- Category
- State · Attributed to a state or working for one.
- Origin
- Russia(medium confidence)
- Motivation
- Information theft and espionage
- Seen
- 2018
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0145 · powerpool
RussiaWhat it is
Malware developers have started to use the zero-day exploit for Task Scheduler component in Windows, two days after proof-of-concept code for the vulnerability appeared online.
A security researcher who uses the online name SandboxEscaper on August 27 released the source code for exploiting a security bug in the Advanced Local Procedure Call (ALPC) interface used by Windows Task Scheduler.
More specifically, the problem is with the SchRpcSetSecurity API function, which fails to properly check user's permissions, allowing write privileges on files in C:\Windows\Task.
The vulnerability affects Windows versions 7 through 10 and can be used by an attacker to escalate their privileges to all-access SYSTEM account level.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- IAmTheKing
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTRussia
Targets
- Countries
- Chile, Germany, India, Malaysia, Philippines, Poland, Russia, Ukraine, United Kingdom, United States
- Sectors
- Defense, Education, Energy, Government
Tools
The tools and malware families the sources tie to it.
- ALPC Local PrivEsc
- Archelaus Beta
- FireMaster
- JackOfHearts
- KingOfHearts
- LaZagne
- Mimikatz
- POWERSOURCE
- POWERSTATS
- Power Loader
- PowerDuke
- PowerDump
- PowerRAT
- PowerSploit
- ProcDump
- PsExec
- Quarks PwDump
- QueenOfClubs
- QueenOfHearts
- SLOTHFULMEDIA
- SMBExec
- Small-Net
- UNITEDRAKE
- Windows Remote Desktop
- Xploit
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de