Using Qualys Custom Asset and Remediation, you can utilize the following PowerShell community scripts to identify potential infected assets by either copying the contents of the script manually or pointing the tool to the GitHub script directly to download.


Fig.14 CAR Scripts Users of Custom Assessment and Remediation and Qualys Patch Management can also push scripts to uninstall the impacted software automatically.

3CXDesktopApp Backdoored in a Suspected Lazarus Campaign


These scripts will be published to GitHub in the coming days.


An example output from a system that does not have a vulnerable version of ffmpeg.dll installed: Fig.15 CAR script output CAR can also be leveraged to remediate this vulnerability.


You need to execute this uninstallation script provided by Qualys.


This script checks for 3CX Desktop App’s vulnerable version 18.12.407.0 & 18.12.416.0 for Windows.


If any of these versions are installed on the system, the script will attempt to uninstall the vulnerable application.


Fig.16 CAR script for remediation You can also create dashboards for better visualization.


Fig.17 CAR dashboard for 3CX Qualys Multi-Vector EDR customers are protected against this threat as both the installer and the beacon are detected and will be remediated.


(Note: our instance was set to audit-only mode for analysis.)


Fig.18 EPP Scan Results Fig.19 Epp Detection for shellcode loader Multi-Vector EDR customers can also hunt through telemetry, looking for behavior indicators to identify this threat activity.


A first step would look for instances where the 3cxdesktopapp.exe process executed in the environment using a QQL Query of process.name:”3xcdesktopapp.exe”.


Here you would want to look for evidence of the ffmpeg.dll file being loaded, which would be indicative that this machine may be impacted by this campaign.


Fig.20 EDR Behavioral Detection Telemetry Fig.21 EDR Shellcode Loader Detection Fig.22 Loaded malicious ffmpeg.dll telemetry While Qualys Endpoint Protection (EPP) users will be automatically protected by default, Qualys EDR-only customers can use the recently released auto-remediation feature to automatically take action.


Conclusion Supply chain compromises are a growing concern for businesses, as they can lead to serious security breaches and financial losses.


The attack was a multi-stage chain where attackers compromised a version of the 3CX VoIP desktop client, which was then used to target the company’s customers.


This is reminiscent of the SolarWinds campaign that we examined back in December 2022.


Organizations should take immediate steps to stop using the vulnerable version of the software, apply patches and monitor for anomalous behavior in 3CX processes.


It is also essential to enable behavioral monitoring to detect the presence of such attacks within the system.


MITRE TID Mapping TacticTechnique IDTechnique Name Resource Development T1608.001 Stage Capabilities: Upload Malware Resource Development T1587.003 Develop Capabilities: Digital Certificates Initial Access T1195.002 Supply Chain Compromise: Compromise Software Supply Chain Execution T1106 Native API Execution T1204.002


User Execution: Malicious File Defense Evasion T1140 Deobfuscate/Decode Files or Information Defense Evasion T1027 Obfuscated Files or Information Defense Evasion T1574.002 Hijack Execution Flow: DLL Side-Loading Defense Evasion T1553.002 Subvert Trust Controls: Code Signing Defense Evasion T1497.003 Virtualization/Sandbox Evasion: Time-Based Evasion Credential Access T1555 Credentials from Password Stores Credential Access T1539 Steal Web Session Cookie Command and Control T1132.001 Data Encoding: Standard Encoding Command and Control T1102.001 Web Service:


Dead Drop Resolver Command and Control T1071 Application Layer Protocol Collection T1005 Data from Local System Table.5 MITRE mapping IOCS ffmpeg.dll C485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896 c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02 d3dcompiler.dll 11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03 11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03 Embedded dll F86A81B89C5FD4C98BC8616440FF0382505EC7942DA6D4F19EEE011E956434A8 Trojanized 3cxDesktopApp Dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc Fad482ded2e25ce9e1dd3d3ecc3227af714bdfbbde04347dbc1b21d6a3670405 92005051ae314d61074ed94a52e76b1c3e21e7f0e8c1d1fdd497a006ce45fa61


Infostealer dll Cad1120d91b812acafef7175f949dd1b09c6c21a 7faea2b01796b80d180399040bb69835 GitHub Repository raw[.]githubusercontent[.]com/IconStorages/images/main/ C2s akamaicontainer[.]com akamaitechcloudservices[.]com azuredeploystore[.]com azureonlinecloud[.]com azureonlinestorage[.]com dunamistrd[.]com glcloudservice[.]com journalide[.]org msedgepackageinfo[.]com msstorageazure[.]com msstorageboxes[.]com officeaddons[.]com officestoragebox[.]com pbxcloudeservices[.]com pbxphonenetwork[.]com pbxsources[.]com qwepoi123098[.]com sbmsa[.]wiki sourceslabs[.]com visualstudiofactory[.]com zacharryblogs[.]com Icon File Hashes a541e5fc421c358e0a2b07bf4771e897fb5a617998aa4876e0e1baa5fbb8e25c d459aa0a63140ccc647e9026bfd1fccd4c310c262a88896c57bbe3b6456bd090 d51a790d187439ce030cf763237e992e9196e9aa41797a94956681b6279d1b9a 4e08e4ffc699e0a1de4a5225a0b4920933fbb9cf123cde33e1674fde6d61444f 8c0b7d90f14c55d4f1d0f17e0242efd78fd4ed0c344ac6469611ec72defa6b2d f47c883f59a4802514c57680de3f41f690871e26f250c6e890651ba71027e4d3 2c9957ea04d033d68b769f333a48e228c32bcf26bd98e51310efd48e80c1789f 268d4e399dbbb42ee1cd64d0da72c57214ac987efbb509c46cc57ea6b214beca c62dce8a77d777774e059cf1720d77c47b97d97c3b0cf43ade5d96bf724639bd c13d49ed325dec9551906bafb6de9ec947e5ff936e7e40877feb2ba4bb176396 f1bf4078141d7ccb4f82e3f4f1c3571ee6dd79b5335eb0e0464f877e6e6e3182 2487b4e3c950d56fb15316245b3c51fbd70717838f6f82f32db2efcc4d9da6de e059c8c8b01d6f3af32257fc2b6fe188d5f4359c308b3684b1e0db2071c3425c d0f1984b4fe896d0024533510ce22d71e05b20bad74d53fae158dc752a65782e Contributors Travis Smith, Vice President, Threat Research Unit, Qualys Irfan Asrar, Director, Malware and Threat Research, Qualys Mayuresh Dani, Manager, Threat Research.


Qualys Sabri Naoufal, Senior Malware Analyst, Qualys Mohammad Shabbir, Malware Analyst, Qualys Akshat Pradhan, Senior Engineer, Threat Research, Qualys


On March 29, Crowdstrike published a report about a supply chain attack conducted via 3CXDesktopApp, a popular VoIP program.

Not just an infostealer Gopuram backdoor deployed through 3CX supply chain attack


Since then, the security community has started analyzing the attack and sharing their findings.


The following has been discovered so far:


The infection is spread via 3CXDesktopApp MSI installers.


An installer for macOS has also been trojanized.


The malicious installation package contains an infected dll library that decrypts a shellcode from the d3dcompiler_47.dll library’s overlay and executes it.


The decrypted payload extracts C2 server URLs from icons stored in a GitHub repository (the repository is removed).


The payload connects to one of the C2 servers, downloads an infostealer and starts it.


The infostealer collects system information and browser history, then sends it to the C2 server.


As we reviewed available reports on the 3CX attack, we began wondering if the compromise concluded with the infostealer or further implants followed.


To answer that question, we decided to review the telemetry we had on the campaign.


On one of the machines, we observed a DLL named guard64.dll, which was loaded into the infected 3CXDesktopApp.exe process.


Interestingly enough, we opened an investigation into a case linked to that DLL on March 21, about a week before the supply chain attack was discovered.


A DLL with that name was used in recent deployments of a backdoor that we dubbed “Gopuram” and had been tracking internally since 2020.


Three years ago, we were investigating an infection of a cryptocurrency company located in Southeast Asia.


During the investigation, we found that Gopuram coexisted on victim machines with AppleJeus, a backdoor attributed to the Korean-speaking threat actor Lazarus.


Over the years, we observed few victims compromised with Gopuram, but the number of infections began to increase in March 2023.


As it turned out, the increase was directly related to the 3CX supply chain attack.


We found out that the threat actor specifically targeted cryptocurrency companies, dropping the following files on infected machines: C:\Windows\system32\wlbsctrl.dll, a malicious library (MD5: 9f85a07d4b4abff82ca18d990f062a84); C:\Windows\System32\config\TxR\<machine hardware profile GUID>.TxR.0.regtrans-ms, an encrypted shellcode payload.


Once dropped, wlbsctrl.dll becomes loaded on every startup by the IKEEXT service via DLL hijacking.


We further saw DLLs with the names ualapi.dll and ncobjapi.dll being sideloaded into spoolsv.exe and svchost.exe, respectively.


The wlbsctrl.dll library is responsible for decrypting and executing the shellcode stored in the C:\Windows\System32\config\TxR directory.


The decryption is notably performed through the CryptUnprotectData API function that uses a different encryption key internally on every machine.


This makes it difficult for researchers to decrypt the payload from the file without physical access to the victim machines.


Snippet of the loading function using CryptUnprotectData The component loaded by the library is Gopuram’s main module.


As mentioned above, its name in the export directory is guard64.dll.


The job of the main module is to connect to a C2 server and request commands.


The backdoor implements commands that allow the attackers to interact with the victim’s file system and create processes on the infected machine.


Gopuram was additionally observed to launch in-memory modules.


Just like the implants used in the 3CX campaign, Gopuram’s modules are DLL files that include an export function named DllGetClassObject.


We have observed eight modules so far: Module name Description Ping Pings a host specified in the argument.


Connect Connects to a given host via a socket and waits for the server to send data.


Registry Manipulates registry (lists, adds, deletes and exports keys).


Service Manipulates (creates, lists, starts, stops and deletes) services.


Timestomp Performs timestomping on files.


Inject Performs payload injections through syscalls via mapping a shellcode to a remote process and creating a remote thread.


KDU Kernel Driver Utility that allows an attacker to bypass driver signature enforcement.


The utility is used to load an unsigned driver (MD5: F684E10FF1FFCDD32C62E73A11382896).


The driver collects information about installed AV filters and writes it to the C:\Windows\System32\catroot2\edb.chk.log file.


Update Encrypts a provided payload


and writes it to the C:\Windows\System32\config\TxR\<machine hardware profile GUID>.TxR.0.regtrans-ms file.


Net Partially implements features of the net command: management of users, groups, sessions and network shares.


The discovery of the new Gopuram infections allowed us to attribute the 3CX campaign to the Lazarus threat actor with medium to high confidence.


Our attribution is based on the following facts: While investigating an attack on a Southeast Asian cryptocurrency company in 2020, we found Gopuram coexisting on the same machine with the AppleJeus backdoor, which is attributed to Lazarus.


The Gopuram backdoor has been observed in attacks on cryptocurrency companies, which is aligned with the interests of the Lazarus threat actor.


While looking for additional implants that used the same loader shellcode as the 3CX implants, we discovered a sample on a multiscanner service (MD5: 933508a9832da1150fcfdbc1ca9bc84c) loading a payload that uses the wirexpro[.]com C2 server.


The same server is listed as an IoC for an AppleJeus campaign by Malwarebytes.


First bytes of the loader shellcode used in 3CX and AppleJeus Note, though, that the shellcode is based on open-source code that has been used by other threat actors, for example, SilentBreak.


Still, the use of that shellcode along with the 0xF558F4DA constant (which is the ROR13 hash for the string DllGetClassObject) is a more unique pattern.


While investigating a malicious MSI file (MD5: ec3f99dd7d9dbce8d704d407b086e84f) that has been uploaded to a multiscanner service, we observed the following two events: The dll library dropped from the MSI was observed to launch an in-memory payload that contacts the oilycargo[.]com domain.


