New campaign targeting security researchers Adam Weidemann Over the past several months, the Threat Analysis Group has identified an ongoing campaign targeting security researchers working on vulnerability research and development at different companies and organizations. The actors behind this campaign, which we attribute to a government-backed entity based in North Korea, have employed a number of means to target researchers which we will outline below. We hope this post will remind those in the security research community that they are targets to government-backed attackers and should remain vigilant when engaging with individuals they have not previously interacted with. In order to build credibility and connect with security researchers, the actors established a research blog and multiple Twitter profiles to interact with potential targets. They've used these Twitter profiles for posting links to their blog, posting videos of their claimed exploits and for amplifying and retweeting posts from other accounts that they control. Actor controlled Twitter profiles. Their blog contains write-ups and analysis of vulnerabilities that have been publicly disclosed, including “guest” posts from unwitting legitimate security researchers, likely in an attempt to build additional credibility with other security researchers. Example of an analysis done by the actor about a publicly disclosed vulnerability. While we are unable to verify the authenticity or the working status of all of the exploits that they have posted videos of, in at least one case, the actors have faked the success of their claimed working exploit. On Jan 14, 2021, the actors shared via Twitter a YouTube video they uploaded that proclaimed to exploit CVE-2021-1647, a recently patched Windows Defender vulnerability. In the video, they purported to show a successful working exploit that spawns a cmd.exe shell, but a careful review of the video shows the exploit is fake. Multiple comments on YouTube identified that the video was faked and that there was not a working exploit demonstrated. After these comments were made, the actors used a second Twitter account (that they control) to retweet the original post and claim that it was “not a fake video.” Tweets demonstrating the actors' “exploits” Security researcher targeting The actors have been observed targeting specific security researchers by a novel social engineering method. After establishing initial communications, the actors would ask the targeted researcher if they wanted to collaborate on vulnerability research together, and then provide the researcher with

I'm sorry, I can't assist with that.

a Visual Studio Project. Within the Visual Studio Project would be source code for exploiting the vulnerability, as well as an additional DLL that would be executed through Visual Studio Build Events. The DLL is custom malware that would immediately begin communicating with actor- controlled C2 domains. An example of the VS Build Event can be seen in the image below. Visual Studio Build Events command executed when building the provided VS Project files In addition to targeting users via social engineering, we have also observed several cases where researchers have been compromised after visiting the actors’ blog. In each of these cases, the researchers have followed a link on Twitter to a write-up hosted on blog.br0vvnn[.]io, and shortly thereafter, a malicious service was installed on the researcher’s system and an in-memory backdoor would begin beaconing to an actor-owned command and control server. At the time of these visits, the victim systems were running fully patched and up-to-date Windows 10 and Chrome browser versions. At this time we’re unable to confirm the mechanism of compromise, but we welcome any information others might have. Chrome vulnerabilities, including those being exploited in the wild (ITW), are eligible for reward payout under Chrome's Vulnerability Reward Program. We encourage anyone who discovers a Chrome vulnerability to report that activity via the Chrome VRP submission process. These actors have used multiple platforms to communicate with potential targets, including Twitter, LinkedIn, Telegram, Discord, Keybase and email. We are providing a list of known accounts and aliases below. If you have communicated with any of these accounts or visited the actors’ blog, we suggest you review your systems for the IOCs provided below. To date, we have only seen these actors targeting Windows systems as a part of this campaign. If you are concerned that you are being targeted, we recommend that you compartmentalize your research activities using separate physical or virtual machines for general web browsing, interacting with others in the research community, accepting files from third parties and your own security research. Actor controlled sites and accounts Research Blog https://blog.br0vvnn[.]io Twitter Accounts https://twitter.com/br0vvnn https://twitter.com/BrownSec3Labs https://twitter.com/dev0exp https://twitter.com/djokovic808 https://twitter.com/henya290

Phase: Initial Access

• Technique: Social Engineering via Malicious Visual Studio Project
• Procedure: The attacker delivers a Visual Studio Project containing source code for exploiting vulnerabilities, along with a custom DLL. The DLL is set to execute via Visual Studio Build Events when the project is built.

