Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Mark Lechtik
Iran's Hidden Hand in Middle Eastern Networks
Written by: Stav Shulman, Matan Mimran, Sarah Bock, Mark Lechtik < div class="block-paragraph_advanced"> Executive Summary UNC1860 is a persistent and opportunistic Iranian state-sponsored threat actor that is likely affiliated with Iran's Ministry of Intelligence and Security (MOIS).
Kaspersky spam and phishing report for 2021
Figures of the year In 2021: 45.56% of e-mails were spam 24.77% of spam was sent from Russia with another 14.12% from Germany Our Mail Anti-Virus blocked 148 173 261 malicious attachments sent in e-mails The most common malware family found in attachments were Agensla Trojans Our Anti-Phishing system blocked 253 365 212 phishing links Safe Messaging blocked 341 954 attempts to follow phishing links in messengers Trends of the year How to make an unprofitable investment with no return The...
MoonBounce: Internals of the 3rd publicly known UEFI firmware implant
Speaker Bio: Mark Lechtik is a Senior Security Researcher at Kaspersky's GReAT (Global Research & Analysis Team), based in Israel. After having worked as a researcher and manager on Check Point’s malware research team, his primary focus is analysing malware of all shapes and forms, digging up their underlying stories and profiling the actors behind them.
MoonBounce: the dark side of UEFI firmware
What happened? At the end of 2021, we were made aware of a UEFI firmware-level compromise through logs from our Firmware Scanner, which has been integrated into Kaspersky products since the beginning of 2019. Further analysis has shown that a single component within the inspected firmware’s image was modified by attackers in a way that allowed them to intercept the original execution flow of the machine’s boot sequence and introduce a sophisticated infection chain.
Lyceum group reborn
APT reports APT reports 18 Oct 2021 minute read This year, we had the honor to be selected for the thirty-first edition of the Virus Bulletin conference. During the live program, we presented our research into the Lyceum group (also known as Hexane), which was first exposed by Secureworks in 2019. In 2021, we have been able to identify a new cluster of the group’s activity, focused on two entities in Tunisia.
GhostEmperor: From ProxyLogon to kernel mode
Download GhostEmperor’s technical details (PDF) While investigating a recent rise of attacks against Exchange servers, we noticed a recurring cluster of activity that appeared in several distinct compromised networks. This cluster stood out for its usage of a formerly unknown Windows kernel mode rootkit that we dubbed Demodex, and a sophisticated multi-stage malware framework aimed at providing remote control over the attacked servers.
Lyceum reborn: counterintelligence in the Middle East
Lyceum reborn: counterintelligence in the Middle East Aseel Kayal (Kaspersky), Mark Lechtik (Kaspersky) & Paul Rascagneres (Kaspersky) Aseel Kayal Kaspersky Aseel is a malware analyst at Kaspersky's GReAT (Global Research and Analysis Team). Her research mainly focuses on threat groups and attacks active in the Middle East region. Aseel received her Bachelor’s degree in computer science and English literature, and speaks Arabic, Hebrew and English.
Bizarro banking Trojan expands its attacks to Europe
Bizarro is yet another banking Trojan family originating from Brazil that is now found in other regions of the world. We have seen users being targeted in Spain, Portugal, France and Italy. Attempts have now been made to steal credentials from customers of 70 banks from different European and South American countries. Following in the footsteps of Tetrade, Bizarro is using affiliates or recruiting money mules to operationalize their attacks, cashing out or simply to helping with transfers.
LuminousMoth APT: Sweeping attacks for the chosen few
APT actors are known for the frequently targeted nature of their attacks. Typically, they will handpick a set of targets that in turn are handled with almost surgical precision, with infection vectors, malicious implants and payloads being tailored to the victims’ identities or environment.
Kaspersky spots customised UEFI firmware bootkit
Kaspersky says it has spotted a customised firmware bootkit in the wild. The UEFI bootkit is being used as part of an Advanced Persistent Threat (APT) espionage campaign. It has named the bootkit MosaicRegressor and said it is a variant of the HackingTeam’s VectorEDK bootkit that was leaked in 2015. As a bootkit, it is hard to identify and even harder to remove. The malware was used to target diplomats and members of NGOs from Africa, Asia and Europe.