This domain name has previously been attributed to Lazarus by multiple researchers.


In our telemetry, we observed AvBugReport.exe, the executable hosting dll, to contain Gopuram’s main module payload, guard64.dll.


These four facts allow us to conclude that Lazarus is likely the threat actor deploying the Gopuram backdoor.


As for the victims in our telemetry, installations of the infected 3CX software are located all over the world, with the highest infection figures observed in Brazil, Germany, Italy and France.


As the Gopuram backdoor has been deployed to less than ten infected machines, it indicates that attackers used Gopuram with surgical precision.


We additionally observed that the attackers have a specific interest in cryptocurrency companies.


As it turns out, the infostealer is not the only malicious payload deployed during the 3CX supply chain attack.


The threat actor behind Gopuram additionally infects target machines with the full-fledged modular Gopuram backdoor.


We believe that Gopuram is the main implant and the final payload in the attack chain.


Our investigation of the 3CX campaign is still far from complete.


We will continue analyzing the deployed implants to find out more details about the toolset used in the supply chain attack.


Gopuram indicators of compromise MD5 hashes 9f85a07d4b4abff82ca18d990f062a84 96d3bbf4d2cf6bc452b53c67b3f2516a File paths C:\Windows\System32\config\TxR\<machine hardware profile GUID>.TxR.0.regtrans-ms C:\Windows\system32\catroot2\edb.chk.log More indicators of compromise and YARA rules for detecting Gopuram components are available for TIP subscribers.


Contact intelreports@kaspersky.com for more details.


Original release date: July 19, 2021SummaryThis Joint Cybersecurity Advisory was written by the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) to provide information on a Chinese Advanced Persistent Threat (APT) group known in open-source reporting as APT40.

AA21200A Tactics Techniques and Procedures of Indicted APT40 Actors Associated with Chinas MSS Hainan State Security Department


This advisory provides APT40’s tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help cybersecurity practitioners identify and remediate APT40 intrusions and established footholds.


APT40—aka BRONZE MOHAWK, FEVERDREAM, G0065, Gadolinium, GreenCrash, Hellsing, Kryptonite Panda, Leviathan, MUDCARP, Periscope, Temp.


Periscope, and Temp.


Jumper—is located in Haikou, Hainan Province, People’s Republic of China (PRC), and has been active since at least 2009.


APT40 has targeted governmental organizations, companies, and universities in a wide range of industries—including biomedical, robotics, and maritime research—across the United States, Canada, Europe, the Middle East, and the South China Sea area, as well as industries included in China’s Belt and Road Initiative.


On July 19, 2021, the U.S. Department of Justice (DOJ) unsealed an indictment against four APT40 cyber actors for their illicit computer network exploitation (CNE) activities via front company Hainan Xiandun Technology Development Company (Hainan Xiandun).


Hainan Xiandun employee Wu Shurong cooperated with and carried out orders from PRC Ministry of State Security (MSS) Hainan State Security Department (HSSD) intelligence officers Ding Xiaoyang, Zhu Yunmin, and Cheng Qingmin to conduct CNE.


Wu’s CNE activities resulted in the theft of trade secrets, intellectual property, and other high-value information from companies and organizations in the United States and abroad, as well as from multiple foreign governments.


These MSS-affiliated actors targeted victims in the following industries: academia, aerospace/aviation, biomedical, defense industrial base, education, government, healthcare, manufacturing, maritime, research institutes, and transportation (rail and shipping).


Click here for a PDF version of this report.


(Updated July 19, 2021) Click here for indicators of compromise (IOCs) in STIX format.


Note: to uncover malicious activity, incident responders search for IOCs in network- and host-based artifacts and assess the results—eliminating false positives during the assessment.


For example, some MD5 IOCs in the STIX file identify legitimate tools—such as Putty, cmd.exe, svchost.exe, etc.—as indicators of compromise.


Although the tools themselves are not malicious, APT 40 attackers placed and used them from non-standard folders on victim systems during computer intrusion activity.


If a legitimate tool is identified by an incident responder, then the location of the tool should be assessed to eliminate false positives or uncover malicious activity.


See Technical Approaches to Uncovering and Remediating Malicious Activity for more incident handling guidance.


Technical DetailsThis Joint Cybersecurity Advisory uses the MITRE ATT&CK:registered: framework, version 9.


See the ATT&CK for Enterprise framework for all referenced threat actor tactics and techniques.


[G0065] has used a variety of tactics and techniques and a large library of custom and open-source malware—much of which is shared with multiple other suspected Chinese groups—to establish initial access via user and administrator credentials, enable lateral movement once inside the network, and locate high value assets in order to exfiltrate data.


Table 1 provides details on these tactics and techniques.


Note: see the appendix for a list of the domains, file names, and malware MD5 hash values used to facilitate this activity.


Table 1: APT40


ATT&CK Tactics and Techniques Tactics Activities and Techniques Reconnaissance [TA0043] and Resource Development [TA0042] Gathered victim identity information [T1589] by collecting compromised credentials [T1589.001] Acquire infrastructure


[T1583] to establish domains that impersonate legitimate entities [T1583.001], aka ‘typosquatting’, to use in watering hole attacks and as command and control (C2)


[TA0011] infrastructure Establish new [T1585.002] and compromise existing [T1586.002] email and social media accounts


[1585.001] to conduct social engineering attacks Initial Access


[TA0001] External remote services (e.g., virtual private network


[VPN] services)


[T1133] Spearphishing emails with malicious attachments [T1566.001] and links [T1566.002] Drive-by compromises


[T1189] and exploitation of public-facing applications [T1190] Access to valid


[T1078], compromised administrative [T1078.001] accounts Execution


[TA0002] Command and scripting interpreters


[T1059] such as PowerShell [T1059.001] Exploitation of software vulnerabilities in client applications to execute code


[T1203] using lure documents that dropped malware exploiting various Common Vulnerabilities and Exposures (CVEs)


User execution


[T1204] of malicious files [T1204.002] and links


[T1566.002] attached to spearphishing emails [T1566.001] Persistence [TA0003], Privilege Escalation [TA0004], Credential Access


[TA0006], Discovery [TA0007], and Lateral Movement


[TA0008] APT40 has used a combination of tool frameworks and malware to establish persistence, escalate privileges, map, and move laterally on victim networks.


Additionally, APT40 conducted internal spearphishing attacks [T1534]. BADFLICK/Greencrash China Chopper [S0020] Cobalt Strike [S0154] Derusbi/PHOTO [S0021] Gh0stRAT


[S0032] GreenRAT jjdoor/Transporter jumpkick Murkytop (mt.exe)


[S0233] NanHaiShu [S0228] Orz/AirBreak [S0229] PowerShell Empire


[S0363] PowerSploit


[S0194] Server software component: Web Shell [TA1505.003] Defense Evasion


[TA0005], Command and Control


[TA0011], Collection [TA0009], and Exfiltration [TA0010] Use of steganography [T1027.003] to hide stolen data inside other files stored on GitHub Protocol impersonation


[T1001.003] by using Application Programming Interface (API) keys for Dropbox accounts in commands to upload stolen data to make it appear that the activity was a legitimate use of the Dropbox service Protocol tunneling [T1572] and multi-hop proxies


[T1090.003], including the use of Tor [S0183] Use of domain typosquatting for C2 infrastructure [T1583.001] Archive [T1560], encrypt [T1532], and stage collected data locally


[T1074.001] and remotely [T1074.002] for exfiltration Exfiltration over C2 channel [T1041] MitigationsNetwork Defense-in-Depth Proper network defense-in-depth and adherence to information security best practices can assist in mitigating the threat and reducing the risk.


The following guidance may assist organizations in developing network defense procedures.


Patch and Vulnerability Management Install vendor-provided and verified patches on all systems for critical vulnerabilities, prioritizing timely patching of internet-connected servers and software processing internet data—such as web browsers, browser plugins, and document readers.


Ensure proper migrating steps or compensating controls are implemented for vulnerabilities that cannot be patched in a timely manner.


Maintain up-to-date antivirus signatures and engines.


Routinely audit configuration and patch management programs to ensure the ability to track and mitigate emerging threats.


Implementing a rigorous configuration and patch management program will hamper sophisticated cyber threat actors’ operations and protect resources and information systems.


Review the articles in the References section for more information on Chinese APT exploitation of common vulnerabilities.


Protect Credentials Strengthen credential requirements, regularly change passwords, and implement multi-factor authentication to protect individual accounts, particularly for webmail and VPN access and for accounts that access critical systems.


Do not reuse passwords for multiple accounts.


Audit all remote authentications from trusted networks or service providers.


Detect mismatches by correlating credentials used within internal networks with those employed on external-facing systems.


Log use of system administrator commands such as net, ipconfig, and ping.


Enforce principle of least privilege.


Network Hygiene and Monitoring Actively scan and monitor internet-accessible applications for unauthorized access, modification, and anomalous activities.


Actively monitor server disk use and audit for significant changes.


Log Domain Name Service (DNS) queries and consider blocking all outbound DNS requests that do not originate from approved DNS servers.


Monitor DNS queries for C2 over DNS.


Develop and monitor the network and system baselines to allow for the identification of anomalous activity.


Audit logs for suspicious behavior.


Identify and suspend access of users exhibiting unusual activity.


Use allowlist or baseline comparison to monitor Windows event logs and network traffic to detect when a user maps a privileged administrative share on a Windows system.


Leverage multi-sourced threat-reputation services for files, DNS, URLs, IP addresses, and email addresses.


Network device management interfaces—such as Telnet, Secure Shell (SSH), Winbox, and HTTP—should be turned off for wide area network (WAN) interfaces and secured with strong passwords and encryption when enabled.


When possible, segment critical information on air-gapped systems.


Use strict access control measures for critical data.


APPENDIX:


APT40 Indicators of Compromise APT40 used the following domains, file names, and malware MD5 hash values to facilitate the CNE activity outlined in this CSA between 2009 through 2018.


Domains airbusocean[.]com https://pastebin[.]com/vfb5mbbu pacifichydrologic[.]org cargillnotice[.]com huntingtomingalls[.]com philippinenewss[.]com ccidmeekparry[.]info indiadigest[.]in philstarnotice[.]com ccvzvhjhdf[.]website jack-newnb[.]com porndec143.chickenkiller[.]com cdigroups[.]com kAty197.chickenkiller[.]com santaclarasystem[.]us checkecc[.]com louisdreyfu[.]com scsnewstoday[.]com chemscalere[.]com mail2.ignorelist[.]com secbkav[.]com cnnzapmeta[.]com masterroot[.]pw Soure7788.chickenkiller[.]com corycs[.]com microsql-update[.]info tccoll[.]com deltektimes[.]com mihybb[.]com teledynegroup[.]com Engaction[.]com mlcdailynews[.]com teledyneinstrument[.]com ens-smithjonathan.rhcloud[.]com movyaction[.]net testdomain2019.chickenkiller[.]com fishgatesite.wordpress[.]com msusanode[.]com thestar[.]live goo2k88yyh2.chickenkiller[.]com newbb-news[.]com thrivedataview[.]com gttdoskip[.]com nfmybb[.]com thyssemkrupp[.]com http://gkimertds.wordpress[.]com/feed/ nmw4xhipveaca7hm[.]onion.link/en_US/all.js thyssenkrupp-marinesystems[.]org http://stackoverflow[.]com/users/3627469/angle-swift nobug[.]uk.to togetno992.mooo[.]com http://stackoverflow[.]com/users/3804206/swiftr-angle notesof992.wordpress[.]com tojenner97.chickenkiller[.]com http://stackoverflow[.]com/users/3863346/gkimertdssdads onlinenewspapers[.]club trafficeco[.]com vser.mooo[.]com onlineobl[.]com transupdate[.]com https://pastebin[.]com/p1mktQpD oyukg43t[.]website troubledate[.]com ultrasocial[.]info wsmcoff[.]com xbug.uk[.]to usdagroup[.]com www.yorkshire-espana-sa[.]com/english/servicios/ yootypes[.]com https://github[.]com/slotz/sharp-loader/commit/f9de338fb474fd970a7375030642d04179b9245d MD5 Malware Hashes (Updated July 19, 2021) Note: to uncover malicious activity, incident responders search for indicators of compromise (IOCs) in network- and host-based artifacts and assess the results—eliminating false positives during the assessment.