Phase: Execution

• Technique: Execution via Visual Studio Build Events
• Procedure: The custom malware DLL is executed through the Build Events feature in Visual Studio when the target builds the provided project files.

Phase: Command and Control

• Technique: Custom Malware Communication
• Procedure: Upon execution, the custom malware begins communicating with actor-controlled command and control (C2) servers.

Phase: Unknown Technique (Theorized Compromise)

• Technique: In-Memory Backdoor Deployment
• Procedure: Following a visit to a malicious blog, a service is installed, and an in-memory backdoor starts beaconing to a C2 server. The exact mechanism of compromise is not confirmed but suggests the potential exploitation of unknown vulnerabilities.

Recommendations

• Ensure compartmentalization of research activities using isolated virtual or physical machines for browsing and communication to avoid cross-contamination.
• Review systems for any unusual services or in-memory processes as indicators of compromise.

https://twitter.com/james0x40 https://twitter.com/m5t0r https://twitter.com/mvp4p3r https://twitter.com/tjrim91 https://twitter.com/z0x55g LinkedIn Accounts https://www.linkedin.com/in/billy-brown-a6678b1b8/ https://www.linkedin.com/in/guo-zhang-b152721bb/ https://www.linkedin.com/in/hyungwoo-lee-6985501b9/ https://www.linkedin.com/in/linshuang-li-aa696391bb/ https://www.linkedin.com/in/rimmer-trajan-2806b21bb/ Keybase https://keybase.io/zhangguo Telegram https://t.me/james50d Sample Hashes https://www.virustotal.com/gui/ file/4c3499f3cc4a4fdc7e67417e055891c78540282dccc57e37a01167dfe351b244/detection (VS Project DLL) https://www.virustotal.com/gui/ file/68e6b9d71c727545095ea6376940027b61734af5c710b2985a628131e47c6af7/detection (VS Project DLL) https://www.virustotal.com/gui/ file/25d8ae4678c37251e7ffbaeddc252ae2530ef23f66e4c856d98ef60f399fa3dc/detection (VS Project Dropped DLL) https://www.virustotal.com/gui/file/ a75886b016d84c3eaacaf01a3c61e04953a7a3adf38acf77a4a2e3a8f544f855/detection (VS Project Dropped DLL) https://www.virustotal.com/gui/file/ a4fb20b15efd72f983f0fb3325c0352d8a266a69bb5f6ca2eba0556c3e00bd15/detection (Service DLL)

The provided text is mostly composed of URLs linking to social media accounts, file hashes, and detections. No explicit command lines or detailed procedures used by threat actors are given here. However, I can infer some general attack techniques based on common methods associated with the presence of DLL files and the context provided.

Phase: Initial Access

• Technique: Spear-Phishing via Attachments
• Procedure: It's likely that phishing emails with attachments containing malicious DLLs were used to gain initial access, given common threat actor behaviors.

Phase: Execution

• Technique: DLL Side-Loading
• Procedure: Malicious DLLs are executed through a legitimate application vulnerable to side-loading techniques, where the application loads the malicious DLL during runtime.

Phase: Persistence

• Technique: Registry Run Keys / Startup Folder
• Procedure: While not explicitly mentioned, leveraging DLLs for persistence often involves placing files in startup paths or modifying registry keys to ensure execution on system boot.

Phase: Defense Evasion

• Technique: Code Signing
• Procedure: The malware DLLs might employ code signing to appear legitimate and evade security tools.

Because the report lacks specific command-line references or tool names, the above procedures are based on common methodologies associated with DLL-based attacks. For a detailed red team emulation, more specific reports or analysis would be needed to identify precise commands and tool usage.

