Publicly available Active Directory auditing frameworks like DSInternals provide PowerShell cmdlets to extract the Syskey from the SYSTEM registry hive and extract all the credentials from the Ntds.dit file.


Ntds.dit can also give access to the powerful service account within the Active Directory Domain, KRBTGT (Key Distribution Centre Service account).

Detecting Credential Stealing Attacks Through Active InNetwork Defense


Acquiring the NTLM hash of this account can enable the attacker to execute a Golden Ticket attack leading to complete domain compromise with unrestricted access to any service on the domain joined system.


Stealing Credentials Through a DCSync Attack – From Domain user to Domain Admin A DCSync attack is a method of credential acquisition which allows an attacker to impersonate the Domain Controller and can consequently replicate all the Active Directory objects to the impersonating client remotely, without requiring the user to logon to the DC or dumping the Ntds.dit file.


By impersonating the Domain Controller, the attacker could acquire the NTLM hash of the KRBTGT service account, enabling them to gain access to all the shared resources and applications in the domain joined environment.


To be able to execute this credential stealing technique, an attacker would have to compromise the user account with the required permissions, specifically DS-Replication-Get-Changes and DS-Replication-Get-Changes-All, as shown below.


Figure 13 – User with privileges Once the attacker compromises the user account with the required privileges, Pass-The-Hash attacks can be executed to spawn a command shell with the forged logon session.


Credential dumping tools like Mimikatz do this by enumerating all the user logon sessions and replacing the user credentials with the stolen usernames and NTLM hashes provided, in the current logon session.


Behind the scenes, this is executed by duplicating the current process’s access token, replacing the user credentials pointed by duplicated access token and subsequently using the modified access token to start a new process with the stolen credentials which will be used for network authentication.


This is as shown below for example user “DCPrivUser”.


Figure 14 – Pass-the-Hash attack Further, as indicated below, any subsequent NTLM authentication from the logon session will use the stolen credentials to authenticate to domain joined systems like the Active Directory Controller.


Attackers can now initiate the AD user objects Replication request to the Domain Controller using Directory Replication Services Remote Protocol (DRSUAPI).


DRSUAPI is the RPC protocol used for replication of AD objects.


With DCERPC bind request to DRSUAPI, an RPC call to DSGetNCChanges will replicate all the user AD objects to the impersonating client.


Attackers would usually target the KRBTGT account since acquiring the NTLM hash of this account will enable them to execute a Golden Ticket attack resulting in unrestricted access to domain services and applications.


Figure 15 – DCSync Attack As indicated earlier, with the NTLM hash of the KRBTGT account, adversaries can initiate a Golden Ticket attack (Pass-the-Ticket) by injecting the forged Kerberos tickets into the current session which can be used to authenticate to any service with the client that supports pass the ticket (for instance, sqlcmd.exe connection to DB server, PsExec, etc.)


Figure 16 – Golden ticket with forged Kerberos ticket Detecting Credential Stealing Attacks with Network Deception


The credential theft techniques we discussed in the previous sections are just the tip of the iceberg.


Adversaries can use many other sophisticated credential stealing techniques to take advantage of system misconfigurations and legitimate administrative tools and protocols and, at the same time, remain undetected for a longer period.


With many other event management solutions with SIEMs, used in conjunction with other network security solutions, it becomes a challenge for administrators to distinguish malicious use of legitimate tools and services from lateral movement.


Perimeter solutions have their limitations in terms of visibility once the attacker crosses the network boundary and is inside the domain environment.


It is extremely critical for organizations to protect and monitor critical network assets like the Domain Controller, Database server, Exchange Servers, build systems and other applications or services, as compromising these systems will result in significant damages.


Therefore, enterprise networks must deploy a solution to detect credential stealing attacks as they can be used to pivot to other systems on the network and move laterally once an attacker establishes an attack path to a high value target.


If the deployment of a solution within the critical zones of the network can detect the use of stolen credentials before adversaries can reach their target, the critical assets could still be prevented from being compromised.


Network Deception is one such deployment within the domain environment where, using the MITRE Shield techniques like decoy systems and network, decoy credentials, decoy accounts, decoy contents, could potentially help detect lateral movement early in the adversary’s attack path to the target asset and at the same time, report significantly low false detection rates.


The idea of deception originates from the decades old honeypot systems but, unlike those, relies more on forging trust and giving adversaries what they are looking for.


With its inbuilt proactiveness it is configured to lure attackers towards deceptive systems.


As shown in the figure below, Network Deception consists of authentic looking decoy systems placed within the domain network, specifically in the network where the critical assets are placed.