For example, some MD5 IOCs in the table below identify legitimate tools—such as PuTTY, cmd.exe, svchost.exe, etc.—as indicators of compromise.


01234c0e41fc23bb5e1946f69e6c6221 018d3c34a296edd32e1b39b7276dcf7f 019b68e26df8750e2f9f580b150b7293 01fa52a4f9268948b6c508fef0377299 022bd2040ec0476d8eb80d1d9dc5cc92 039d9ca446e79f2f4310dc7dcc60ec55 043f6cdca33ce68b1ebe0fd79e4685af 04918772a2a6ccd049e42be16bcbee39 04dc4ca70f788b10f496a404c4903ac6 060067666435370e0289d4add7a07c3b 062c759d04106e46e027bbe3b93f33ef 07083008885d2d0b31b137e896c7266c 079068181a728d0d603fe72ebfc7e910 0803f8c5ee4a152f2108e64c1e7f0233 09143a14272a29c56ff32df160dfdb30 0985f757b1b51533b6c5cf9b1467f388 09aab083fb399527f8ff3065f7796443 0b7bb3e23a1be2f26b9adf7004fc6b52 0b9a614a2bbc64c1f32b95988e5a3359 0bbe092a2120b1be699387be16b5f8fb 0bbe769505ca3db6016da400539f77aa 0c3c00c01f4c4bad92b5ba56bd5a9598 0c4fa4dfbe0b07d3425fea3efe60be1c 0ca936a564508a1f9c91cb7943e07c30 0d69eefede612493afd16a7541415b95 0da08b4bfe84eacc9a1d9642046c3b3c 0dd7f10fdf60fc36d81558e0c4930984 0e01ec14c25f9732cc47cf6344107672 10191b6ce29b4e2bddb9e57d99e6c471 105757d1499f3790e69fb1a41e372fd9 207e3c538231eb0fd805c1fc137a7b46 20e52d2d1742f3a3caafbac07a8aa99a 226042db47bdd3677bd16609d18930bd 22823fed979903f8dfe3b5d28537eb47 2366918da9a484735ec3a9808296aab8 239a22c0431620dc937bc36476e5e245 2499390148fc99a0f38148655d8059e7 24dbcd8e8e478a35943a05c7adfc87cc 25a06ab7675e8f9e231368d328d95344 25b79ba11f4a22c962fea4a13856da7f 25fc4713290000cdf01d3e7a0cea7cef 2639805ae43e60c8f04955f0fe18391c 270df5aab66c4088f8c9de29ef1524b9 280e5a3b9671db31cf003935c34f8cf9 28366de82d9c4441f82b84246369ad3b 28628f709a23d5c02c91d6445e961645 28c6f235946fd694d2634c7a2f24c1ba 29c1b4ec0bc4e224af2d82c443cce415 2b8a06d1de446db3bbbd712cdb2a70ce 2bf998d954a88b12dbec1ee96b072cb9 2c408385acdb04f0679167223d70192b 2c9737c6922b6ca67bf12729dcf038f9 2dd9aab33fcdd039d3a860f2c399d1b1 2de0e31fda6bc801c86645b37ee6f955 2e5b59c62e6e2f3b180db9453968d817 2ee7168c0cc6e0df13d0f658626474bb 2eee367a6273ce89381d85babeae1576 2f0a52ce4f445c6e656ecebbcaceade5 2f9995bc34452c789005841bc1d8da09 30701b1d1e28107f8bd8a15fcc723110 31a72e3bf5b1d33368202614ffd075db 3389dae361af79b04c9c8e7057f60cc6 33d18e29b4ecc0f14c20c46448523fc8 46e80d49764a4e0807e67101d4c60720 480f3a13998069821e51cda3934cc978 48101bbdd897877cc62b8704a293a436 48548309036005b16544e5f3788561dc 4a23e0f2c6f926a41b28d574cbc6ac30 4ab825dc6dabf9b261ab1cf959bfc15d 4b18b1b56b468c7c782700dd02d621f4 4b93159610aaadbaaf7f60bea69f21a4 4beb3f7fd46d73f00c16b4cc6453dcdb 4dd6eab0fa77adb41b7bd265cfb32013 4e79e2cade96e41931f3f681cc49b60a 4ef1c48197092e0f3dea0e7a9030edc8 503f8dc2235f96242063b52440c5c229 50527c728506a95b657ec4097f819be6 5064dc5915a46bfa472b043be9d0f52f 513f559bf98e54236c1d4379e489b4bc 51e21a697aec4cc01e57264b8bfaf978 51f31ed78cec9dbe853d2805b219e6e7 52b0f7d77192fe6f08b03f0d4ea48e46 53ceeaf0a67239b3bc4b533731fd84af 56a9ff904b78644dee6ef5b27985f441 56b18ba219c8868a5a7b354d60429368 56d6d3aa1297c62c6b0f84e5339a6c22 57849bb3949b73e2cd309900adafc853 5826e0bd3cd907cb24c1c392b42152ca 5875dfe9a15dd558ef51f269dcc407b5 58e7fd4530a212b05481f004e82f7bc1 5957ef4b609ab309ea2f17f03eb78b2d 5984955cbc41b1172ae3a688ab0246c5 59ce71ffb298a5748c3115bc834335bf 5a8d488819f2072caed31ead6aeaf2fc 5acac898428f6d20f6f085d79d86db9c 5b2cddac9ebd7b0cd3f3d3ac15026ffb 6f6d12da9e5cf8b4a7f26e53cc8e9fbd 700d2582ccb35713b7d1272aa7cfc598 70206725df8da51f26d6362e21d8fadb 70e0052d1a2828c3da5ae3c90bc969ea 7204c1f6f1f4698ac99c6350f4611391 72a7fd2b3d1b829a9f01db312fdd1cd7 7327993142260cee445b846a12cf4e85 7525bc47e2828464ce07fa8a0db6844f 76adaa87f429111646a27c2e60bda61e 76c5dca8dc9b1241b8c9a376abab0cc5 782202b09f72b3cfdc93ffb096ca27de 7836c4a36cc66d4bcbd84abb25857d21 78a0af31a5c7e4aee0f9acde74547207 7969dc3c87a3d5e672b05ff2fe93f710 7a09bf329b0b311cc552405a38747445 7a63ea3f49a96fa0b53a84e59f005019 7b3f959ab775032a3ca317ebb52189c4 7b710f9731ad3d6e265ae67df2758d50 7bd10b5c8de94e195b7da7b64af1f229 7c036ba51a3818ddc8d51cf5a6673da4 7c49efe027e489134ec317d54de42def 7d63f39fb0100a51ba6d8553ef4f34de 7ef6802fc9652d880a1f3eaf944ce4a3 7f7d726ea2ed049ab3980e5e5cb278a3 7fe679c2450c5572a45772a96b15fcb1 83076104ae977d850d1e015704e5730a 8361b151c51a7ad032ad20cecf7316f4 838ceb02081ac27de43da56bec20fc76 84865f8f1a2255561175ab12d090da7c 8520062de440b75f65217ff2509120f7 85862c262c087dd4470bb3b055ef8ea5 85e5b11d79a7570c73d3aa96e5a4e84d 85ecef9ca15e25835a9300a85f9bcd2a 9d3fd2ff608e79101b09db9e361ea845 9d5206f692577d583b93f1c3378a7a90 9e592d0918c029aa49635f03947026e8 9f847b3618b31ef05aebd81332067bd8 9fdd77dc358843af3d7b3f796580c29d a025881cd4ae65fab39081f897dc04fd a0e3561633bdf674b294094ffa06a362 a13715be3d6cbd92ed830a654d086305 a2256f050d865c4335161f823b681c24 a26e600652c33dd054731b4693bf5b01 a2c66a75211e05b20b86dd90ba534792 a2cb95be941b94f5488eab6c2eec7805 a320510258668504ed0140e7b58ee31e a34db95c0fcb78d9c5452f81254224eb a3c0151e0b6289376f383630a8014722 a42a91354d605165d2c1283b6b330539 a4711b8414445d211826b4da3f39de0a a4a70ce528f64521c3cd98dce841f6f3 a5ac89845910862cfef708b20acd0e44 a67fcb5dcfc9e3cfbfd7890e65d4f808 a68bf5fce22e7f1d6f999b7a580ae477 a6b9bbb87eb08168fc92271f69fa5825 a6cab9f2e928d71ed8ecf2c28f03a9a2 a7e4f42ad70ddd380281985302573491 a83b1aed22de71baee82e426842eeb48 a91dca76278cf4f4155eb1b0fc427727 a96dca187c3c001cad13440c3f7e77e8 aa73e7056443f1dd02480a22b48bdd46 aaafb1eeee552b0b676a5c6297cfc426 ab662cee6419327de86897029a619aeb ab8f72562d02156273618d1f3746855c abdb86d8b58b7394be841e0a4da9bec7 ace585625de8b3942cc3974cf476f8de beea0da01409b73be94b8a3ef01c4503 befc121916f9df7363fead1c8554df9a bf250a8c0c9a820cd1a21e3425acfe37 bfb0dcd9ef6ac6e016a8a5314d4ef637 bff56d7e963ea28176b0bcb60033635d c05e5bc5adb803b8a53cff7f95621c73 c0ad63a680fbdc75d54b270cbedb4739 c0d9f3a67a8df0ed737ceb9e15bacc47 c112456341a1c5519e7039ce0ba960fa c161f10fccecec67c589cdd24a05f880 c183e7319f07ccc591954068e15095db c2e023b46024873573db658d7977e216 c380675a29f47dba0b1401c7f8e149dc c3996bf709cad38d58907da523992e3b c583ae5235ddea207ac11fff4af82d9b c71f125fb385fed2561f3870b4593f18 c75a2b191da91114ceea80638bc54030 c78ee46ffbe5dd76d84fb6a74bf21474 c79b27fe1440b11a99a5611c9d6c6a78 c808d2ed8bb6b2e3c06c907a01b73d06 c8930a4fd33dcf18923d5cf0835272bd c8940976a63366f39cfcdc099701093b c89e8f0bc93d472a4f863a5fa7037286 c8a850a027fa4a3cdae7f87cc1c71ba0 cab21cb7ba1c45a926b96a38b0bdaaef cbe63b9c0c9ac6e8c0f5b357df737c5e cbfc1587f89f15a62f049e9e16cccf68 cd049c2b76c73510ae70610fd1042267 cd058dd28822c72360bc9950a6c56c45 cd427b4afea8032c77e907917608148a cd81267e9c82d24a9f40739fa6bf1772 cdc22f7913eb93d77d629e59ac2dc46a cdc585a1fd677da07163875cd0807402 e0b7e6c17339945bba43b8992a143485 e119a70f50132ae3afba3995fdf1aca6 e1512a0bf924c5a2b258ec24e593645a e195d22652b01a98259818cfbab98d33 e1ab3358b5356adefaffbc15bc43a3f9 e1b840bbf5b54aeb19e6396cab8f4c6a e26a29c0fc11cfb92936ab3374730b79 e284c25c50ba59d07a4fa947dc1a914a e3867f6e964a29134c9ea2b63713f786 e3eb703ef415659f711b6bc5604e131e e498718fd286aca7bb78858f4636f2db e4d2c63a73a0f1c6b5e60bde81ac0289 e5478fb5e8d56334d19d43cae7f9224a e5f7efcee5b15cf95a070a5cd05dbda9 e6348ee5beb9c581eeeaf4e076c5d631 e637f47c4f17c01a68539fcfcc4bc44f e63fbc864b7911be296c8ee0798f6527 e68f9b39caf116fb108ccb5c9c4ce709 e6a757114c0940b6d63c6a5925ade27f e6adc73df12092012f8cd246ba619f90 e8881037f684190d5f6cc26aab93d40f e890fa6fd8a98fec7812d60f65bf1762 e8bc927ee0ae288609e1c37665a3314e e8e73156316df88dee28214fb203658b e957c36c9d69d6a8256b6ddf7f806f56 e9ce9b35e2386bf442e22a49243a647e eadcae9ecba1097571c8d08e9b1c1a9c eb06648b43d34f20fc1c40e509521e99 eb5e5db77540516e6400a7912ad0ef0d eb5e999753f5ea094d59bdae0c66901c eb5ee94048730b321e35394a0fb10a5d eb64867dc48f757f0afe05dbf605b72d eb88f415336f0dccedfc93405330c561 fae03ff044d6bb488e1a6f1c6428c510 fc2142bd72bd520338f776146903be67 fc9b8262905a80cc5381d520813d556d fccd3de1df131f9d74949d69426c24af fcd912fd7ed80e2cdf905873c6ced4ad ff804e266a83974775814870cc49b66b 11166f8319c08c70fc886433a7dac92d 1223302912ec70c7c8350268a13ad226 139e071dd83304cdcfd5280022a0f958 13c93dc9186258d6c335b16dc7bb3c8c 14e2b0e47887c3bfbddb3b66012cb6e8 15437cfedfc067370915864feec47678 15e1816280d6c2932ff082329d0b1c76 166694d13ac463ea1c2bed64fbbb7207 16a344cd612cca4f0944ba688609e3ac 16c0011ea01c4690d5e76d7b10917537 1734a2b176a12eba8b74b8ca00ef1074 18144e860d353600bbd2e917aed21fde 1815c3a7a4a6d95f9298abb5855a3701 181a5b55b7987b62b5236965f473ba3b 18c26c5800e9e2482f1507c96804023e 1932ce50b7b6c88014cf082228486e5c 1af78c50aca90ee3d6c3497848ac5705 1b44fb4aaff71b1f96cd049a9461eaf5 1bb8f32e6e0e089d6a9c10737cf19683 1c35a87f61953baace605fff1a2d0921 1c945a6b0deccc6cd2f63c31f255d0ec 1cb216777039fe6a8464fc6a214c3c86 1d3a10846819a07eef66deefcc33459a 1dd6c80b4ea5d83aff4480dcbbef520c 1e91f0f52994617651e9b4a449af551a 1eb568559e335b3ed78588e5d99f9058 1ef9c42efe6e9a08b7ebb16913fa0228 1f2befede815fcf65c463bf875fcf497 1f9bdc0435ff0914605f01db8ca77a65 1ffd883095ff3279b31650ca3a50ad3c 34521c0f78d92a9d95e4f3ff15b516db 34681367cbcc3933f0f4b36481bde44e 34aa195c604d0725d7dd2aa4cc4efe28 354b95e858bcaced369ecbfdec327e2b 35f456afbe67951b3312f3b35d84ff0a 3647d11c155d414239943c8c23f6e8ec 37578c69c515f1d0d49769930fba25ce 375cbb0a88111d786c33510bff258a21 37b9b4ed979bd2cf818e2783499bfb5e 3810a18650dbacecd10d257312e92f61 3975740f65c2fa392247c60df70b1d6d 3a4ec0d0843769a937b5dadbe8ea56b1 3ab6bf23d5d244bc6d32d2626bd11c08 3bf8bb90d71d21233a80b0ec96321e90 3c2fe2dbdf09cfa869344fdb53307cb2 3c3d453ecf8cc7858795caece63e7299 3cbb46065f3e1dccbd707c340f38ce6b 3cf9dc0fdc2a6ab9b6f6265dc66b0157 3e89c56056e5525bf4d9e52b28fbbca7 3eb6f85ac046a96204096ab65bbd3e7e 3f50eedf4755b52aa7a7b740bd21daa6 3fefa55daeb167931975c22df3eca20a 4012acd80613aaa693a5d6cd4e7239ba 40528e368d323db0ac5c3f5e1efe4889 407c1ea99677615b80b2ffa2ed81d513 417949c717f78dc9e55ca81a5f7ade3e 4260e71d89f622c6a3359c5556b3aad7 429c10429a2ebb5f161e04159a59cf5b 4315975499cdc50098dbdb5b8aa4a199 44fa9c5df4ae20c50313aae02ba8fb95 4519b5d443a048a8599144900c4e1f28 45eb058edde4e5755a5ea1aff3ce3db7 460dc00ce690efacb5db8273c80e2b23 5b3050df93629f2f6cb3801ed19963c5 5b37ac4d642b96c4bf185c9584c0257a 5b3e945cd32a380f09ea98746f570758 5b72df8f6c110ae1d603354fcd8fe104 5c6f5cd81b099014718056e86b510fa2 5d63a3a02df2beda9d81f53abbd8264a 5d9c3cb239fa24bed2781bcf2898f153 5e353d1d17720c0f7c93f763e3565b3f 5f1c7f267fbe12210d3c80944f840332 5f393838220a6bf0cd9fd59c7cf97f5b 5f771966ef530ee0c2b42ef5cc46ad3a 6034ff91b376d653dc30f79664915b4e 603935efa89d93ea39b4b4d4a52ec529 607ea06890a6eedd723f629133576f20 60b2ce5ef4a076d1fa8675b584c27987 60cff7381b8fb64602816f9e5858930b 614909c72fa811ae41ea3d9b70122cee 6372d578e881abf76a4ec61e7a28da7d 63bf28f5dc6925a94c8b4e033a95be10 646cbeb4233948560ac50de555ea85ca 64db8e54d9a2daaa6d9cf156a8b73c18 675fe822243dfd1c3ace2a071d0aa6dd