MosaicRegressor: Lurking in the Shadows of UEFI
Part II. Technical details (PDF) UEFI (or Unified Extensible Firmware Interface) has become a prominent technology that is embedded within designated chips on modern day computer systems. Replacing the legacy BIOS, it is typically used to facilitate the machine’s boot sequence and load the operating system, while using a feature-rich environment to do so. At the same time, it has become the target of threat actors to carry out exceptionally persistent attacks.
Programme - VB2021 localhost
ON DEMAND Uncovering automatic Obfuscation-as-a-Service for malicious Android applications Masarah Paquet-Clouston (GoSecure), Vit Sembera (Trend Micro), Sebastian Garcia (Stratosphere Laboratory) & Maria Jose Erquiaga (Cisco Systems)
Cycldek: Bridging the (air) gap
Key findings While investigating attacks related to a group named Cycldek post 2018, we were able to uncover various pieces of information on its activities that were not known thus far. In this blog post we aim to bridge the knowledge gap on this group and provide a more thorough insight into its latest activities and modus operandi.
UPSynergy: Chinese-American Spy vs. Spy Story
September 5, 2019 Research By: Mark Lechtik & Nadav Grossman Introduction Earlier this year, our colleagues at Symantec uncovered an interesting story about the use of Equation group exploitation tools by an alleged Chinese group named Buckeye (a.k.a APT3, or UPS team). One of the key findings in their publication was that variants of the Equation tools were used by the group prior to ‘The Shadow Brokers’ public leak in 2017.
Q2 2021 spam and phishing report
Quarterly highlights The corporate sector In Q2 2021, corporate accounts continued to be one of the most tempting targets for cybercriminals. To add to the credibility of links in emails, scammers imitated mailings from popular cloud services. This technique has been used many times before. A fake notification about a Microsoft Teams meeting or a request to view an important document traditionally takes the victim to a phishing login page asking for corporate account credentials.
APT trends report Q1 2021
For four years, the Global Research and Analysis Team (GReAT) at Kaspersky has been publishing quarterly summaries of advanced persistent threat (APT) activity. The summaries are based on our threat intelligence research and provide a representative snapshot of what we have published and discussed in greater detail in our private APT reports. They are designed to highlight the significant events and findings that we feel people should be aware of.
Deep Dive into UPAS Kit vs. Kronos
In this post we will be analyzing the UPAS Kit and the Kronos banking Trojan, two malwares that have come under the spotlight recently due to the back story behind them. In May 2017, WannaCry wreaked havoc in over 150 countries and brought down companies across all industries. Luckily, the attack was brought to a halt by the British cyber-analyst, Marcus Hutchins, through the discovery of the first of four kill-switches.
SiliVaccine: Inside North Korea’s Anti-Virus
Revealed: In an exclusive piece of research, Check Point Researchers have carried out a revealing investigation into North Korea’s home-grown anti-virus software, SiliVaccine. One of several interesting factors is that a key component of SiliVaccine’s code is a 10-year-old copy of one of Trend Micro’s, a Japanese company, software components.
The leap of a Cycldek-related threat actor
Introduction In the nebula of Chinese-speaking threat actors, it is quite common to see tools and methodologies being shared. One such example of this is the infamous “DLL side-loading triad”: a legitimate executable, a malicious DLL to be sideloaded by it, and an encoded payload, generally dropped from a self-extracting archive. Initially considered to be the signature of LuckyMouse, we observed other groups starting to use similar “triads” such as HoneyMyte.
Operation TunnelSnake
Windows rootkits, especially those operating in kernel space, are pieces of malware infamous for their near absolute power in the operating system. Usually deployed as drivers, such implants have high privileges in the system, allowing them to intercept and potentially tamper with core I/O operations conducted by the underlying OS, like reading or writing to files or processing incoming and outgoing network packets.
Lazarus Under The Hood
Download full report (PDF) In February 2017 an article in the Polish media broke the silence on a long-running story about attacks on banks, allegedly related to the notoriously known Lazarus Group. While the original article didn’t mention Lazarus Group it was quickly picked up by security researchers.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Mark
Contact Mark, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack