• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Advisory – CVE 2019-10974 – NREL EnergyPlus Denial of Service Vulnerability
August 1, 2019
Rewterz Threat Alert – CVE 2019-10961 – Advantech WebAccess HMI Designer
August 2, 2019

Rewterz Threat Alert – Energy Sector Targeted By Karagany

August 1, 2019

Severity

Medium

Analysis Summary

A malware package known as “Karagany” (also known as xFrost). Karagany is a modular remote access Trojan (RAT) linked to a threat-group known as IRON LIBERTY (aka, DragonFly2.0 and Energetic Bear). Karagany is believed to have been developed from the source code of a malware package called “Dream Loader” after it was leaked in 2010. It is believed that IRON LIBERTY has invested significant time and effort into modifying the source to create a malware package suited to their own operations. IRON LIBERTY has been targeting the energy industry in the United States and Europe since at least 2010. After public exposure in 2014, Secureworks believes the group retired its own tools and infrastructure. Then, in 2016, they re-emerged once again with a fresh campaign. Samples of Karagany from 2016 to 2018 indicate constant development on the code. The core of Karagany provides persistence to the victim’s device, file upload and download, plugin execution, and limited browser credential harvesting. Infection of victims is through manual installs. The group targets specific individuals in specific roles to acquire their Active Directory credentials. Using PsExec, the group then initiates a remote command session to the targeted system and installs the malware. Persistence to survive a system reboot is achieved by creating a LNK file in the Startup folder that points back to the malware. Communication with its command and control servers is via HTTP and the data is secured using SSL/TLS.

Impact

Credential theft

Indicators of Compromise

Malware Hash (MD5/SHA1/SH256)

  • 20ec7658254eddd917e1b351e1728534
  • 2618ab729dea68dfbcb11dce2e66c8c2
  • 418e58b78731546089eb1b7fa6e1d99f
  • 418e58b78731546089eb1b7fa6e1d99f
  • 4ad06a76e1ad423b13e03587a887ede0
  • 8aeacf3fde1b49940fb4d08226dccbc4
  • fca1fa07afa1b3ff9f67f2a377de51ae
  • fd6145bbc722ef52eed6b94dd520170c
  • fff6dc1216fe549fa1d700f1ccfcd754

Remediation

  • Block all threat indicators at your respective controls.
  • Always be suspicious about emails sent by unknown senders.
  • Never click on the link/ attachments sent by unknown senders.
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.