67dbecfb5e0f2f729e57d0f1eda82c67 685cbba8cf2584a3378d82dec65aa0bb


693a4c2fcaa67fb87e62f150fb65e00e 6ad33ab8b9ff3f02964a8aab2a40ebb5 6b540be7ac7159104b0ffa536747f1bf 6b7276e4aa7a1e50735d2f6923b40de4 6b930be55ed4bf8e16b30eadc3873dfd 6c67f275d50f6bfee4848de6d4911931 6c9cfada134ede220b75087c7698ebf2 6e843ef4856336fe3ef4ed27a4c792b1 6e97bf1b7c44edc66622b43e81105779 86e50d6dc28283dbd295079252787577 870fbad5b9a54cb6720c122d1fa321ec 88b3b94574ba1eeb711a66eb04021eed 8956a045306b672d3cc852419a72c4b0 8a9ac1b3ef2bf63c2ddfadbbbfd456b5 8b3b96327fbddebefe727ac2edad5714 8baa499b3e2f081ff47f8cf06a5e7809 8bc20fcd09adb7ea86dda2c57477633b 8be0c21b6ee56d0f68e0d90f7d0a26d7 8c80dd97c37525927c1e549cb59bcbf3 8d2416d9f6926fb0dc12ab5dafef691d 8d74922b2b31354ce588cefac71d9a9b 8e8fb7632c3a7e96cf0ea5299d564018 8ee6c9e1adb71b2623d5e7aa45df5f4d 8efaa987959ef95179a0f5be05c10faf 8fbf53f77c98daba277dae7661b86f02 8fc825df73977eeffaaa1587565f7505 90a3e3a2049c6eb9e39d113d9451a83f 932d355d9f2df2e8d8449d85454fc983 9450980a4413dfdbc60a62b257a7b019 947892152b8419a2dfe498be5063c1da 94d42ff06a588587131c2cd8a9b2fe96 95c15b7961e2d6fad96defa7ff2c6272 96ba4bf00d8b4acee9f550286610dcc7 97004f1962e2aed917dc2be5c908278f 972077c1bb73ca78b7cad4ac6d56c669 991ebcd03ace627093acc860fae739b5 99949240bc4eae33cac4bbb93b72349d 9a0a8048d53dedc763992fff32584741 9a0e3e80cd7c21812de81224f646715e 9a61ed5721cf4586abd1d49e0da55350 9b26999182ea0c2b2cac91919697289e 9c656ce22c93ca31c81ff8378a0a91ee ace620a0cc2684347e372f7e40e245d5 ad3b9e45192ec7c8085c3588cacb9c58 adb4f6ecb67732b7567486f0cee6e525 afa03ddb9fc64a795aadb6516c3bc268 b0269263ce024fc9de19f8f30bd51188 b04e895827c24070eb7082611ab79676 b059c9946ff67c62c074d6d15f356f6e b07299a907a4732d14da32b417c08af3 b1dadfcf459f8447b9ec44d8767da36d b2f1d2fefe9287f3261223b4b8219d03 b36f3e12cb88499f8795b8740ae67057 b4204f08c1a29fd4434e28b6219bfbc6 b4878c233d7f776a407f55a27b5effbc b6c12d88eeb910784d75a5e4df954001 b7ab5c6926f738dbe8d3a05cb4a1b4f5 b80dcd50e27b85d9a44fc4f55ff0a728 b8a61b1fda80f95a7dcdb0137bc89f67 b9642c1b3dbcccc9d84371b3163d43e0 b9647f389978f588d977ef6ef863938f b977bed98ae869a9bb9bf725215ef8e5 b9b627c470de997c01fdef4511029219 ba629216db6cf7c0c720054b0c9a13f3 badf0957c668d9f186fb218485d0d0f6 bb165b815e09fe95fa9282bce850528d bbfb478770a911cf055b8dfd8dcb36e4 bc4c189e590053d2cf97569c495c9610 bc9089c39bcdb1c3ef2e5bd25c77ed68 bd42303e7c38486df2899b0ccf3ce8f7 bd452dc2f9490a44bcff8478d875af4b bd6031dd85a578edf0bf1560caf36e02 bd63832e090819ea531d1a030fb04e9b be39ff1ec88a1429939c411113b26c02 be88741844bf7c47f81271270abe82dc ce26e91fc13ccb1be4b6bf6f55165410 ce449d7cb0a11b53b0513dde3bd57b1c ceba742bccb23304cf05d6c565dc53f8 cebe44b8a9a2d6e15a03d40d9e98e0ed cf946bc0faecb2dc8e8edc9e6ce2858f d09fcd9fa9ed43c9f28bcd4bd4487d22 d0b5c11ee5df0d78bdde3fdc45eaf21d d0d8243943053256bc1196e45fbf92d2 d0efc042ba4a6b207cf8f5b6760799d8 d20d01038e6ea10a9dcc72a88db5e048 d31596fe58ca278be1bb46e2a0203b34 d3df8c426572a85f3afa46e4cd2b66cd d59a77a8da7bec1f4bad7054a41b3232 d76b1c624e9227131a2791957955dddc d79477c9c688a8623930f4235c7228f6 d8a483d21504e73f0ba4b30bc01125d3 da46994fee26782605842005aabcd2fe daa232882b74d60443dfec8742401808 dab45ac39e34cfee60dcb005c3d5a668 dbc583d6d5ec8f7f0c702b209af975e2 dbe92b105f474efc4a0540673da0eb9c dbee8be5265a9879b61853cd9c0e4759 dc15ca49b39d1d17b22ec7580d32d905 dc386102060f7df285e9498f320f10e0 dd43cd0eddbb6f7cb69b1f469c37ec35 dd4e0f997e0b2cc9df28dca63ded6816 ddbdc6a3801906de598531b5b2dac02a dde4ff4e41f86426051f15da48667f5f ddecce92a712327c4068fabf0e1a7ff1 de608439f2bcc097b001d352b427bb68 deeb9b4789ac002aa8b834da76e70d74 df6475642f1fe122df3d7292217f1cff e011784958e7a00ec99b8f2320e92bf4 ec4cdc752c2ecd0d9f97491cc646a269 edb648f6c3c2431b5b6788037c1cd8ef ee3e297abd0a5b943dce46f33f3d56fb ee4862bc4916fc22f219e1120bea734a ef14448bf97f49a2322d4c79e64bb60b ef2738889e9d041826d5c938a256bc45 ef6fcdd1b55adf8ad6bcdf3d93fd109e efb5499492f08c1f10fecdeb703514d5 f0098aab593b65d980061a2df3a35c21 f073de9c169c8fcb2de5b811bff51cee f0881d5a7f75389deba3eff3f4df09ac f172ad4e906d97ed8f071896fc6789dc f2b6bffa2c22420c0b1c848b673055ed f446d8808a14649bddcc412f9e754890 f4dbe32f3505bc17364e2b125f8dd6df f4dd628f6c0bc2472d29c796ee38bf46 f4e67343e13c37449ada7335b9c53dd1 f53e332b0a6dbe8d8d3177e93b70cb1e f5ae03de0ad60f5b17b82f2cd68402fe f5ce889a1fa751b8fd726994cdb8f97e f5fdbfce1a5d2c000c266f4cd180a78d f7202dea71cc638e0c2dbeb92c2ce279 f7cef381c4ee3704fc8216f00f87552a f7ffbbbc68aadcbfbace55c58b6da0a7 f8b91554d221fe8ef4a4040e9516f919 f906571d719828f0f4b6212fc2aa7705 f9155052a43832061357c23de873ff9f f9abacc459e5d50d8582e8c660752c4e f9f608407d551f49d632bd6bd5bd7a56 f9fc9359dc5d1d0ac754b12efb795f79 fa27742b87747e64c8cb0d54aa70ef98 fa3c8d91ef4a8b245033ddb9aa3054a2 fad93907d5587eb9e0d8ebc78a5e19c2 Contact Information To report suspicious or criminal activity related to information found in this Joint Cybersecurity Advisory, contact your local FBI field office at www.fbi.gov/contact-us/field, or the FBI’s 24/7 Cyber Watch (CyWatch) at (855) 292-3937 or by email at CyWatch@fbi.gov.


