Hackers Targeting Taiwanese Technology Firm

In the past, hackers have attempted to compromise targeted organizations by sending phishing email directly to their users. However, there seems to be a shift away from this trend in the recent years. Hackers were observed to conduct multi-prong approaches to targeting the organization of interest and their affiliated companies. For example, in July 2011, ESTsoft’s ALZip update server was compromised in an attack on CyWorld and Nate users.¹

In one of our investigations, a malicious email was found to be targeting a Taiwanese technology company that deals heavily with the finance services industry (FSI) and the government in Taiwan (see Figure 1 below). To trick the user into opening the malicious document, the attacker made use of an announcement by the Taiwanese Ministry of Finance (see Figure 2).

A blast from the past: How to protect yourself against SYSENTER/SYSCALL hooks

In my last two blogs I discussed PDF exploits and shell code in general, so this time around I’ll make it a little different.

Experienced Windows programmers (well, Linux can be included as well if you think about it) know that for a few years now Microsoft has been taking advantage of the evolution of microprocessors like Intel and AMD.

A long time ago, when a function was called from user mode, the call would trickle down a system DLL and end up calling a system API. The problem was that the context switch between user mode and kernel mode was too expensive and they needed something more efficient. Enter fast system calls.

More About Attacks on Financial Industries…

On Sept. 17, the FBI issued a warning about the possibility of cyber attacks on the financial industry. Recently, we observed another kind of an attack (not Distributed Denial of Service or Denial of Service attack) across at least two major financial institutions. The attack, if successful, will result in the establishment of a malicious communication channel on the victim’s computer. The purpose of this blog is to share the finer technical details about the level of obfuscation which was done to hide the malicious executable in the attack.

Analysis of Malware Page

Target and Delivery Method

Malware Page employs the vulnerability in PDFs and has been seen to be delivered via email. Agenda_Web_(8-24-12).pdf is one of the names this malicious sample uses. Per our logs this sample has been seen to target the aviation defense industry, making this malware a critical limited edition threat. When the malicious PDF file is opened, it infects the victim’s machine and a decoy document is generated. When the decoy PDF file is opened in Acrobat Reader, as shown in Figure 1, the victim finds an invitation to an actual defense industry event.

Figure 1. Contents of the decoy PDF file

The purpose of this blog is to share the technical details about this critical limited edition malware.

Just Released - FireEye Advanced Threat Report - 1H 2012

The third issue of the FireEye Advanced Threat Report was released today. We are excited to share this report which contains the latest advanced threat information and new insights into the continued evolution of the cyber threat landscape. Advanced malware continues to grow and in the first half of 2012 is up nearly 400% vs. the first half of 2011. On average, an organization is experiencing 643 advanced malware infections per week. Keep in mind that this is advanced malware, which are unknown threats that have not been seen before, and that bypass traditional signature-based security defenses such as next-generation firewalls, IPS, gateways, and AV. The report highlights five key findings, a few of which are included here. 

Advanced threats come into organizations via several threat vectors—the Web, email, and files. While web-based threats are significant, the dangers of email-based threats are growing more severe. Links and attachments delivered via email have been the source of some of the high-profile advanced persistent threat (APT) attacks such as the RSA breach, GhostNet, and NightDragon. These targeted spear-phishing emails are up, because they work. But spear phishing emails are evolving with the use of malicious links becoming more prevalent than the use of malicious attachments. 

Advanced threats are posing challenges to enterprises and government agencies across the board. Industries with intellectual property, customer information, or critical infrastructure to protect are particularly vulnerable to advanced threats. Notable increases in advanced threats have been seen in the healthcare, financial services, and energy/utility industries while the technology industry continues to experience a high level of advanced threats. No industry or government agency is immune. 

We hope you find the report informative and useful. And, more importantly, we hope organizations and government agencies take action to protect themselves from advanced threats. Read more in the FireEye Advanced Threat Report by filling out the form below.

Surprises in our Advanced Threat Awareness Survey

A few weeks ago we conducted a survey to assess the general knowledge of advanced attacks among enterprise security professionals. Though we originally ran the survey to gather data for our own understanding, we found the results so interesting (and frankly, surprising) that we wanted to share them.

As we’ve discussed in the past, there continues to be many myths and misunderstandings regarding advanced persistent threats ("APTs"). What is clear, however, is that there is a significant disconnect in the understanding of what constitutes an advanced targeted attack and which technologies protect against them.

Grum CnCs—Just a few more to go

This post was updated on July 17, 2012, at 3:15 PM.

Last week, I wrote an article covering various aspects of a large spam botnet named Grum. This article mainly covered the current command and control (CnC) coordinates of this botnet. The intention behind this article was not only to share this information for a general awareness, but also to invite the research community to come forward to take down this spam beast. I can see that this strategy is really working. Dutch authorities have pulled the plug on two of the CnC servers pointing to IP addresses 94.102.51.226 and 94.102.51.227.¹ Thanks to the Dutch authorities for swift action.

Unpacking SimplePack

By packing their malicious executable, malware authors can be sure that when they are opened in a disassembler they will not show the correct sequence of instructions, thus making malware analysis a lengthier and more difficult process.

SimplePack is yet another packer often used by malware authors. Specifically, it uses LZMA compression. When the packed process is opened in the debugger, the packed code starts with the instruction PUSHAD as seen in Figure 1. The instruction then pushes all the general purpose registers onto the stack, with value stored in EDI being on top of the stack.

An Inside Look into a Customized Threat

Recently, we came across a customized threat that, per our current understanding, was customized for a single individual—the president of a billion dollar corporation. As the goal of this posting is to share the findings about the targeted attack, the individual and corporation's identity have been withheld and will not be discussed in this blog. 

How Advanced Malware Bypasses Process Monitoring

One of the primary aims of an anti-virus (AV) engine is to monitor all process activity—while malware, on the other hand, wants to avoid detection by AV. The philosophy of most rootkits is to run silent and deep, which also aligns with the goals of advanced malware as it evades detection by most enterprise class host-based security solutions (HBSS) and AV.

So how does malware evade detection when starting new rogue processes? Easy—it directly attacks the operating system’s kernel. Microsoft provides the kernel routine PsSetCreateProcessNotifyRoutine to allow security software to monitor process creation and termination events in the Windows kernel, and security software calls the PsSetCreateProcessNotifyRoutine in order to be notified by the kernel when these events occur. These security solutions will then act on process creation and termination events in order to track system activity and protect critical resources.