ThreatRecon Team – Page 15

About ThreatRecon Team

We are the Cyber Threat Intelligence division of NSHC RedAlert Labs. We track Threat Actor Groups activities worldwide and aim to release some of our findings.

Entries by ThreatRecon Team

Threat Actor Group using UAC Bypass Module to run BAT File

March 28, 2019/in Threat Analysis/by ThreatRecon Team

Our Threat Recon team continues to collect and analyze activity-related data from multiple APT groups. We analyzed malware used in hacking activities targeting organizations located in South Korea, the US, and East Asia earlier this year.

SectorM04 Targeting Singapore – An Analysis

March 19, 2019/in Threat Analysis/by ThreatRecon Team

On or around June 27, 2018, personal particulars of almost 1.5 million people was exfiltrated from a SingHealth database in Singapore where information on patients was stored. Multiple pieces and types of malware was used in this attack which took place over almost a year. This is our analysis into one of the RATs that was used.

SectorD02 PowerShell Backdoor Analysis

March 7, 2019/in Threat Analysis/by ThreatRecon Team

SectorD02 is a state sponsored threat actor group which mainly targets governments and organizations around the Middle East. In this case, the target of this malware was Turkey, although it has been reported that they also sometimes target countries outside of the Middle East. One characteristic of SectorD02 is their incrementally changing PowerShell backdoor.

We came across two of SectorD02’s such backdoors at the end of 2018, and we analyzed these variants then identified them as the group’s PowerShell malware.

Monthly Threat Actor Groups Intelligence Report, January 2019

February 14, 2019/in Monthly Report/by ThreatRecon Team

This is a summary of activity of suspected state sponsored Threat Actor Groups analyzed by the Threat Recon Team, based on data and information collected from December 21, 2018 to January 20, 2019.

The Double Life of SectorA05 Nesting in Agora (Operation Kitty Phishing)

January 30, 2019/in Threat Analysis/by ThreatRecon Team

In early January 2019, an email containing malware was distributed to 77 reporters from the Unification Ministry of South Korea. We analysed these malware and identified them as malware used by SectorA05, and we confirm that they have been using a specific C2 server located in Korea for at least 26 months continuously. We decided to group these wave of attacks under what we call “Operation Kitty Phishing”.