When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact.


To request incident response resources or technical assistance related to these threats, contact CISA at CISAServiceDesk@cisa.dhs.gov. References DOJ Press Release Talos Intelligence:


China Chopper Still Active


9 Years Later CISA China Cyber Threat Overview webpage CISA Alert TA15-314A: Compromised Web Servers and Web Shells - Threat Awareness and Guidance CISA Alert AA20-133A: Top 10 Routinely Exploited Vulnerabilities CISA Alert AA20-275A:


Potential for China Cyber Response to Heightened U.S.-China Tensions NSA Cybersecurity Advisory U/OO/179811-20: Chinese State-Sponsored Actors Exploit Publicly Known Vulnerabilities Revisions July 19, 2021:


Initial version Updated July 19, 2021: Added note and STIX file This product is provided subject to this Notification and this Privacy & Use policy.


Operation Spalax:

Operation Spalax Targeted malware attacks in Colombia


Targeted malware attacks in Colombia url: https://www.welivesecurity.com/2021/01/12/operation-spalax-targeted-malware-attacks-colombia/ ESET researchers uncover attacks targeting Colombian government institutions and private companies, especially from the energy and metallurgical industries


In 2020 ESET saw several attacks targeting Colombian entities exclusively.


These attacks are still ongoing at the time of writing and are focused on both government institutions and private companies.


For the latter, the most targeted sectors are energy and metallurgical.


The attackers rely on the use of remote access trojans, most likely to spy on their victims.


They have a large network infrastructure for command and control: ESET observed at least 24 different IP addresses in use in the second half of 2020.


These are probably compromised devices that act as proxies for their C&C servers.


This, combined with the use of dynamic DNS services, means that their infrastructure never stays still.


We have seen at least 70 domain names active in this timeframe


and they register new ones on a regular basis.


The attackers The attacks we saw in 2020 share some TTPs with previous reports about groups targeting Colombia, but also differ in many ways, thus making attribution difficult.


One of those reports was published in February 2019, by QiAnXin researchers.


The operations described in that blogpost are connected to an APT group active since at least April 2018.


We have found some similarities between those attacks and the ones that we describe in this article: We saw a malicious sample included in IoCs of QiAnXin’s report and a sample from the new campaign in the same government organization.


These files have fewer than a dozen sightings each.


Some of the phishing emails from the current campaign were sent from IP addresses corresponding to a range that belongs to Powerhouse Management, a VPN service.


The same IP address range was used for emails sent in the earlier campaign.


The phishing emails have similar topics and pretend to come from some of the same entities – for example, the Office of the Attorney General (Fiscalia General de la Nacion) or the National Directorate of Taxes and Customs (DIAN).


Some of the C&C servers in Operation Spalax use linkpc.net and publicvm.com subdomains, along with IP addresses that belong to Powerhouse Management.


This also happened in the earlier campaign.


However, there are differences in the attachments used for phishing emails, the remote access trojans (RATs) used and in most of the operator’s C&C infrastructure.


There is also this report from Trend Micro, from July 2019.


There are similarities between the phishing emails and parts of the network infrastructure in that campaign and the one we describe here.


The attacks described in that article were connected to cybercrime, not espionage.


While we have not seen any payload delivered by the attackers other than RATs, some of the targets in the current campaign (such as a lottery agency) don’t make much sense for spying activities.


These threat actors show perfect usage of the Spanish language in the emails they send, they only target Colombian entities, and they use premade malware and don’t develop any themselves.


Attack overview Targets are approached with emails that lead to the download of malicious files.


In most cases, these emails have a PDF document attached, which contains a link that the user must click to download the malware.


The downloaded files are regular RAR archives that have an executable file inside.


These archives are hosted in legitimate file hosting services such as OneDrive or MediaFire.


The target has to manually extract the file and execute it for the malware to run.


We’ve found a variety of packers used for these executables, but their purpose is always to have a remote access trojan running on the victimized computer, usually by decrypting the payload and injecting it into legitimate processes.


An overview of a typical attack is shown in Figure 1.


We have seen the attackers use three different RATs: Remcos, njRAT and AsyncRAT. Figure 1.


Overview of the attack Phishing emails The attackers use various topics for their emails, but in most cases they are not specially crafted for their victims.


On the contrary, most of these emails have generic topics that could be reused for different targets.


We found phishing emails with these topics: A notification about a driving infraction A notification to take a mandatory COVID-19 test A notification to attend a court hearing An open investigation against the recipient for misuse of public funds A notification of an embargo of bank accounts The email shown in Figure 2 pretends to be a notification about a driving infraction for a value of around US$250.


There is a PDF file attached that promises a photo of the infraction, as well as information about time and place of the incident.


The sender has been spoofed to make the email look like it is coming from SIMIT (a system for paying transit violations in Colombia).


Example of a phishing email The pdf file only contains an external link that has been shortened with the acortaurl service, as shown in Figure 3.


The shortened URL is: https://acortaurl[.]com/httpsbogotagovcohttpsbogotagovcohttpsbogotagovco.


After the shortened link is expanded, a RAR archive is downloaded from: http://www.mediafire[.]com/file/wbqg7dt604uwgza/SIMITcomparendoenlineasimitnumeroreferenciaComparendo2475569.uue/file.


PDF attached to phishing email Figure 4 shows part of the email’s header.


The spoofed sender is notificacionesmultas@simit.org[.]co but we can see that the real sender is IP address 128.90.108[.]177, which is connected with the domain name julian.linkpc[.]net, as found in historic DNS data.


It’s not a coincidence that the same domain name is used for contacting the C&C server in the malicious sample contained in the RAR archive.


This IP address belongs to Powerhouse Management, a VPN service provider.


Header of a phishing email In more recent emails, the shortened link in the PDF file resolves to https://bogota.gov[.]co (a legitimate site) when visited from outside of Colombia.


Also, in some cases the GetResponse service has been used to send the email.


This is probably done to track whether the victim has clicked on the link.


In these cases there is no attachment: a link to the GetResponse platform leads to the download of malware.


You can see the other emails in the following gallery (click to enlarge): Figures 5 to 13.


Various phishing emails and their attached files Malicious artifacts Droppers The executable files contained in compressed archives that are downloaded via the phishing emails are responsible for decrypting and running remote access trojans on a victimized computer.


In the following sections, we describe the various droppers we have seen.


NSIS installers The dropper that is most commonly used by these attackers comes as a file that was compiled with NSIS (Nullsoft Scriptable Install System).


To try to evade detection, this installer contains several benign files that are written to disk (they are not part of NSIS binaries and they are not used at all by the installer) and two files that are malicious: an encrypted RAT executable and a DLL file that decrypts and runs the trojan.


An NSIS script for one of these installers is shown in Figure 14.


The benign files are usually different in different droppers used by the attackers.


NSIS script for one of the droppers; the malicious files are highlighted The files Bonehead (encrypted RAT) and ShoonCataclysm.dll (dropper DLL) are written in the same folder and the DLL is run with rundll32.exe using Uboats as its argument.


The names of these files change between executables.


Some more examples are: rundll32.exe


Blackface,Breathing rundll32.exe OximeLied,Hostage rundll32.exe Conservatory,Piggins


We used the name of the benign files contained in some of these NSIS installers to find more malicious installers used by the Spalax operators.


Table 1 lists details of three different NSIS installers used by the attackers that contained all the same benign files.


The only difference among them was the encrypted file, which pointed to different C&C servers.


NSIS installers with identical benign files used by this group SHA-1C&C


However, we also found malicious NSIS installers used by other unrelated groups that had the same benign files as the ones used by this group.


Figure 15 lists the files contained in two different NSIS installers.


The one on the left (SHA-1: 3AC39B5944019244E7E33999A2816304558FB1E8) is an executable used by this group and the one on the right (SHA-1: 6758741212F7AA2B77C42B2A2DE377D97154F860) is unrelated.


The SHA-1 hashes for all the benign files are the same (and also the filenames) and even the malicious DLL is the same.


However, the encrypted file Bonehead is different.


Files contained in NSIS droppers from unrelated campaigns This means that these installers were generated with the same builder, but by different actors.


The builder is probably offered in underground forums and includes these benign files.


This, along with a complete analysis of the dropper, was described earlier this year by Sophos in their RATicate article.


There is also an article by Lab52 describing one of the NSIS installers used in Operation Spalax, which they attribute to APT-C-36.


In the vast majority of cases these NSIS droppers decrypt and run the Remcos RAT, but we have also seen cases where the payload is njRAT.


These will be described later in the Payloads section.


Agent Tesla packers We have seen several droppers that are different variants of a packer that uses steganography and is known to be used in Agent Tesla samples.


Interestingly, the attackers use various payloads, but none of them are Agent Tesla.


Even though there are differences in all the samples regarding the layers of encryption, obfuscation or anti-analysis used, we can summarize the actions taken by the droppers as follows: The dropper reads a string (or binary data) from its resource section and decrypts it.


The result is a DLL that will be loaded and called in the same address space.


The DLL reads pixels from an image contained in the first binary and decrypts another executable.


This one is loaded and executed in the same address space.


This new executable is packed with CyaX. It reads data from its own resource section and decrypts a payload.


There are anti-analysis checks; if they pass, the payload can be injected into a new process or loaded in the same process space.


The initial dropper is coded in C#.


In all the samples that we have seen, the code for the dropper was hiding in non-malicious code, probably copied from other apps.


The benign code is not executed; it’s there to evade detection.


In Figure 16 we see an example of the resources contained in one of these droppers.


The text in green (only shown partially) is a string that will be decrypted to generate the next stage to be executed and the image that we see below the green text will be decrypted by the second stage malware.


