New APT34 Campaign Leverages LinkedIn and Other News

Iranian APT34 Group Using LinkedIn to Spread Malware

A new campaign by the Iranian APT34 group is using LinkedIn to spread malware. Claiming to be associated with Cambridge University, APT34 is targeting victims in the oil and gas, energy and utilities, and government industries. Three primary malware families have been seen to be distributed in this campaign: TONEDEAF, VALUEVAULT, and PICKPOCKET.

Recommendations

• Consider enabling the Cyber Chatter rule in order to monitor activity related to this threat.
• Ensure defensive systems are up to date with the latest detection.
• Blacklist network infrastructure associated with this campaign.
• Remain alert to potential phishing attacks on social media.

Details

Researchers at FireEye have identified a new APT34 campaign that leverages LinkedIn to spread malware. Fake accounts, claiming to be associated with Cambridge University, requested to join a potential victim's network before sending a direct message regarding job opportunities. Then, claiming to be too busy to continue the conversation, the actors send a message with a malicious Excel document attached.

Embedded in this Excel document is malicious VBA code which creates a second Office document upon opening, and creates a scheduled task to run the second document every minute. Upon closing of the Excel sheet, the second document is renamed to System Manager.exe. This executable has been identified as belonging to the TONEDEAF malware family. Additional malware associated with this campaign includes VALUEVAULT and PICKPOCKET. TONEDEAF is a backdoor, and has functionality to steal system information, and upload and download files from the command and control server. It can also arbitrarily run shell commands. VALUEVAULT is a Golang credential stealer, and PICKPOCKET is a browser credential theft tool. Additionally, FireEye has associated the LONGWATCH keylogger with this campaign.

This campaign targeted victims mainly within the oil and gas, energy and utilities, and government industries.

IOCs

Hashes (MD5):
b338baa673ac007d7af54075ea69660b
50fb09d53c856dcd0782e1470eaeae35
96feed478c347d4b95a8224de26a1b2c
caf418cbf6a9c4e93e79d4714d5d3b87
9fff498b78d9498b33e08b892148135f
021a0f57fe09116a43c27e5133a57a0a
d8abe843db508048b4d4db748f92a103
6eca9c2b7cf12c247032aae28419319e

Domains:
hxxp[://]www[.]cam-research-ac[.]com
offlineearthquake[.]com
c[.]cdn-edge-akamai[.]com

IPs:
185[.]15[.]247[.]154

Breaking News - 07.22.2019

At Least 60 US Colleges and Universities Compromised With ERP Vuln

Exploitation of a vulnerability in enterprise resource planning (ERP) software Ellucian Banner Web Tailor, CVE-2019-8978, has resulted in the compromise of a large number of educational organizations. Hackers were able to used this to make over 600 fradulentstudent accounts, which were then used for criminal activity.

See the full report here: https://www.infosecurity-magazine.com/news/over-60-us-colleges-compromised-by/

Phishing Campaign Targets Office 365 Admins

Phishing attacks targeting Office 365 admins have spiked recently, due to the high reward for successfully gaining access to the admin account. Attackers could potentially use the account for creation of new accounts under an organizations domain, among other things, which legitimizes emails send in further phishing campaigns.

See the full report here: https://www.bleepingcomputer.com/news/security/phishers-target-office-365-admins-with-fake-admin-alerts/

Equifax Hit with $700 Million in Fines Over 2017 Breach

The Wall Street Journal has released a statement that credit reporting agency Equifax will pay about $700 million in fines for the exposure of records related to over 150 million Americans, after the organization repeatedly failed to patch a vulnerability in Apache Struts.

See the full report: https://securityaffairs.co/wordpress/88759/breaking-news/equifax-700m-settlement.html