securelist-penquins_moonlit_maze2017

0001-01-01

Penquin’s Moonlit Maze

by Costin Raiu, Daniel Moore, Juan Andres Guerrero-Saade, and Thomas Rid

2017-04-03

https://securelist.com/penquins-moonlit-maze/77883/ https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180251/Penquins_Moonlit_Maze_PDF_eng.pdf https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180254/Penquins_Moonlit_Maze_AppendixB.pdf https://youtu.be/9RorL9y70GU

I read this article due to the connection with LOKI2, one of the more interesting bits of malware that I have observed that works on Linux systems.

This article provides compelling links to the historic Moonlight Maze espionage campaign and the modern day Turla group.

A variant of LOKI2 was discovered and named “Penguin Turla”. Penguin Turla was originally misattributed as a cd00r variant.

Remark
Kaspersky
SecureList
GReAT
Moonlight Maze
cyberespionage
Turla - aka Snake, Uroburos, Venomous Bear, Krypton
waterhole attack
covert channel
deception
Agent.BTZ
Buckshot Yankee
exfiltration
Equation Group
Solaris
Penguin Turla
Phrack
cd00r by fx http://www.phenoelit.org/stuff/cd00r.c
static linked
libpcap
OpenSSL
Alhambra
daemon9
beachhead
artifacts/artefacts
backups
OPSEC/Operational Security
FBI
FSB
Pentagon
Department of Energy
NASA
HRTest
FOIA - Freedom of Information Act
SPARC
MIPS
IRIX
/var/tmp directory
hands-on-keyboard/operator-at-keyboard
binary tree
sniffer
exfiltration
logs/log files
Storm Cloud operation https://www.wsj.com/articles/SB993588688215931869 (aka Makers Mark/MM)
Wright Patterson Air Force Base
Air Force
Kelly Air Force Base
Army Research Lab
Naval Sea Systems Command
APT - Advanced Persistent Threat
Rise of the Machines book
samples
visibility
forensic evidence
dropper
hop (networking)
Scotland Yard
SunOS
EtherPeek
Karl Grindal
CGI - Common Gateway Interface
phf vulnerability – hxxp://server/cgi-bin/phf?Qalias=%ff/bin/cat%20/etc/passwd
solsniffer
telnet
pop3
ftp
rlogin
ICMP
spy_cli.c
pine email client
log wiper
Silicon Graphics - SGI
lateral movement
Moonlight Maze operators: Max, Iron, Rinat
BPF
SSLeay
NTP - Network Time Protocol
ntpd
trojanize

Samples

Moonlight Maze samples

YARA rules

Moonlight Maze YARA rules


Links to this note