The algorithm used for decryption of the string varies from sample to sample, but sometimes the resource is just an unencrypted binary.


Figure 16.


Resources contained in Agent Tesla’s packer


The method to be executed in the DLL is always named StartGame or StartUpdate.


It reads the image from the first executable, and stores every pixel as three numbers according to its red, green and blue components.


Then it decrypts the array by doing a single-byte XOR operation, cycling through the key.


After that, the array is gzip-decompressed and executed.


Part of the code for the mentioned operations is shown in Figure 17. Figure 17.


Code to decrypt and run the third-stage malware The third stage is in charge of decrypting and running the payload.


The .NET packer known as CyaX is used to perform this task.


The version of the packer used by the attackers is v4, although they used v2 in some cases.


Figure 18 shows the hardcoded configuration for one of their samples.


Hardcoded configuration in CyaX-Sharp packer


The decryption of the payload is based on XOR operations and is the same as the algorithm previously shown but with an extra step: the payload is XORed with its first 16 bytes as a key.


Once it’s decrypted, it can be run in the same address space or injected into a different process, depending on the configuration.


This packer supports various anti-analysis operations such as disabling Windows Defender, checking for security products, and detecting virtual environments and sandboxes.


The majority of the payloads for these droppers are njRAT, but we have also seen AsyncRAT.


We saw Remcos in one of these droppers, but the code in the packer was different.


Part of the main routine for the injection of the payload is shown in Figure 19. Figure 19.


Code for the last stage of a dropper We have noticed that the configuration is contained in different variables.


Values like #startup_method# or #bind# mean that the configuration was not set for those options.


The payload is read from an encrypted resource and XORed with a hardcoded password.


The shellcode that performs the injection is contained in an array and is dynamically loaded.


There are no anti-analysis checks or protection mechanisms.


AutoIt


droppers For some of their droppers, the attackers have used an AutoIt packer that comes heavily obfuscated.


Unlike the cases that were previously described, in this case the first-stage malware performs the injection and execution of the payload.


It does so by using two shellcodes contained in the compiled AutoIt script: one to decrypt the payload and another to inject it into some process.


The payload is constructed by concatenating several strings, as shown in Figure 20.


By inspecting the last two characters, we can see that the string is in reverse order.


Figure 20.


Concatenation of the payload The routine that decrypts the payload contains a small shellcode that is loaded with VirtualAlloc and executed.


The decryption done by the shellcode is based on a single-byte XOR algorithm.


The code that loads the shellcode is shown in Figure 21. Figure 21.


Execution of shellcode to decrypt the payload We can see that the shellcode is stored encrypted.


In fact, before deobfuscating the script, all strings were encrypted with this same XOR-based algorithm.


The decryption routine used is shown in Figure 22. Figure 22.


Routine to decrypt strings Once the payload is decrypted, a shellcode with RunPE code is used to perform the injection.


The shellcode is concatenated in the same manner as the payload and executed like the previous shellcode.


To achieve persistence, a VBS script is created to execute a copy of the dropper (which is renamed to aadauthhelper.exe).


Then an Internet Shortcut (.url) file is created in the Startup folder to execute the script.


The code that generates these files is shown in Figure 23. Figure 23.


Code for persistence in AutoIt


droppers The dropper contains code that is not executed.


It can: Check for VMware and VirtualBox Delete the dropper executable Run the dropper continuously Download and execute files Terminate if a “Program Manager” window is found Read a binary from its resource section, write it to disk and execute it Modify the security descriptor (ACL) for the injected process For more information see this analysis by Morphisec where similar AutoIt droppers were used with Frenchy shellcode.


Payloads The payloads used in Operation Spalax are remote access trojans.


These provide several capabilities not only for remote control, but also for spying on targets: keylogging, screen capture, clipboard hijacking, exfiltration of files, and the ability to download and execute other malware, to name a few.


These RATs were not developed by the attackers.


They are: Remcos, sold online njRAT, leaked in underground forums AsyncRAT, open source There is not a one-to-one relationship between droppers and payloads, as we have seen different types of droppers running the same payload and also a single type of dropper connected to different payloads.


However, we can state that NSIS droppers mostly drop Remcos, while Agent Tesla and AutoIt packers typically drop njRAT.


Remcos is a tool for remote control and surveillance.


It can be purchased with a six-month license that includes updates and support.


There is also a free version with limited functionalities.


While the tool can be used for legitimate purposes, it is also used by criminals to spy on their victims.


Most of the Remcos samples used by this group are v2.5.0 Pro, but we have also seen all versions that were released since September 2019, which may indicate that the attackers bought a license after that month and have been actively using the different updates that they received during their six month license period.


Regarding njRAT, this group mostly uses v0.7.3 (also known as the Lime version).


That version includes functionalities such as DDoS or ransomware encryption, but only spy features such as keylogging are used by the attackers.


For a more complete description of this version, refer to this 2018 article by Zscaler.


Another njRAT version used by the attackers is v0.7d (the “green edition”) which is a simpler version focused on spying capabilities: keylogging, taking screenshots, access to webcam and microphone, uploading and downloading files, and executing other binaries.


The final type of payload that we will mention is AsyncRAT.


In all cases we have observed v0.5.7B, which can be found on GitHub, has been used.


The functionalities in this RAT are similar to those in the previously mentioned RATs, which allow attackers to spy on their victims.


Network infrastructure During our research we saw approximately 70 different domain names used for C&C in the second half of 2020.


This amounts to at least 24 IP addresses.


By pivoting on passive DNS data for IP addresses and known domain names, we found that the attackers have used at least 160 additional domain names since 2019.


This corresponds to at least 40 further IP addresses.


They’ve managed to operate at such scale by using Dynamic DNS services.


This means that they have a pool of domain names (and also register new ones on a regular basis) that are dynamically assigned to IP addresses.


This way a domain name can be related to several IP addresses over a period of time and IP addresses can be related to many domain names.


Most of the domain names we have seen were registered with Duck DNS, but they have also used DNS Exit for publicvm.com and linkpc.net subdomains.


Regarding IP addresses, almost all of them are in Colombia.


Most are IP addresses related to Colombian ISPs: 60% of them are Telmex and 30% EPM Telecomunicaciones (Tigo).


As it is highly unlikely that the criminals own so many residential IP addresses, it is possible that they use some victims as proxies, or some vulnerable devices to forward communication to their real C&C servers.


Finally, a subset of the IP addresses belongs to Powerhouse Management, a VPN service provider.


They are used in conjunction with DNS Exit subdomains.


Similar findings can be found in this analysis by Lab52. Conclusion Targeted malware attacks against Colombian entities have been scaled up since the campaigns that were described last year.


The landscape has changed from a campaign that had a handful of C&C servers and domain names to a campaign with very large and fast-changing infrastructure with hundreds of domain names used since 2019.


Even though TTPs have seen changes, not only in how malware is delivered in phishing emails but also in the RATs used, one aspect that remains the same is that the attacks are still targeted and focused on Colombian entities, both in the public and private sectors.


It should be expected that these attacks will continue in the region for a long time, so we will keep monitoring these activities.


A comprehensive list of Indicators of Compromise (IoCs) and samples can be found in our GitHub repository.


For any inquiries, or to make sample submissions related to the subject, contact us at threatintel@eset.com.


MITRE ATT&CK techniques Note: This table was built using version 7 of the MITRE ATT&CK framework.


TacticIDNameDescription Initial AccessT1566.001Phishing:


Spearphishing AttachmentThe attackers have used emails with PDF or RTF files attached that contain a link to download malware.


Spearphishing LinkThe attackers have used emails with a link to download malware.


ExecutionT1059.005Command and Scripting Interpreter:


Visual BasicThe attackers have used droppers that dump VBS files with commands to achieve persistence.


T1059.003Command and Scripting Interpreter:


Windows Command ShellThe attackers have used RATs that can launch a command shell for executing commands. T1106Native


APIThe attackers have used API calls in their droppers, such as CreateProcessA, WriteProcessMemory and ResumeThread, to load and execute shellcode in memory.


T1204.001User Execution: Malicious LinkThe attackers have attempted to get users to open a malicious link that leads to the download of malware.


T1204.002User Execution: Malicious FileThe attackers have attempted to get users to execute malicious files masquerading as documents. PersistenceT1547.001Boot or Logon Initialization Scripts: Registry Run Keys / Startup


FolderThe attackers have used RATs that persist by creating a Run registry key or by creating a copy of the malware in the Startup folder.


T1053.005Scheduled Task/Job: Scheduled TaskThe attackers have used scheduled tasks in their droppers and payloads to achieve persistence.


Privilege EscalationT1548.002Abuse Elevation Control Mechanism: Bypass User Access ControlThe attackers have used RATs that implement UAC bypassing.


Defense EvasionT1140Deobfuscate/Decode Files or InformationThe attackers have used various encryption algorithms in their droppers to hide strings and payloads.


T1562.001Impair Defenses: Disable or Modify ToolsThe attackers have used CyaX packer, which can disable Windows Defender.


T1070.004Indicator Removal on Host:


File DeletionThe attackers have used malware that deletes itself from the system.


T1112Modify RegistryThe attackers have used RATs that allow full access to the Registry, for example to clear traces of their activities.


T1027.002Obfuscated Files or Information:


Software PackingThe attackers have used various layers of packers for obfuscating their droppers.


T1027.003Obfuscated Files or Information:


SteganographyThe attackers have used packers that read pixel data from images contained in PE files’ resource sections and build the next layer of execution from the data.


T1055.002Process Injection: Portable Executable InjectionThe attackers have used droppers that inject the payload into legitimate processes such as RegAsm.exe, MSBuild.exe and more.


T1497.001Virtualization/Sandbox Evasion:


System ChecksThe attackers have used droppers and payloads that perform anti-analysis checks to detect virtual environments and analysis tools.


Credential AccessT1555.003Credentials from Password Stores: Credentials from Web BrowsersThe attackers have used various RATs with modules that steal passwords saved in victim web browsers.


Window


DiscoveryThe attackers have used droppers and RATs that gather information about opened windows. T1083File and Directory


DiscoveryThe attackers have used various RATs that can browse file systems.


T1120Peripheral Device


DiscoveryThe attackers have used njRAT, which attempts to detect if the victim system has a camera during the initial infection.


DiscoveryThe attackers have used various RATs with modules that show running processes.


T1012Query RegistryThe attackers have used various RATs that can read the Registry.


T1018Remote System DiscoveryThe attackers have used njRAT, which can identify remote hosts on connected networks.


T1518.001Software Discovery: Security Software


DiscoveryThe attackers have used droppers that check for security software present in a victim’s computer.


T1082System Information


DiscoveryThe attackers have used various RATs that gather system information such as computer name and operating system during the initial infection. T1016System Network Configuration DiscoveryThe attackers have used various RATs that can collect the IP address of the victim machine.


T1049System Network Connections DiscoveryThe attackers have used various RATs that can list network connections on a victim’s computer.


T1033System Owner/


User DiscoveryThe attackers have used various RATs that retrieve the current username during initial infection.


Service DiscoveryThe attackers have used various RATs that have modules to manage services on the system.


T1021.001Remote Services: Remote Desktop ProtocolThe attackers have used various RATs that can perform remote desktop access.


Through Removable MediaThe attackers have used njRAT, which can be configured to spread via removable drives.


CaptureThe attackers have used various RATs that can capture audio from the system’s microphone.


DataThe attackers have used various RATs that can access and modify data from the clipboard. T1005Data from Local SystemThe attackers have used various RATs that can access the local file system and upload, download or delete files.


T1056.001Input Capture:


KeyloggingThe attackers have used various RATs that have keylogging capabilities.


CaptureThe attackers have used various RATs that can capture screenshots of victim machines.


CaptureThe attackers have used various RATs that can access the victim’s webcam. Command and ControlT1132.001Data Encoding: Standard EncodingThe attackers have used njRAT, which uses base64 encoding for C&C traffic.


