................................................ 13 Facebook. ........................................................................................................................................... 14 Twitter Account. ................................................................................................................................... 15 Malware Analysis ........................................................................................................................................ 16 Weaponised Documents ......................................................................................................................... 16 Exploitation of Known Vulnerabilities ................................................................................................... 16 BADNEWS Weaponised Documents ................................................................................................... 17 AutoIt Backdoor & Unknown Logger Weaponised Documents ............................................................ 19 TINYTYPHON Weaponised Documents .............................................................................................. 19 Potential Silverlight Exploit ...................................................................................................................... 20 Silverlight Profiling ............................................................................................................................... 21 BADNEWS Malware ................................................................................................................................ 22 DLL Side-Loading ................................................................................................................................ 22 Persistence ......................................................................................................................................... 22 C&C Channels ..................................................................................................................................... 23 C&C Mechanism ................................................................................................................................. 26 badnews_decoder.py .......................................................................................................................... 27 Command Set ..................................................................................................................................... 28 Keylogger ............................................................................................................................................ 29 Document Crawler ............................................................................................................................... 29 MONSOON – ANALYSIS OF AN APT CAMPAIGN Revision: 1.07 | TLP-WHITE | 2/57
Page 1: MONSOON - ANALYSIS OF AN APT CAMPAI
Page 5 and 6: Forcepoint Security Labs | Special
Page 53 and 54:
Forcepoint Security Labs | Special
Page 55 and 56:
Page 57 and 58:
show all

MONSOON – ANALYSIS OF AN APT CAMPAIGN

Create successful ePaper yourself

Delete template?

Save as template?