Threat Detection Update 02-July-2024 | Stamus Networks (2024)

The Week in Review from Stamus Labs

Welcome to the weekly threat detection update report from Stamus Networks. Each week, you will receive this email with a summary of the updates.

Current Stamus Threat Intelligence (STI) release version: 1085

This week, in addition to daily ruleset and IOC updates, we provided Stamus Security Platform customers with the following improved defense(s):

• New threat detection(s) added [1]: 5 (Satan Stealer, Rafel RAT, SpiceRAT, Polyfill Supply Chain Attack, Compromised Wordpress Plugin)
• Major changes to detections(s) [2]: 254
• Updated threat detection(s) [3]: 302

Note: a "method" as referenced below, is a discrete detection vector for a given threat.

The following detections were added to your Stamus Security Platform (SSP) this past week:

Satan Stealer (Data Theft)

A new malware named “Satanstealer” has been identified, targeting browser cookies and passwords.

The discovery was first reported by MonThreat, a prominent cybersecurity research group, via their official Twitter account.

The malware is designed to infiltrate users’ systems, extract sensitive information, and potentially compromise personal and financial data.

Cyber Security News

Satan Stealer - Github |

• Total number of detection methods: 2
• Kill chain phase(s): actions on objectives, exploitation
• MITRE ATT&CK: T1005

Rafel RAT (RAT)

Check Point Research has identified multiple threat actors utilizing Rafel, an open-source remote administration tool (RAT). The discovery of an espionage group leveraging Rafel in their operations was of particular significance, as it indicates the tool’s efficacy across various threat actor profiles and operational objectives.

Check Point Research

• Total number of detection methods: 2
• Kill chain phase(s): command and control

SpiceRAT (RAT)

A previously undocumented Chinese-speaking threat actor codenamed SneakyChef has been linked to an espionage campaign primarily targeting government entities across Asia and EMEA (Europe, Middle East, and Africa) with SugarGh0st malware since at least August 2023.

The attacks against Angola are also notable for the fact that it utilizes a new remote access trojan codenamed SpiceRAT using lures from Neytralny Turkmenistan, a Russian-language newspaper in Turkmenistan.

SpiceRAT, for its part, employs two different infection chains for propagation, one of which uses an LNK file present inside a RAR archive that deploys the malware using DLL side-loading techniques.

"When the victim extracts the RAR file, it drops the LNK and a hidden folder on their machine," the researchers said. "After a victim opens the shortcut file, which masqueraded as a PDF document, it executes an embedded command to run the malicious launcher executable from the dropped hidden folder."

Thehackernews

SpiceRAT - Cisco Talos |

• Total number of detection methods: 4
• Kill chain phase(s): command and control

Polyfill Supply Chain Attack (Supply Chain Attack)

Google has taken steps to block ads for e-commerce sites that use the Polyfill.io service after a Chinese company acquired the domain and modified the JavaScript library ("polyfill.js") to redirect users to malicious and scam sites.

More than 110,000 sites that embed the library are impacted by the supply chain attack, Sansec said in a Tuesday report.

Polyfill is a popular library that incorporates support for modern functions in web browsers. Earlier this February, concerns were raised following its purchase by China-based content delivery network (CDN) company Funnull.

Thehackernews

Polyfill Supply Chain Attack - Mozilla |

• Total number of detection methods: 9
• Kill chain phase(s): exploitation, command and control

Compromised Wordpress Plugin (Backdoor)

WordPress plugins running on as many as 36,000 websites have been backdoored in a supply-chain attack with unknown origins, security researchers said on Monday.

So far, five plugins are known to be affected in the campaign, which was active as recently as Monday morning, researchers from security firm Wordfence reported. Over the past week, unknown threat actors have added malicious functions to updates available for the plugins on WordPress.org, the official site for the open source WordPress CMS software. When installed, the updates automatically create an attacker-controlled administrative account that provides full control over the compromised site. The updates also add content designed to goose search results.