T1573.001Encrypted Channel:


Symmetric CryptographyThe attackers have used Remcos RAT, which uses RC4 for encrypting C&C communications.


T1095Non-Application Layer ProtocolThe attackers have used various RATs that use TCP for C&C communications.


T1571Non-Standard PortThe attackers have used various RATs that communicate over different port numbers.


Over C2 ChannelThe attackers have used various RATs that exfiltrate data over the same channel used for C&C. 12 Jan 2021 - 11:30AM


Authored by: David Brown, Michael Matthews and Rob Smallridge tl;dr This post describes the techniques, tactics and procedures we observed during recent LAPSUS$ incidents.

LAPSUS Recent techniques tactics and procedures


Our findings can be summarised as below: Access and scraping of corporate Microsoft SharePoint sites in order to identify any credentials which may be stored in technical documentation.


Access to local password managers and databases to obtain further credentials and escalate privileges.


Living of the land – tools such as RVTools to shut down servers and ADExplorer to perform reconnaissance.


Cloning of git repositories and extraction of sensitive API Keys.


Using compromised credentials to access corporate VPNs.


Disruption or destruction to victim infrastructure to hinder analysis and consume defensive resource.


Summary LAPSUS$ first appeared publicly in December 2021, however, NCC Group first observed LAPSUS$ months prior during an incident response engagement.


We believe the group has also operated prior to this date, though perhaps not under the “LAPSUS$” banner.


Over the last 5 months, LAPSUS$ has gained large notoriety with some successful breaches of some large enterprises including, Microsoft, Nvidia, Okta & Samsung.


Little is still known about this group with motivations appearing to be for reputation, money and “for the lulz”.


Notifications or responsibility of victims by LAPSUS$ are commonly reported via their telegram channel and in one case a victim’s DNS records were reconfigured to LAPSUS$ controlled domains/websites.


However, not all victims or breaches appear to actively be announced via their telegram channel, nor are some victims approached with a ransom.


This distinguishes themselves from more traditional ransomware groups who have a clear modus operandi and are clearly financially focused.


The result of this is that LAPSUS$ are less predictable which may be why they have seen recent success.


This serves as a reminder for defenders for defence in depth and the need to anticipate different tactics that threat actors may use.


It is also worth mentioning the brazen behaviour of this threat actor and their emboldened attempts at Social Engineering by offering payment for insiders to provide valid credentials.


This tactic is potentially in response to greater home working due to the pandemic which means there is a far larger proportion of employees with VPN access and as such a greater pool of potential employees willing to sell their credentials.


To combat this, organisations need to ensure they have extensive VPN logging capabilities, robust helpdesk ticketing as well as methods to help identify anomalies in VPN access.


It is notable that the majority of LAPSUS$ actions exploit the human element as opposed to technical deficiencies or vulnerabilities.


Although potentially viewed as unsophisticated or basic these techniques have been successful, so it is vital that organisations factor in controls and mitigations to address them.


Initial access Threat Intelligence shows that LAPSUS$ utilise multiple methods to gain Initial access.


The main source of initial access is believed to occur via stolen authentication cookies which would grant the attacker access to a specific application.


These cookies are usually in the form of Single sign-on (SSO) applications which would allow the attacker to pivot into other corporate applications ultimately bypassing controls such as multi-factor authentication (MFA).


Credential access and Privilege escalation Credential Harvesting and privileged escalation are key components of the LAPSUS$ breaches we have seen, with rapid escalation in privileges the LAPSUS$ group have been seen to elevate from a standard user account to an administrative user within a couple of days.


In the investigations conducted by NCC Group, little to no malware is used.


In one case NCC Group observed LAPSUS$ using nothing more than the legitimate Sysinternals tool ADExplorer, which was used to conduct reconnaissance on the victim’s environment.


Access to corporate VPNs is a primary focus for this group as it allows the threat actor to directly access key infrastructure which they require to complete their objectives.


In our incident response cases, we saw the threat actor leveraging compromised employee email accounts to email helpdesk systems requesting access credentials or support to get access to the corporate VPN.


Lateral Movement In one incident LAPSUS$ were observed to sporadically move through the victim environment via RDP in an attempt to access resources deeper in the victim environment.


In some instances, victim controlled hostnames were revealed including the host “VULTR-GUEST” which refers to infrastructure hosted on the private cloud service, Vultr[3].


Exfiltration LAPSUS$’s action on objectives appears to focus on data exfiltration of sensitive information as well as destruction or disruption.


In one particular incident the threat actor is observed to utilise the free file drop service “filetransfer[.]io”.


Impact NCC Group has observed disruption and destruction to client environments by LAPSUS$ such as shutting down virtual machines from within on-premises VMware ESXi infrastructure, to the extreme of mass deletion of virtual machines, storage, and configurations in cloud environments making it harder for the victim to recover and for the investigation team to conduct their analysis activities.


The theft of data reported appears to heavily be focused on application source code or proprietary technical information.


With a targeting of internal source code management or repository servers.


These git repositories can contain not only commercially sensitive intellectual property, but also in some cases may include additional API keys to sensitive applications including administrative or cloud applications.


Recommendations Ensure that Cloud computing environments have sufficient logging enabled.


Ensure that cloud administrative access is configured to prevent unauthorised access to resources and that API keys are not overly permissive to the permissions they require.


Utilise MFA for user authentication on both cloud and remote access solutions to help reduce the risk of unauthorised access.


Ensure logging is in place to record MFA device enrolmentSecurity controls such as Conditional Access can help restrict or prevent unauthorised access based on criteria such as geographical location.


Implement activities to detect and investigate anomalies in VPN access.


Ensure a system is in place to record all helpdesk queries.


Avoid using SMS as an MFA vector to avoid the risk of SIM swapping.


Securing source code environments to ensure that users can only access the relevant repositories.


Secret Scanning[1][2] on source code repositories should be conducted to ensure that sensitive API credentials are not stored in source code.


GitHub and Gitlab offer detection mechanisms for thisRemote Desktop services or Gateways used as a primary or secondary remote access solution should be removed from any corporate environment in favour for alternative solutions such as secured VPNs, or other Remote Desktop applications which mitigate common attack techniques such as brute force or exploitation and can offer additional security controls such as MFA and Conditional Access.


Centralise logging including cloud applications (SIEM solution).Offline or immutable backups of servers should be taken to ensure that in the event of a data disruption or destruction attack, services can be restored.


Reduce MFA token/Session cookie validity timesEnsure principle of least privilege for user accounts is being adhered to.


Social engineering awareness training for all staff.


Indicators of Compromise Indicator ValueIndicator TypeDescription104.238.222[.]158IP


addressMalicious Lapsus Network Address108.61.173[.]214IP


addressMalicious Lapsus Network Address185.169.255[.]74IP addressMalicious Lapsus Network AddressVULTR-GUESTHostnameThreat Actor Controlled Hosthxxps://filetransfer[.]ioDomainFree


File Drop Service Utilised by the Threat Actor MITRE ATT&CK Technique CodeTechniqueT1482Discovery – Domain Trust DiscoveryT1018Discovery – Remote System DiscoveryT1069.002Discovery –


Groups Discovery: Domain GroupsT1016.001Discovery – System Network Configuration DiscoveryT1078.002Privilege Escalation – Domain AccountsT1555.005Credential Access – Credentials from Password Stores: Password ManagersT1021.001Lateral Movement – Remote Services:


Remote Desktop ProtocolT1534Lateral Movement – Internal SpearphishingT1072Execution – Software Deployment ToolsT1213.002Collection – Data from Information Repositories: SharepointT1039Collection – Data from Network Shared DriveT1213.003Collection – Data from Information Repositories: Code RepositoriesT1567Exfiltration – Exfiltration Over Web ServiceT1485Impact – Data DestructionT1529Impact – System Shutdown/Reboot References https://docs.github.com/en/code-security/secret-scanning/about-secret-scanninghttps://docs.gitlab.com/ee/user/application_security/secret_detectionhttps://www.vultr.com/


Executive Summary Today, enterprises tend to use multiple layers of security defenses, ranging from perimeter defense on network entry points to host based security solutions deployed at the end user’s machines to counter the ever-increasing threats.

Detecting Credential Stealing Attacks Through Active InNetwork Defense


This includes inline traffic filtering and management security solutions deployed at access and distribution layers in the network, as well as out of band solutions like NAC, SIEM or User Behavior Analysis to provide identity-based network access and gain more visibility into the user’s access to critical network resources.


However, layered security defenses face the major and recurring challenge of detecting newer exploitation techniques as they heavily rely on known behaviors.


Additionally, yet another significant challenge facing the enterprise network is detecting post-exploitation activities, after perimeter security is compromised.


Post initial compromise, to be able to execute meaningful attacks, attackers would need to steal credentials to move laterally inside the network, access critical network assets and eventually exfiltrate data.


They will use several sophisticated techniques to perform internal reconnaissance and remote code execution on critical resources, which range from using legitimate operating system tools to discover network assets to using novel code execution techniques on the target.


Consequently, differentiating between the legitimate and malicious use of Windows’ internal tools and services becomes a high priority for enterprise networks.


To tackle this long-standing problem of detecting lateral movement, enterprise networks must formulate active in-network defense strategies to effectively prevent attackers from accessing critical network resources.


Network Deception is one such defensive approach which could potentially prove to be an effective solution to detect credential theft attacks.


Detecting credential stealing attacks with deception essentially requires building the necessary infrastructure by placing the decoy systems within the same network as production assets and configuring them with decoy contents to lure the attackers towards the decoy machines and services.


Accurately configuring and tuning the deceptive network can deflect the attacker’s lateral movement path towards the deceptive services, consequently allowing the attackers to engage with the deceptive network, helping enterprises protect production assets.


MITRE Shield, a knowledge base maintained by MITRE for active defense techniques highlights many of the methods in adversary engagement.


Some of the techniques described by MITRE Shield Matrix with respect to network deception are as below: MITRE Shield Description ATT&CK Technique Decoy Account – DTE0010 A decoy account is created for defensive or deceptive purposes.


The decoy account can be used to make a system, service, or software look more realistic or to entice an action Account Discovery, Reconnaissance Decoy Credentials – DTE0012 Seed a target system with credentials (such as username/password, browser tokens, and other forms of authentication data) Credential Access, Privilege Escalation Decoy Diversity – DTE0013 deployment of decoy systems with varying Operating Systems and software configurations Reconnaissance Decoy Network – DTE0014 Multiple computing resources that can be used for defensive or deceptive purposes Initial Access Decoy Personna – DTE0015 Used to establish background information about a user.


In order to have the adversary believe they are operating against real targets Initial Access, Discovery, Reconnaissance Decoy System – DTE0017 Computing resources presented to the adversary in support of active defense Reconnaissance Over the course of this paper, we will discuss some of the widely adapted credential theft attacks executed by adversaries after the initial compromise and then move on to discuss defense techniques against the above MITRE Shield attacks and how to use them effectively to detect deceptive credential usage in the network.


Network Deception – An Active in-network defensive approach Most of the targeted attacks involve stealing credentials from the system at a certain point in time as attackers would use them to pivot to other systems in the network.


Some of the credential stealing techniques like Golden Ticket attacks have been found to be used in multiple ransomwares armed with lateral movement capabilities.


Active in-network defense strategies described by the MITRE Shield matrix are significant and play a critical role in detecting credential abuse in the network.


Network Deception uses these active defense techniques to build the deceptive network infrastructure which could potentially lead to redirecting an attacker’s lateral movement path and engaging them to the decoy services without touching the critical production systems.


It involves placing decoy systems, decoy credentials and decoy contents all throughout the production network essentially converting it into a trap, playing a crucial role in mitigating the attacks.


McAfee Protection McAfee MVISION Endpoint Security has the capabilities to protect against credential theft attacks like credential extraction from LSASS process memory via ATP rule 511.