These decoy systems (could be virtual machines) are the full-fledged OS with configured applications or services and could be replicating the crucial services like Domain Controller, Exchange or DB server and other decoy machines that could lead to those systems.


The image below highlights the key foundational aspects of the Network Deception Figure 17 – Network Deception Key Aspects of Network Deception As visualized in the figure above, Network Deception comprises the following key basic facts with respect to the deployment in the domain joined environment: As a part of deployment, decoy/deceptive machines are planted within the network alongside production systems and critical assets.


These decoy systems could be real systems or virtual systems with production grade operating systems with the required setup to make them blend well with real systems.


As one of the key aspects, deceptive machines are configured to lure attackers towards the decoy services instead of the production services, thereby deflecting or misleading the attacker’s lateral movement path to the target asset.


Many of the decoy machines could replicate critical services like Domain Controller, DB servers, Exchange/SharePoint servers and other critical services or applications within the data center.


Any legitimate domain user should not be generating traffic to or communicating with the configured decoy machines unless there are some misconfigurations in the network, which need to be corrected.


Basic Decoy Network Setup Since credential theft plays an important role in a successful targeted attack, deception essentially focuses on planting fake credentials on the production and decoy endpoints at multiple places within the OS and monitoring the use of these credentials to pivot to other systems.


With respect to the network setup, the following are the key aspects, however this list is not exhaustive, and much more could be added: Replicating critical network assets and services with decoy machines: Replicating critical network services like Active Directory, DB services, etc., will make more sense since these are the most targeted systems in the network.


The decoy Active Directory should be configured with deceptive AD objects (users, groups, SPNs, etc.).


with deceptive contents for other replicated services.


Planting authentic looking decoy machines in the production network: As indicated earlier, these decoy machines could be real or virtual machines with the production grade OS placed alongside production systems in the critical infrastructure to blend in well.


These decoy machines should be joined to the decoy AD and configured with deceptive user accounts to monitor successful logon attempts to the systems.


Injecting deceptive credentials on production endpoints: Production endpoints should be injected with deceptive credentials at multiple places like LSASS process memory, Credential Manager, browser credentials, etc., to increase the possibility of these credentials being picked up and used to pivot to decoy systems in the network.


These endpoints could be public facing machines or their replicas as well.


Decoy Machine runs client applications pointing to decoy services: Decoy machines may run the client with deceptive credentials and configured to point to the decoy services.


These could be DB/FTP/Email clients and any other replicated decoy services.


Mark decoy systems as “NO LANDING ZONE”: One of the key deployment aspects of deception is to mark all the decoy systems and services as “NO LANDING ZONE”, essentially meaning no legitimate domain users should be accessing decoys and any attempts to access these systems should be closely monitored.


Some of the other setup required for effective deployment of deception is as summarized below: Figure 18 – Deceptive network setup – Basic requirements Basic Decoy Systems Setup To detect the use of deceptive credentials, setting up decoy machines is an essential part of the solution as well.


Primarily, decoy machines should enable the access attackers are looking to have during the lateral movement phase.


Decoys should also be configured to enable relevant auditing services to be able to generate events.


For instance, the following enables the account logon events to be audited: Decoy machines must be setup to run the log collector agent that can collect the access logs generated and forward them to the correlation server.


However, in the domain joined environment, it is also essential to tune the decoy machines to forward only the relevant logs to the correlation server to minimize false positives.


The below highlights some of the auditing required to be enabled on the decoy systems for effective correlation.


Figure 19 – Basic decoy setup Illustrating and Achieving Network Deception


The following sections describe some examples of how deception can be achieved in the domain network, along with a visualization of how credential theft can be detected.


Network Deception – Example 1: Injecting NETONLY credentials into LSASS process memory LSASS process memory is one of the prime targets for attackers, as well as malware armed with lateral movement capabilities since it caches a variety of credentials.


Credential extraction from the LSASS process requires opening a read handle to the process itself which is closely monitored by EDR products but there are stealthier ways around it.


One of the primary tasks towards achieving credential-based deception is to stage the deceptive credentials in LSASS process memory.


This can be accomplished on the production and decoy systems by executing a trivial credential injection code which uses the CreateProcessWithLogonW Windows API with the specified crafted credentials.


CreateProcessWithLogonW creates the new logon session using the caller process access token and spawns the process specified as a parameter in the security context of the specified deceptive credentials and it will be staged in the LSASS memory until the process runs in the background.


The below shows the example code calling the API with the specified credentials which is also visible when credentials are extracted with Mimikatz.