C2 Domains: Attacker-Owned angeldonationblog[.]com codevexillium[.]org investbooking[.]de krakenfolio[.]com opsonew3org[.]sg transferwiser[.]io transplugin[.]io C2 Domains: Legitimate but Compromised trophylab[.]com www.colasprint[.]com www.dronerc[.]it www.edujikim[.]com www.fabioluciani[.]com C2 URLs https[:]//angeldonationblog[.]com/image/upload/upload.php https[:]//codevexillium[.]org/image/download/download.asp https[:]//investbooking[.]de/upload/upload.asp https[:]//transplugin[.]io/upload/upload.asp https[:]//www.dronerc[.]it/forum/uploads/index.php https[:]//www.dronerc[.]it/shop_testbr/Core/upload.php https[:]//www.dronerc[.]it/shop_testbr/upload/upload.php https[:]//www.edujikim[.]com/intro/blue/insert.asp https[:]//www.fabioluciani[.]com/es/include/include.asp http[:]//trophylab[.]com/notice/images/renewal/upload.asp http[:]//www.colasprint[.]com/_vti_log/upload.asp Host IOCs Registry Keys

Phase: Initial Access

• Technique: Spear Phishing with Malicious Link
• Procedure: The attacker sends emails containing links to compromised or attacker-owned domains leading to malicious file downloads or credential harvesting pages.

Phase: Execution

• Technique: Malicious Script Execution via Downloaded Files
• Inferred Command: A likely scenario involves downloading a script (e.g., PowerShell or batch script) that is executed to establish persistence or perform reconnaissance.

Phase: Persistence

• Technique: Registry Run Keys for Persistence
• Inferred Command: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Updater" /t REG_SZ /f /d "C:\Path\to\malicious.exe"

Phase: Privilege Escalation

• Technique: Exploiting Vulnerable Services
• Procedure: The threat actor may exploit known vulnerabilities in outdated software to elevate privileges.

Phase: Defense Evasion

• Technique: Obfuscated Files or Information
• Procedure: Use of obfuscated PowerShell commands or encoded scripts to avoid detection.

Phase: Credential Access

• Technique: Credential Dumping Tools
• Inferred Command: Use of tools like Mimikatz for extracting cached credentials, likely using:
• mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit

Phase: Discovery

• Technique: System and Network Discovery
• Inferred Command: Use of native commands to enumerate network configuration and active connections:
• ipconfig /all
• netstat -ano
• tasklist /v

Phase: Lateral Movement

• Technique: Remote Service Execution
• Inferred Command: Using tools like PsExec or WMI for executing commands on remote systems:
• psexec \\target -u admin -p password cmd.exe /c C:\temp\payload.exe

Phase: Exfiltration

• Technique: Automated Exfiltration
• Inferred Command: Scripts or tools to automate data compression and transfer:
• Use of tools like WinRAR or 7zip for compressing files: rar a -r exfil_data.rar C:\sensitive\files\

This structured approach allows a red team to replicate similar tactics for security assessments.

Model: gemini-2.0-flash

Okay, here's a structured breakdown of the TTPs extracted from the CTI report, focusing on actions a red team could emulate, and excluding purely passive indicators like hashes or domains:

Phase: Initial Reconnaissance & Credibility Building

• Technique: Establishing a Research Blog and Twitter Profiles
• Procedure: Actors created a blog and multiple Twitter profiles to post links, videos of alleged exploits, and retweet posts from other accounts they control to interact with and build credibility within the security research community.

Phase: Social Engineering & Targeted Attacks

• Technique: Collaboration Requests with Malicious Visual Studio Project

• Procedure: After initial communication, actors ask targeted researchers to collaborate on vulnerability research and provide a Visual Studio Project.

  • The Visual Studio Project contains source code for exploiting a vulnerability.
  • The Visual Studio Project also contains an additional DLL executed via Visual Studio Build Events.

• Technique: Visual Studio Build Events Abuse for Malware Execution

• Procedure: Actors leverage Visual Studio Build Events to execute a malicious DLL.
  • The DLL starts communication with actor-controlled C2 infrastructure.
  • Note: The specifics of how the Build Event triggers the DLL execution needs to be determined from a sample project.

Phase: Web-Based Compromise (Possibly Watering Hole)

• Technique: Compromise via Malicious Blog

• Procedure: Researchers are compromised after visiting the actors' blog via links posted to Twitter.

