Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Medium
A malware package known as “Karagany” (also known as xFrost). Karagany is a modular remote access Trojan (RAT) linked to a threat-group known as IRON LIBERTY (aka, DragonFly2.0 and Energetic Bear). Karagany is believed to have been developed from the source code of a malware package called “Dream Loader” after it was leaked in 2010. It is believed that IRON LIBERTY has invested significant time and effort into modifying the source to create a malware package suited to their own operations. IRON LIBERTY has been targeting the energy industry in the United States and Europe since at least 2010. After public exposure in 2014, Secureworks believes the group retired its own tools and infrastructure. Then, in 2016, they re-emerged once again with a fresh campaign. Samples of Karagany from 2016 to 2018 indicate constant development on the code. The core of Karagany provides persistence to the victim’s device, file upload and download, plugin execution, and limited browser credential harvesting. Infection of victims is through manual installs. The group targets specific individuals in specific roles to acquire their Active Directory credentials. Using PsExec, the group then initiates a remote command session to the targeted system and installs the malware. Persistence to survive a system reboot is achieved by creating a LNK file in the Startup folder that points back to the malware. Communication with its command and control servers is via HTTP and the data is secured using SSL/TLS.
Credential theft
Malware Hash (MD5/SHA1/SH256)