Ars Technica

Compromised Wordpress Plugin - Wordfence |

• Total number of detection methods: 31
• Kill chain phase(s): exploitation

The following detections were updated this past week with changes to kill chain phase(s) or MITRE ATT&CK tactic(s)/technique(s):

APT 29 (APT)

APT29 is threat group that has been attributed to the Russian government and has operated since at least 2008. This group reportedly compromised the Democratic National Committee starting in the summer of 2015. MITRE

• Added kill chain phase(s): actions on objectives, command and control
• Previously supported kill chain phase(s): actions on objectives, command and control
• Methods added: 2

APT-C-23 (APT)

The APT-C-23 group is known to have used both Windows and Android components in its operations, with the Android components first described in 2017. In the same year, multiple analyses of APT-C-23’s mobile malware were published. ESET

• Added kill chain phase(s): command and control
• Previously supported kill chain phase(s): command and control, actions on objectives
• Methods added: 1

APT35 (APT)

Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted U.S. and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014. MITRE

• Added kill chain phase(s): delivery
• Previously supported kill chain phase(s): command and control, delivery
• Methods added: 38

ClearFake (Exploit Kit)

There are several malicious fake updates campaigns being run across thousands of compromised websites. This campaign appears to have started around July 19th, 2023. Based on a search on PublicWWW of the injection base64 there are at least 434 infected sites. The name is a reference to the majority of the Javascript being used without obfuscation. One noticeable difference from SocGholish is that there appears to be no tracking of visits by IP or cookies. As an analyst you can you go back to the compromised site over and over coming from the same IP and not clearing your browser cache. This also means the site owner is more likely to see the infection as well. When a user visits a compromised website with ClearFake, the page initially loads as normal before the whole page is taken over by a call to action to update Chrome.

On the index page of the compromised site there is a Javascript injection. The Javascript is base64 encoded. Presumably this is a dynamic injection and will change over time to reflect the new host for the initial payload. On the index page of the compromised site there is a Javascript injection. The Javascript is base64 encoded. Presumably this is a dynamic injection and will change over time to reflect the new host for the initial payload. The second web call returns a Javascript that creates an iframe to house the fake update UI. The iframe src is set to a Keitaro endpoint. The response from the Keitaro endpoint is the foundation for the HTML to be rendered within the iframe.

ClearFake Malware Analysis

• Added kill chain phase(s): command and control
• Previously supported kill chain phase(s): command and control, exploitation
• Methods added: 6

Command and Control (Generic CnC)

Adversaries may communicate using a custom command and control protocol instead of encapsulating commands/data in an existing Standard Application Layer Protocol. Implementations include mimicking well-known protocols or developing custom protocols (including raw sockets) on top of fundamental protocols provided by TCP/IP/another standard network stack.

• Added kill chain phase(s): command and control
• Previously supported kill chain phase(s): command and control, actions on objectives, delivery, installation
• MITRE ATT&CK added: T1071
• Previously existing MITRE ATT&CK: T1587, T1071, T1486, T1496
• Methods added: 11

Fake Browser (Trojan)

Attackers are utilizing hacked web sites that promote fake browser updates to infect targets with banking trojans. In some cases, post exploitation toolkits are later executed to encrypt the compromised network with ransomware.

Between May and September 2019, FireEye has conducted multiple incident response cases where enterprise customers were infected with malware through fake browser updates.

Hacked sites would display these "fakeupdates" through JavaScript alerts that state the user is using an old version of a web browser and that they should download an offered "update" to keep the browser running "smoothly and securely".

bleepingcomputer

• Added kill chain phase(s): exploitation, command and control
• Previously supported kill chain phase(s): delivery, exploitation, command and control
• Methods added: 41

Generic Coinminer (Cryptocurrency)

Coinminer is an unwanted malicious software which uses the victim's computational power (CPU and RAM mostly) to mine for coins (for example Monero or Zcash). The malware achieves persistence by adding one of the opensource miners on startup without the victim's consensus. Most sophisticated coin miners use timer settings or cap the CPU usage in order to remain stealthy. Malpedia

• Added kill chain phase(s): command and control
• Previously supported kill chain phase(s): actions on objectives, command and control, delivery
• MITRE ATT&CK added: T1496
• Previously existing MITRE ATT&CK: T1496
• Methods added: 1

Keitaro (Phishing)

Cyber ​​criminals violated the law TDS (Traffic Direction System) platform Keitaro and used it to redirect them users in exploit kits RIG and Fallout in order to infect them with malicious software.