Figure 20 – Injecting credentials into LSASS memory One of the parameters to CreateProcessWithLogonW is “dwLogonFlags” which should be specified as LOGON_NETCREDENTIALS_ONLY as shown in the code above.


This ensures the specified credentials are used only on the network and not for local logons.


Additionally, NETONLY credentials used to create a logon session are not validated by the system.


Below is a code snapshot from credential extraction tool Mimikatz, using a similar approach to forge a logon session and replacing the credentials with the supplied ones while executing Pass-the-Hash attacks.


Figure 21 – Mimikatz code for PTH attack Network Deception – Example 2: Configure deceptive hostnames for decoy VMs Attackers or malware moving laterally inside the network might do a recon for interesting hostnames via nbtstat/nbtscan.


To deflect the lateral movement path, decoy systems can be configured with real looking hostnames that match the production systems.


These hostnames will then be visible on NetBIOS scans as shown below.


Figure 22 – Deceptive host names pointing to decoy machines


These decoy systems can also run the relevant client applications pointing to the decoy services, with authentication directed to the decoy Domain Controller in the network.


Detection of this attack path happens much earlier, however the decoy network setup keeps the adversaries engaged, helping admins to study their Tools and Techniques. Figure 23 – Decoy machines running clients pointing to decoy services A similar deception setup can also be done for the browsers where saved credentials can point to the decoy applications and services within the domain.


For instance, Chrome saves the credentials in the SQLite format on the disk which can be decrypted using DPAPI as discussed earlier sections.


The below examples demonstrate deceptive browser credentials which can lure adversaries towards the decoy services.


Figure 24 – Inserting deceptive browser credentials


In addition to some of the techniques discussed above, and many others highlighted in the previous sections, setting up deception involves much more advanced configuration of decoy systems to minimize false positives and needs to be tuned to the environment to accurately identify malicious activities.


Deception can also be configured to address multiple other phases of lateral movement activity including reconnaissance and target discovery, essentially redirecting the adversaries and giving them a path to the target.


Below is a high-level visualization of how the decoy network can look like the domain environment.


Figure 25 – Deception network setup On the occasion where one of the domain-joined or public facing systems is compromised, authentication would be attempted to other domain joined systems in the network.


If an authentication is attempted and any of the decoy systems are accessed and logged on, the use of these planted deceptive credentials should be a red flag and something which must be investigated.


The visualization below shows the flow and an event being sent to an administrator on accessing one of the decoy systems.


Figure 26 – Deceptive credentials usage for authentication in the domain One such example event of successfully logging on to the decoy system is as shown below: Figure 27 – Alert send to administrator on using deceptive credentials MITRE ATT&CK Techniques: Credential theft attacks discussed here are mapped by MITRE as below: Technique ID Technique Name Description T1003.001 LSASS Process Memory Attackers may attempt to access LSASS process memory to extract credentials as it stores a variety of credentials.


Administrative privileges are required to access the process memory.


T1003.002 SAM Database Accessing credentials from SAM database requires SYSTEM level privileges.


Stores credentials for all the local user accounts on the machine.


T1003.003 NTDS.dit file Contains credentials for all the domain users.


File is present on the DC and domain admin privileges are required to access this file.


T1003.006 DCSync Attacker can extract the credentials from the DC by impersonating the domain controller and use DRSUAPI protocol to replicate credentials from DC.


T1558.001 Golden Ticket Attackers acquiring credentials for KRBTGT account can forge the Kerberos ticket called Golden Ticket, allowing them to get unrestricted access to any system in the domain T1558.002 Silver Ticket Allows attacker to get admin level access to the service accounts by abusing Kerberos authentication T1558.003 Kerberoasting Allows attackers to extract the Kerberos tickets for service accounts from memory and brute force offline to get credentials Conclusion As credential theft attacks play a significant role in an attacker’s lateral movement, so as in-network defense for the defenders.


With attackers’ lateral movement tactics evolving and getting more stealthier, defenders will have to adapt to innovative ways of defending the critical network assets.


In–network defense strategies like Deception could prove to be a promising and forward-looking approach towards detecting and mitigating data theft attacks.


Strategic planting of decoy systems within the production network, inserting decoy credentials and decoy contents on calculative selection of endpoints and decoy systems and accurately setting up the logging and correlation via SIEMs for monitoring the use of decoy contents, could certainly detect and mitigate the attacks early in the lateral movement life cycle.


Endpoint solutions like User Entity Behavior Analytics (UEBA) and Endpoint Detection and Response (EDR) could also play a significant role in building the deception infrastructure.


