#equation group

TAJ MAHAL

Taj Mahal is a previously unknown and technically sophisticated Advanced Persistent Threat (APT) espionage framework, developed by a nation-state, discovered by Kaspersky Lab in the autumn of 2018. This multi-stage framework has two stages, 'Tokyo' and 'Yokohama', and is believed to have been in use for 5 years without detection. Only one known victim has been documented, a diplomatic entity from an undisclosed Central Asian country.

The second stage includes roughly 80 different modules with various capabilities including: backdoors, loaders, orchestrators, Command and Control (C2) communicators, audio recorders, keyloggers, screen and webcam grabbers, document and cryptography key stealers, and file indexer for the victim’s machine.

Included Components

WatchPoints Document stealer, C2 communication and command processor LocalInfo Performs system reconnaissance, outputs to file titled “TAJ MAHAL” AudioRecorder Captures audio from microphone, Windows COM, VOIP and Windows Metro applications Orchestrator Update/install/uninstall, selects target processes and loads plugins Reinstaller/Injector SuicideWatcher Cleanly removes the framework after a designated time IM-Stealer Steals conversation content from chat windows of instant messaging applications Indexer Indexes files on victim drives, user profiles, removable drives Thumbnailer Makes and prepares to send thumbnails of found picture files Keylogger Keystroke logger & clipboard monitor DocumentStealer Steals printed documents from spooler queue EgressSender Sends files from output queue to C2 ClientRecon Daily stateful scan of the compromised machine, sends system changes to C2 Screenshoter Takes periodic low-resolution screenshots DocumentStealer Steal documents from fixed and removable drives and written CD images WebcamSnapshot Periodically takes webcamera snapshots

Source:

DANDERSPRITZ

DanderSpritz is the companion to the FuzzBunch exploitation framework. Both were leaked by The Shadow Brokers on April 14th, 2017 as part of the “Lost in Translation” leak. These tools are widely accepted as belonging to the Equation Group (NSA). It’s a modular, stealthy, and fully functional framework for post-exploitation activities on Windows and Linux hosts. DanderSpritz modules include tools to evade detection by bypassing anti-virus & security tools, disable and delete Windows event logs, establish persistence, perform local and network reconnaissance, move laterally within a network, and exfiltrate data.

Exploitation frameworks allow attackers to select, configure and deploy different malicious scripts, or modules, against one or more targets. Exploits leverage vulnerabilities in order to give an attacker access to a compromised system. Post-Exploitation frameworks are designed to deploy additional modules specific to mission objectives after the initial compromise.

Included Components

DarkSkyline Captures network traffic, performs packet filtering and parsing DarkPulsar Legacy implant/backdoor, similar to PeddleCheap DecibelMinute Install/uninstall tool for KillSuit (termination module) DoubleFeature Logs & reports tools that could be deployed on the target DoormanGauze A kernel level network driver designed to bypass the standard Windows TCP/IP stack ExpandingPulley Listening Post developed in 2001 and abandoned in 2008, predecessor to DanderSpritz FlewAvenue DoormanGauze component GreaterDoctor GreaterSurgeon Parser/Processor GangsterTheif GreaterDoctor output parser. Identifies other persistently installed malicious software GreaterSurgeon Dumps memory from a specified process Gui DanderSpirtz GUI LegacyWindowsExploits Ops An extensive set of python / dss scripts designed to perform system reconnaissance PassFreely Bypasses authorization for oracle databases PaperCut Performs operations on file handles opened by other processes PeddleCheap The main implant (loaded via DoublePulsar) that executes DanderSpritz instructions ScRe Interacts with SQL databases Strangeland Keystroke logger Tasking Handles DanderSpritz collection tasks TerritorialDispute Identifies other nation state tools that may be persistently installed UtilityBurst Persistence mechanism via driver injection ZippyBang Custom Mimikatz-like tool use for credential harvesting

Sources:

https://medium.com/francisck/the-equation-groups-post-exploitation-tools-danderspritz-and-more-part-1-a1a6372435cd

https://github.com/francisck/DanderSpritz_docs

Building A Global Nation State #SMB #Exploit #Honeypot Infrastructure With £50 #EternalPot

Note to post: All words, IP ownership, analysis, opinions, data, graphs et al are the property of Kevin Beaumont and where altered and extracted are done so remaining true to the original meaning / assertions. From and article by “Kevin Beaumont InfoSec, from the trenches of reality. Email [email protected] | Twitter: @gossithedog on Twitter” titled “EternalPot — Lessons from building a…

Stolen NSA Tools for Breaching Windows are Now for Sale, among them was one mentioned by Edward Snowden

The Shadow Brokers are back at it! A while back the group released a bunch of exploits, and have come back with even more goodies. Now they are selling a whole new portion of tools dubbed, “Equation Group Windows Warez.” This bundle includes exploits for Windows and bypassing most anti-virus systems, stolen from the NSA linked “Equation Group.” For those unfamiliar with the Shadow Brokers, they…

Who hacked the NSA?

❝ Last week, a group called the “Shadow Brokers” stole 234 megabytes of data from the National Security Agency. The leak included information about the cyberweapons the NSA uses to hack suspects and enemies, and a tracking code that reveals the fingerprints of the NSA’s malicious software. But, before we can understand the significance of the leak, the mystery behind the identity of the Shadow…

https://theintercept.com/2016/08/19/the-nsa-was-hacked-snowden-documents-confirm/

The evidence that ties the ShadowBrokers dump to the NSA comes in an agency manual for implanting malware, classified top secret, provided by Snowden, and not previously available to the public. The draft manual instructs NSA operators to track their use of one malware program using a specific 16-character string, “ace02468bdf13579.” That exact same string appears throughout the ShadowBrokers leak in code associated with the same program, SECONDDATE.