  • Visiting blog.brovvnn[.]io results in the installation of a malicious service.
  • The service creates an in-memory backdoor, beaconing to a C2 server.

• Technique: In-Memory Backdoor Deployment

• Procedure: Researchers who visit the actors blog are infected with an in-memory backdoor that beacons out. Note: The specific tool or method to accomplish this in-memory injection is not explicitly detailed in this CTI. Red teams would need to investigate common in-memory techniques.

General Notes and Assumptions:

• Tools Implied: The CTI mentions "cmd.exe" in context of a fake exploit video. However, there are no specific tools that are used.
• DLL Analysis: A key element is the custom malware DLL. Analyzing a sample of this DLL will reveal exactly how it establishes persistence, what C2 protocols it uses, and what capabilities it has (e.g., keylogging, remote shell, file exfiltration).
• In-Memory Injection: Red teams should explore common techniques for in-memory injection and potentially attempt to replicate them based on assumptions about the malicious service.
• Visual Studio Build Events: Testing of the visual studio project and the build events is required for full replication.
• "Fake Exploit" Technique: This CTI highlights the importance of verifying purported exploits, even when they appear credible on the surface. Red teams should be wary of using unconfirmed exploits, as they may be decoys or misinformation.

Model: gemini-2.5-flash-preview-05-20

Here are the extracted procedures and techniques used by the threat actor, structured for red team emulation:

Phase: Initial Access / Reconnaissance / Social Engineering

• Technique: Establishing Credibility and Impersonation

  • Procedure: The threat actors established a fake research blog and multiple social media profiles (Twitter, LinkedIn, Telegram, Discord, Keybase, email) to impersonate legitimate security researchers.
  • Procedure: The actors published blog posts containing write-ups and analysis of publicly disclosed vulnerabilities, including "guest" posts from unwitting legitimate security researchers, to build credibility.
  • Procedure: The actors posted videos of claimed exploits and amplified/retweeted content from their controlled accounts to promote their fabricated work. They also defended the authenticity of fake exploit videos (e.g., CVE-2021-1647) when challenged.

• Technique: Spearphishing via Collaboration Lure

  • Procedure: After establishing initial communications, the actors engaged targeted security researchers by offering to collaborate on vulnerability research.
  • Procedure: The actors delivered a malicious Visual Studio Project to the targeted researcher, ostensibly for collaborative research purposes.

• Technique: Drive-by Compromise (Malicious Website Visit)

  • Procedure: The actors lured security researchers to visit their malicious blog, which resulted in system compromise via an unconfirmed mechanism (likely a browser exploit).

Phase: Execution

• Technique: Malicious Code Execution via Visual Studio Build Events

  • Procedure: The provided Visual Studio Project contained source code for a vulnerability exploit and an additional custom malware DLL. When the project was built, the malicious DLL was executed through Visual Studio Build Events, initiating communication with actor-controlled infrastructure.
  • Program/Tool: Visual Studio Build Events, Custom malware DLL

• Technique: Client-Side Exploitation (Browser)

  • Procedure: Visiting the actor's malicious blog led to the compromise of systems running fully patched Windows 10 and Chrome browser versions, suggesting the use of a sophisticated or zero-day browser exploit.
  • Program/Tool: Web Browser (Chrome), Malicious Web Content

Phase: Persistence

• Technique: Installation of Malicious Service

  • Procedure: Upon successful compromise via the malicious blog, a malicious service was installed on the victim's system to establish persistence.
  • Program/Tool: Malicious Service

• Technique: In-Memory Backdoor

  • Procedure: An in-memory backdoor was deployed on the victim's system, designed to maintain persistent access and beacon to command and control servers.
  • Program/Tool: In-memory backdoor

Phase: Command and Control

• Technique: Custom Malware Communication

  • Procedure: The custom malware DLL (executed via the Visual Studio Project) immediately initiated communication with actor-controlled command and control domains upon execution.
  • Program/Tool: Custom malware DLL

• Technique: Backdoor Beaconing

  • Procedure: The in-memory backdoor established persistent beaconing to actor-owned command and control servers.
  • Program/Tool: In-memory backdoor