A Look At Some Real-World Obfuscation Techniques

Among the variety of penetration testing engagements NCC Group delivers, some - often within the gaming industry - require performing the assignment in a blackbox fashion against an obfuscated binary, and the client's priorities revolve more around evaluating the strength of their obfuscation against content protection violations, rather than exercising the application's security boundaries. The … Continue reading A Look At Some Real-World Obfuscation Techniques

Domestic IoT Nightmares: Smart Doorbells

Preface Half way through 2020, UK independent consumer champion Which? magazine reached out to us and asked if we could assist investigating the security of a series of domestic IoT devices and to perform a vulnerability assessment of each device. The assessments included smart plugs and smart/connected doorbells. We also worked on a number of … Continue reading Domestic IoT Nightmares: Smart Doorbells

TA505: A Brief History Of Their Time

Threat Intel Analyst: Antonis Terefos (@Tera0017)Data Scientist: Anne Postma (@A_Postma) 1. Introduction TA505 is a sophisticated and innovative threat actor, with plenty of cybercrime experience, that engages in targeted attacks across multiple sectors and geographies for financial gain. Over time, TA505 evolved from a lesser partner to a mature, self-subsisting and versatile crime operation with … Continue reading TA505: A Brief History Of Their Time

Tool Release – ICPin, an integrity-check and anti-debug detection pintool

by Nicolas Guigo ICPin is an Intel pintool leveraging the framework's JIT mode designed to track a binary's integrity checks. It records all reads and all writes performed by the target executable or dynamically loaded library on its text section and outputs a human readable text file describing each memory access with its type (R|W) … Continue reading Tool Release – ICPin, an integrity-check and anti-debug detection pintool

Turla PNG Dropper is back

This is a short blog post on the PNG Dropper malware that has been developed and used by the Turla Group [1]. The PNG Dropper was first discovered back in August 2017 by Carbon Black researchers. Back in 2017 it was being used to distribute Snake, but recently NCC Group researchers have uncovered samples with … Continue reading Turla PNG Dropper is back

CVE-2017-8570 RTF and the Sisfader RAT

Ben Humphrey – Malware Researcher In late April 2018, NCC Group researchers discovered a small number of documents exploiting CVE-2017-8570 and dropping the same payload. The purpose of these documents is to install a Remote Access Trojan (RAT) on the victims’ machine. This article gives a deep analysis of both the document, and its payload. … Continue reading CVE-2017-8570 RTF and the Sisfader RAT

Emissary Panda – A potential new malicious tool

Introduction Hacking groups linked to the Chinese state are not a new threat. In fact, for the last couple years they have tended to be the most active along with Russian state affiliated hacking groups. One of these groups is the ‘Emissary Panda’ group, also known as TG-3390, APT 27 and Bronze Union. This is … Continue reading Emissary Panda – A potential new malicious tool

Decoding network data from a Gh0st RAT variant

During a forensic investigation in March 2018 we were able to retrieve some files which appeared to be linked with a well-known group named Iron Tiger. From our research, we believe that the perpetrator hasn’t shown any advanced technical capabilities in this attack. In fact, the main goal was to mine cryptocurrency. During the investigation … Continue reading Decoding network data from a Gh0st RAT variant

APT15 is Alive and Strong: An Analysis of RoyalCli and RoyalDNS

In May 2017, NCC Group's Incident Response team reacted to an ongoing incident where our client, which provides a range of services to UK Government, suffered a network compromise involving the advanced persistent threat group APT15. APT15 is also known as, Ke3chang, Mirage, Vixen Panda GREF and Playful Dragon. A number of sensitive documents were … Continue reading APT15 is Alive and Strong: An Analysis of RoyalCli and RoyalDNS