TDS platforms are designed for redirection of users in particular sites. Legitimate TDS platforms, such as Keitaro, are mainly used by individuals and companies that want to advertise services or their products. Platforms drive users to the pages that companies want, targeting specific customers and promoting an ad campaign. techbizweb

• Added kill chain phase(s): exploitation
• Previously supported kill chain phase(s): exploitation, delivery, command and control
• Methods added: 4

Koadic (Offensive Tools)

Koadic is a Windows post-exploitation framework and penetration testing tool. Koadic is publicly available on GitHub and the tool is executed via the command-line. Koadic has several options for staging payloads and creating implants. Koadic performs most of its operations using Windows Script Host. MITRE

• Added kill chain phase(s): delivery
• Previously supported kill chain phase(s): command and control, delivery, actions on objectives
• Methods added: 2

Lumma (Data Theft)

Lumma is an information stealer written in C, sold as a Malware-as-a-Service by LummaC on Russian-speaking underground forums and Telegram since at least August 2022. Lumma's capabilities are those of a classic stealer, with a focus on cryptocurrency wallets, and file grabber capabilities. Malpedia

• Added kill chain phase(s): command and control
• Previously supported kill chain phase(s): actions on objectives, command and control, installation
• Methods added: 78

MintStealer (Data Theft)

The term info stealer is self-explanatory. This type of malware resides in an infected computer and gathers data in order to send it to the attacker. Typical targets are credentials used in online banking services, social media sites, emails, or FTP accounts.

Info stealers may use many methods of data acquisition. The most common are:

hooking browsers (and sometimes other applications) and stealing credentials that are typed by the user using web injection scripts that are adding extra fields to web forms and submitting information from them to a server owned by the attacker form grabbing (finding specific opened windows and stealing their content) keylogging stealing passwords saved in the system and cookies Modern info stealers are usually parts of botnets. Sometimes the target of attack and related events are configured remotely by the command sent from the Command and Control server (C&C). Malwarebytes

• Added kill chain phase(s): command and control, actions on objectives, delivery
• Previously supported kill chain phase(s): command and control
• Methods added: 12

RAT Generic (RAT)

Remote Access Trojans are programs that provide the capability to allow covert surveillance or the ability to gain unauthorized access to a victim PC. Remote Access Trojans often mimic similar behaviors of keylogger applications by allowing the automated collection of keystrokes, usernames, passwords, screenshots, browser history, emails, chat lots, etc. Remote Access Trojans differ from keyloggers in that they provide the capability for an attacker to gain unauthorized remote access to the victim machine via specially configured communication protocols which are set up upon initial infection of the victim computer. This backdoor into the victim machine can allow an attacker unfettered access, including the ability to monitor user behavior, change computer settings, browse and copy files, utilize the bandwidth (Internet connection) for possible criminal activity, access connected systems, and more. Malwarebytes

• Added kill chain phase(s): command and control, delivery
• Previously supported kill chain phase(s): installation, command and control, actions on objectives
• MITRE ATT&CK added: T1573
• Previously existing MITRE ATT&CK: T1041, T1573
• Methods added: 13

SocGholish (Social Engineering)

It leverages compromised websites and performs some of the most creative fingerprinting checks we’ve seen, before delivering its payload (NetSupport RAT). Malwarebytes

• Added kill chain phase(s): command and control
• Previously supported kill chain phase(s): command and control, exploitation, delivery, reconnaissance, actions on objectives
• Methods added: 3

TA399 (APT)

An Advanced Persistent Threat (APT) is a complex cyber-attack in which an unauthorized user gains access to a network and remains undetected for an extended period. What makes an ATP “advanced” is threat actors’ deep expertise and substantial resources, enabling them to employ a range of tactics, techniques, and procedures. “Persistent” underscores their long-term objectives. Rather than executing quick-hit attacks for immediate gain, these attackers focus on sustained operations that enable them to deeply entrench themselves within a compromised infrastructure.

