APT28 / Fancy Bear still targeting military institutions

APT28 / Fancy Bear still targeting military institutions

APT28, aka Fancy Bear, the famous hacker group believed to be state-sponsored from Russia, seems to be targeting NATO partners / defense / military institutions / affairs in these hours. Spear-phishing emails with attached a malicious document referring to a "nato simulation" event (the name of the doc is "NATO Simulation.doc"), seem to be used to try to compromise some institutional entities (likely from north /  east europe). The hunting group involved in the analysis of this event is … [Read more]

Update: Hands in the MuddyWater – Playing with Iranian Cyber-Espionage Campaign

This is an update of previous post "Hands in the MuddyWater - Playing with Iranian Cyber-Espionage Campaign". Because someone asked me to show DNS hits statistics for all the compromized domain names serving this cyber-espionage campaign, following there are the missing two:Three days data 26-29 /10         Note that "hits" can be referred to, in this case, to normal web browsing also (legitimate … [Read more]

Hands in the MuddyWater – Playing with Iranian Cyber-Espionage Campaign

MuddyWater is likely a state sponsored hacking group targeting Saudi Arabia, Iraq, Israel, United Arab Emirates, Georgia, India, Pakistan, Turkey and the United States. It is linked by the security community to  the iranian Government, and its operations are heavily evolving over  the last months.The following is an informal report about one recent malware related to the "MuddyWater" APT campaign.Recap IoC:dn: … [Read more]

Exobot Source Code Available

Exobot Source Code Available

Exobot source code has been leaked and released in darkweb. The code proved to be version 2.5 of the Exobot banking trojan, also known as the "Trump Edition," one of Exobot's last version before its original author gave up on its development. To avoid proliferations of malware samples based on the source code here presented, security restrictions have been applied to download.(Please note that archive is encrypted !! Only accredited security vendors, vetted security researchers and law … [Read more]

Dridex Downloader Analysis

Dridex Downloader Analysis

This morning I received on my company box an email with an attached .xlsm file named D92724446.xlsm coming from [email protected] Central and local AV engines did not found anything malicious and also a multiengine scan got 0/57 as result. I decided to investigate a little more in-depth in order to confirm that was a malicious file and to extract at least the code I was imagining being inside this document. These are some general info collected about the received file: Name: … [Read more]

A look at SANS Brussels Challenges

A look at SANS Brussels Challenges

This morning, a colleague of mine pointed out me to some reversing “challenges” addressed to participants of SANS Brussels 2015 (what? I was not there?). Why not to take a quick look and try to solve them ? I hope to publish the solutions/suggestions is not cause of rage for mentors of SANS, for whom I have a lot of esteem. However, at the time of this writing these challenges are online and accessible without any particular restriction at https://www.sansemea.com/challenges.php, therefore I … [Read more]

Pattern-Based Approach for In-Memory ShellCodes Detection

Pattern-Based Approach for In-Memory ShellCodes Detection

This topic has been dealt in one of my last technical articles. The document shows as it’s possible to approach an incident investigation on the basis of common instructions used by shellcodes to achieve their goals. The analysis is conducted within a memory dump. In this regard have been developed some yara custom rules that can be used as an aid for experienced analyst to quickly locate malicious code. Note, however, that this is a very wide topic (have you ever heard of padding, permutations, … [Read more]

Meeting with a Chinese Malware

Meeting with a Chinese Malware

This evening I received an email with an attached zip. This email was very well made and my anti-virus did not detect anything dangerous -_- veeeery nice…i decided to take a look and see what strange monster was inside :] The executable is a trojan/downloader packed with something custom! After recovering the original executable bypassing all protections, i  was able to have a look within it and immediately i saw some interesting functions … [Read more]

Steganography and Steganalysis: Common Image Formats and LSB

Steganography and Steganalysis: Common Image Formats and LSB

 Thousands and thousands of data items currently are riding the Internet every day; their representation could be a continuous stream of data transiting through the entire globe. With the growth in quantity and especially in the importance of such informations, the need to adopt systems designed to guarantee a good level of protection and security has also grown in proportion. This paper explores those that are the common steganographic algorithms used to hide informations within seemingly … [Read more]

Red October: Cyber-Espionage ToolKit Analysis

Red October: Cyber-Espionage ToolKit Analysis

Reb October is the name of a cyber-espionage toolkit discovered by Kaspersky Lab. The malware was operating worldwide for up to 5 years before to be discovered, transmitting to its C&C servers a lot of informations. Red October is considered an advanced cyber-espionage campaign intended to targeting diplomatic, governmental and financial organizations. This is an analysis conducted by me on 01/13 for InfoSec Institute but published but published after a little... It's possible to view my … [Read more]