More details on configuring policies and a demo are available here.


McAfee MVISION Endpoint Detection and Response (EDR) has the capabilities to detect credential access from tools like Mimikatz.


With McAfee MVISION EDR and ENS integration with Attivo’s network and endpoint deception sensor, McAfee can manage its agents and receive alerts for detections in ePO and EDR.


Lateral Movement – Introduction Lateral movement refers to the tools and techniques used by attackers to progressively expand their foothold within an enterprise network after gaining initial access.


As shown in the figure below, lateral movement activity comprises of several stages starting from credential theft, target enumeration and discovery, privilege escalation, gaining access to network resources and eventually remote code execution on the target before exfiltrating data to accomplish a successful attack.


Once inside the network, attackers will deploy a range of techniques at each stage of lateral movement to achieve their end goal.


One of the primary challenges an attacker will face while moving laterally inside a network is to hide their activities in plain sight by generating a minimum volume of legitimate looking logs to be able to remain undetected.


To achieve this, an attacker might choose to embed the tool within a malicious executable or use the operating system’s internal legitimate tools and services to perform its lateral movement operations, consequently making this network traffic harder to distinguish.


As per the Verizon DBIR report 2020, over 80% of data breaches involve credential theft attacks.


Credential theft is one of the primary tasks attackers need to perform post-exploitation and after gaining initial control of the target machine.


It will usually be the first step towards lateral movement strategies which will allow attackers to elevate their privileges and acquire access to other network resources.


As indicated earlier, attackers have long been abusing Windows legitimate features like SMB, RPC over SMB, Windows Management Instrumentation, Windows Remote Management, and many other features to perform lateral movement activities.


Figure 1 below highlights where lateral movement falls within the attack chain and its different stages.


To remain stealthier, these activities would span a period ranging from many weeks to months.


Figure 1 – Stages of Lateral movement To be able to distinguish between the admissible and malicious use of these inbuilt services, it is extremely critical for organizations to deploy advanced Threat Detection solutions.


Over the course of this blog, we will discuss various credential theft techniques used by adversaries during lateral movement.


We will also discuss an approach that can be used to effectively detect these techniques inside the network.


Credential Theft Attacks Attackers use a variety of tools and techniques to execute credential theft attacks.


Many of these tools are open source and readily available on the internet.


Operating systems like Windows implement Single Sign


On (SSO) functionality, which require the user’s credentials to be stored in memory, thereby allowing the OS to seamlessly access network resource without repeatedly asking the user to re-enter those credentials.


Additionally, user credentials are stored in memory in a variety of formats like NTLM hashes, reversibly encrypted plaintext, Kerberos tickets, PINs, etc., which can be used to authenticate to services depending upon the supported authentication mechanism.


These credentials can be acquired by attackers from memory by parsing appropriate credential storage structures or using the Windows credential enumeration APIs.


Consequently, these attacks pose major security concerns, especially in the domain environment if the attacker gains access to privileged credentials which can then be reused to access critical network resources.


In the following sections, we discuss some of the widely adapted credential stealing techniques used by malware, with respect to the Windows operating system.


Similar credential stealing techniques can also be used with other operating systems as well.


Stealing Credentials from LSASS Process Memory The Local Security Authority Subsystem Service (LSASS) process manages and stores the credentials of all the users with active Windows sessions.


These credentials stored in the LSASS process memory will allow users to access other network resource such as files shares, email servers and other remote services without asking them for the credentials again.


LSASS process memory stores the credentials in many formats including reversibly encrypted plaintext, NTLM hashes, Kerberos Tickets (Ticket Granting Tickets, etc.).


These credentials are generated and stored in the memory of the LSASS process when a user initiates the interactive logon to the machine such as console logon or RDP, runs a scheduled task or uses remote administration tools.


The encryption and decryption of credentials is done using LsaProtectMemory and LsaUnProtectMemory respectively and hence a decryption tool using these APIs will be able to decrypt LSASS memory buffers and extract them.


However, malware would need to execute with local administrator privileges and enable “SeDebugPrivilege” on the current process to be able access the LSASS process memory.


Below is a code snapshot from one of the famous credential harvesting tools, Mimikatz, enabling the required privileges on the calling thread before dumping the credentials.


Figure 2 – Checking for required privileges We can see that the NTLM hash of the user’s credentials is revealed, and this can be brute forced offline as shown below.


Many Windows services, such as SMB, support NTLM authentication and NTLM hashes can be used directly for authentication eliminating the need for the clear text passwords.


Figure 3 – Cracking NTLM Hashes offline Attackers avoid using freely available tools like Mimikatz directly on the target machine to harvest credentials since they are easily detected by AVs.


Instead, they use recompiled clones of it with minimal functionality to avoid noise.


Below is one such instance where malware embeds recompiled Mimikatz code with the minimal required functionality.


Figure 4 – Credential extraction tool embedded inside malicious executable Detection can also be avoided by using several “living off the land’ mechanisms, available in many post-exploitation frameworks, to execute the credential harvesting tools directly from memory using Reflective PE injection, where the binary is never written to the disk.


Yet another approach is to dump the LSASS process memory using process dumping tools, exfiltrate the dump and extract the credentials offline.


Microsoft has documented multiple ways to configure additional LSASS process protection which can prevent credentials being compromised.


Stealing Credentials from Security Accounts Manager (SAM) Database The SAM database is a file on a local hard drive that stores the credentials for all local accounts on the Windows computer.


NT hashes for all the accounts on the local machine, including the local administrator credential hash, are stored in the SAM database.


The SAM database file is in %SystemRoot%system32/config and the hashes of the credentials are within the registry HKLM\SAM.


Attackers need to acquire elevated privileges to be able to access the credentials from the SAM database.


The example below demonstrates how the credentials from the SAM database can be revealed through a simple Meterpreter session.


Figure 5 – Dumping SAM database Stealing Credentials from Windows Credential Manager (CredMan) Windows Credential Manager stores the Web and SMB/RDP credentials of users if they choose to save them on the Windows machine, thereby preventing the authentication mechanism from asking for those passwords again on subsequent logins.


These credentials are encrypted with Windows Data Protection APIs (DPAPI) CryptProtectData, either using the current user’s logon session or a generated master key, and then saved on the local hard drive.


Consequently, any process running in the context of the logged in user will be able to decrypt the credentials using CryptUnProtectData DPAPI.


In the domain environment, these credentials can be used by attackers to pivot to other systems in the network.


Data Protection APIs provide the cryptographic functionalities that can be used to securely store credentials and keys.


These APIs are used by several other Windows components like browsers (IE/Chrome), certificates and many other applications as well.


Below is one example of how credential dumping tools like Mimikatz can be used to dump stored Chrome credentials.


Figure 6 – Dumping browser credentials DPAPI can be abused in multiple ways.


In the Active Directory domain joined environment, if other users have logged into the compromised machine, provided a malware is running with escalated privileges, it can extract other user’s master keys from the LSASS memory which can then be used to decrypt their secrets.


Below is a screenshot of how the master key can be extracted by using the credential dumping tool.


Figure 7 – Extracting DPAPI Master Key Malware also tends to use multiple variants of credential enumeration APIs available within Windows.


These APIs can extract credentials from Windows Credential Manager.


Below is one instance of the malware using CredEnumerateW API to retrieve credentials and then search for terminal services passwords which It would use to pivot to other systems.


Figure 8 – Extracting credentials using Windows API Stealing Service Account Credentials Through Kerberoasting In the domain joined environment, the Kerberos protocol has a significant role to play with respect to authentication and requesting access to services and applications.


It provides Single-Sign-On functionality for accessing multiple shared resources within the enterprise network.


The Kerberos authentication mechanism in Active Directory involves multiple requests and responses like Ticket Granting Ticket (TGT) and Ticket Granting Service (TGS) supported by a Key Distribution Server (KDC), usually a Domain Controller.


Upon successful authentication, a user will be able to access the respective services.


Attackers gaining access to a system joined in the domain would usually look for high value assets like Active Directory Controller, Database server, SharePoint server, Web Server, etc., and these services are registered in the domain with the specific Service Principal Name (SPN) values, which is a unique identifier of the Service Account in the domain.


These SPN values are used by Kerberos to map the instance with the logon account allowing the client to authenticate to the respective service.


Well known SPN values are listed out here.


Once the attacker is authenticated with any domain user credentials and has information about the SPN values of the services within the domain, they can initiate the Kerberos Ticket Granting Service request (TGS – REQ) to the Key Distribution Server with the specified SPN value.


Details on how the SPN values are registered and used in Kerberos authentication is documented here.


TGS response from the KDC will have the Kerberos Ticket encrypted with the hash of the service account.


This ticket can be extracted from the memory and can be brute forced offline to acquire service account credentials, allowing a domain user to gain admin level access to the service.


Kerberoasting is a well-documented attack technique listed in MITRE ATT&CK and it essentially abuses the Kerberos authentication allowing adversaries to request the TGS Tickets for the valid service accounts and brute force the ticket offline to extract the plain text credentials of the service accounts, consequently enabling them to elevate their privileges from domain user to domain admin.


As an initial step to this lateral movement technique, the attacker would perform an internal reconnaissance to gain information about the services registered in the domain and get SPN values.


A simple PowerShell command after importing the Active Directory PowerShell module, as shown below, can initiate the LDAP query to get information about all the user accounts from the Domain Controller with the SPN value set. Figure 9 – PowerShell command to generate LDAP query Attackers can specifically choose to scan the domain for MSSQL service with the registered SPN value used for Kerberos authentication.


PowerShell scripts like GetUserSPNs can scan all the user SPNs in the domain or MSSQL service registered in the domain with Discover-PSMSSQLServers or Invoke-Kerberoast scripts.


Following is an example output from the script:


Figure 10 – Kerberoasting PowerShell script output Once an attacker has the SPN value of the SQL service, a Kerberos Ticket Granting Service Ticket request (TGS-REQ) can be initiated to the domain controller with the SPN value.


This can be done by a couple of PowerShell commands generating KRB-TGS-REQ as shown below: Figure 11 – Kerberos TGS request Consequently, the Domain Controller sends the TGS-RESP with the ticket of the service account which will be cached in the memory and can be extracted by dumping tools like Mimikatz as a .kirbi document.


This can be brute forced offline by tgsrespcrack, allowing the attacker to gain unrestricted access to the service with elevated privileges.


Stealing Credentials from Active Directory Domain Service (ntdis.dit) File As indicted earlier, once an attacker has penetrated the domain network, it will be natural to progress towards targeting critical assets, such as the Active Directory controller.


The Active Directory Database Services AD DS Ntds.dit file is one of the most overlooked attack vectors in the domain environment but can have significant impact if the attacker is able to gain the domain administrative rights leading to complete domain compromise.


The Ntds.dit file is the authoritative store of credentials for all the users in the domain joined environment, storing all the information about the users, groups and memberships, including credentials (NT Hashes) of all the users in the domain with historical passwords and user’s DPAPI backup master keys.


An Attacker with domain admin rights can gain access to the Domain Controller’s file system and acquire credentials like hashes, Kerberos tickets and other reversibly encrypted passwords of all the users joined in the domain by dumping and exfiltrating the Ntds.dit file.


These credentials can then be used by the attacker to further access resources by using attack techniques like PTH within the network since the credentials used across other shared resource could be same.


Multiple techniques can be used to dump the Ntds.dit file from the Domain Controller locally as well as remotely and extract the NTLM hashes/DPAPI backup keys for all the domain joined users.


One of the techniques is to use the Volume Shadow Copy Service using the vssadmin command line utility and then extract the Ntds.dit file from the volume shadow copy as shown below.


Figure 12 – Dumping Volume shadow copy for C drive Sensitive data on Active Directory is encrypted with the Boot Key (Syskey) stored in the SYSTEM registry hive and dumping the SYSTEM registry hive is a prerequisite as well to be able to extract all the credentials.