Unlike other cyber threats primarily characterized by short-lived attacks seeking rapid financial return, like ransomware or phishing scams, Advanced Persistent Threats are methodical campaigns typically sponsored by nation-states or large criminal organizations with specific agendas. Such campaigns often include cyberespionage, intellectual property theft, data theft, network disruption, and system destruction.

The distinguishing factors lie in their systematic approach, sustained nature, and target specificity. APT groups meticulously plan their intrusion strategies tailored toward particular entities while deploying custom malware capable of evading traditional security measures—demonstrating their patience and technical prowess. PFPT

• Added kill chain phase(s): command and control
• Previously supported kill chain phase(s): command and control
• Methods added: 3

TA4903 (APT)

An advanced persistent threat (APT) is a stealthy computer network threat actor, typically a nation state or state-sponsored group, which gains unauthorized access to a computer network and remains undetected for an extended period. In recent times, the term may also refer to non-state sponsored groups conducting large-scale targeted intrusions for specific goals.

Such threat actors' motivations are typically political or economic. To date, every major business sector has recorded instances of attacks by advanced actors with specific goals seeking to steal, spy or disrupt. These include government, defense, financial services, legal services, industrial, telecoms, consumer goods, and many more. Some groups utilize traditional espionage vectors, including social engineering, human intelligence and infiltration to gain access to a physical location to enable network attacks. The purpose of these attacks is to place custom malicious code on one or multiple computers for specific tasks.

Source: Wikipedia

• Added kill chain phase(s): delivery
• Previously supported kill chain phase(s): delivery
• Methods added: 18

TA582 (APT)

An advanced persistent threat (APT) is a stealthy computer network threat actor, typically a nation state or state-sponsored group, which gains unauthorized access to a computer network and remains undetected for an extended period. In recent times, the term may also refer to non-state sponsored groups conducting large-scale targeted intrusions for specific goals.

Such threat actors' motivations are typically political or economic. To date, every major business sector has recorded instances of attacks by advanced actors with specific goals seeking to steal, spy or disrupt. These include government, defense, financial services, legal services, industrial, telecoms, consumer goods, and many more. Some groups utilize traditional espionage vectors, including social engineering, human intelligence and infiltration to gain access to a physical location to enable network attacks. The purpose of these attacks is to place custom malicious code on one or multiple computers for specific tasks.

Source: Wikipedia

• Added kill chain phase(s): command and control
• Previously supported kill chain phase(s): command and control
• Methods added: 9

Unknown APT (APT)

An adversary with sophisticated levels of expertise and significant resources, allowing it through the use of multiple different attack vectors (e.g., cyber, physical, and deception), to generate opportunities to achieve its objectives which are typically to establish and extend its presence within the information technology infrastructure of organizations for purposes of continually exfiltrating information and/or to undermine or impede critical aspects of a mission, program, or organization, or place itself in a position to do so in the future; moreover, the advanced persistent threat pursues its objectives repeatedly over an extended period of time, adapting to a defender’s efforts to resist it, and with determination to maintain the level of interaction needed to execute its objectives. NIST.)

• Added kill chain phase(s): command and control
• Previously supported kill chain phase(s): command and control, delivery
• Methods added: 12

The following threat detection(s) were improved this past week with new or updated threat methods.

Technical support
Join the conversation on Discord
Follow us Twitter
Follow us on LinkedIn
Subscribe to our YouTube channel
Stamus Networks website