#sakulagh0st

[happyhomedecoration]

HURRICANE PANDA

Status: Inactive since Fall 2015Other Names: Operation Umbrella Revolution, Operation Poisoned HurricaneActive Since/Discovered: 2013 Last Report: December 2015 Targets: Telecommunications and technology companies. Targets confidential data and intellectual property Target Sectors: internet services, engineering, and aerospace Malware: -RATs – Sakula Gh0st, plugx, Hikit, Mimikatz -Webshell RAT – Chopper webshell --Easily obfuscated 70 byte text file that consists of an ‘eval()’ command --Used to provide full command execution and file upload/download capabilities to the attackers. --Typically uploaded to a web server via a SQL injection or WebDAV vulnerability Preferred Attack Vector: zero-day vulnerabilities; a DNS resolution exploitation technique; unique toolkit; and a SQL injection vulnerabilities

[fatcashmoney]

HURRICANE PANDA

Status: Inactive since Fall 2015Other Names: Operation Umbrella Revolution, Operation Poisoned HurricaneActive Since/Discovered: 2013 Last Report: December 2015 Targets: Telecommunications and technology companies. Targets confidential data and intellectual property Target Sectors: internet services, engineering, and aerospace Malware: -RATs – Sakula Gh0st, PlugX, Hikit, Mimikatz -Webshell RAT – Chopper webshell --Easily obfuscated 70 byte text file that consists of an ‘eval()’ command --Used to provide full command execution and file upload/download capabilities to the attackers. --Typically uploaded to a web server via a SQL injection or WebDAV vulnerability Preferred Attack Vector: zero-day vulnerabilities; a DNS resolution exploitation technique; unique toolkit; and a SQL injection vulnerabilities

sakulagh0st

[goingforthegold-blog1]

Hurricane Panda, 3 Minute Profile

Hurricane Panda APT (other names associated are Operation Umbrella Revolution and Operation Poisoned Hurricane) targeted the internet services, engineering and aerospace sectors with Sakula Gh0st, PlugX, Hikit, Mimikatz etc. Hurricane Panda used free DNS servers provided by Hurricane Electric to resolve well known domains to the desired attack infrastructure IP