For instance, one of the ways UEBA solutions could prove useful is to baseline user behavior and monitor access to credential stores on the system.


UEBA/EDR could raise the red flag on injection of forged Kerberos tickets in the memory.


This can provide user level visibility to a greater extent when integrated with SIEM, playing a crucial role in mitigating credential theft attacks.


The post Detecting Credential Stealing Attacks Through Active In-Network Defense appeared first on McAfee Blog.


Affected platforms: WindowsImpacted parties: Any organizationImpact: Controls victim’s device and collects sensitive informationSeverity level: Critical EvilExtractor (sometimes spelled Evil Extractor) is an attack tool designed to target Windows operating systems and extract data and files from endpoint devices.


It includes several modules that all work via an FTP service.


It was developed by a company named Kodex, which claims it is an educational tool.


However, research conducted by FortiGuard Labs shows cybercriminals are actively using it as an info stealer.


Based on our traffic source data to the host, evilextractor[.]com, malicious activity increased significantly in March 2023.


FortiGuard Labs observed this malware in a phishing email campaign on 30 March, which we traced back to the samples included in this blog.


It usually pretends to be a legitimate file, such as an Adobe PDF or Dropbox file, but once loaded, it begins to leverage PowerShell malicious activities.


It also contains environment checking and Anti-VM functions.


Its primary purpose seems to be to steal browser data and information from compromised endpoints and then upload it to the attacker’s FTP server.


We recently reviewed a version of the malware that was injected into a victim’s system and, as part of that analysis, identified that most of its victims are located in Europe and America.


The developer released its project in October 2022 (Figure 1) and has kept updating it to increase its stability and strengthen its module.


This article will examine the initial attack method used to deliver EvilExtractor and its functions. Figure 1.


EvilExtractor for sale on the web Initial Access The phishing email with the malicious attachment is shown in Figure 2.


It is disguised as an account confirmation request.


The attacker also tricks the victim by using an Adobe PDF icon for the decompressed file.


The PE header is shown in Figure 3.


The phishing email Figure 3.


File header of "Account_Info.exe" The execution file is a Python program packaged by PyInstaller.


We extracted it with pyinstxtractor and found that the “PYARMOR” string in its main code file “contain.pyc”, shown in Figure 4, is an obfuscating tool for Python script that makes the malware harder to be analyzed and detected.


We extracted the key and iv from _pytransform.dll and decrypted the “contain.pyc” using AES-GCM. Figure 4.


Code in "contain.pyc"


In addition to the Python program, we observed a .NET loader that can extract EvilExtractor.


Figure 5 is part of the code.


It contains Base64-encoded data, which is a PowerShell script.


This execution file is generated from the tool “PS2EXE-GUI”, which can convert PowerShell scripts to EXE Files.


Figure 5. .Net


Code for EvilExtractor EvilExtractor After decrypting the pyc file, we get the primary code of EvilExtractor.


It is a PowerShell script that contains the following modules:


Date time checking Anti-Sandbox Anti-VM Anti-Scanner FTP server setting Steal data Upload Stolen data Clear log It first checks whether the system’s date is between 2022-11-09 and 2023-04-12.


If not, it uses the following command to delete the data in PSReadline and terminate: DEL \"$env:APPDATA\Microsoft\Windows\PowerShell\PSReadline\*\" -Force –Recurse It then compares the product model to see if it matches any of the following: VirtualBox, VMWare, Hyper-V, Parallels, Oracle VM VirtualBox, Citrix Hypervisor, QEMU, KVM, Proxmox VE, or Docker, as shown in Figure 6.


It also checks the victim’s hostname against 187 names from VirusTotal machines or other scanner/virtual machines, as shown in Figure 7. Figure 6.


EvilExtractor comparing product model for match Figure 7.


Virtual environment and scanner/virtual machine checking After passing the environment check, EvilExtractor downloads three components from http://193[.]42[.]33[.]232 used for stealing data.


These files are also Python programs that are obfuscated using PyArmor.


The first is “KK2023.zip”, which is used for stealing browser data and saving it in the folder “IMP_Data”.


It can extract cookies from Google Chrome, Microsoft Edge, Opera, and Firefox.


It also collects browser history and passwords from the following browsers: The second file is “Confirm.zip”.


It is a key logger that saves data in the “KeyLogs” folder.


The last file, “MnMs.zip”, is a webcam extractor.


Its corresponding code is shown in Figure 8. Figure 8.


Download components for the Keylogger and Webcam Snapshot functions EvilExtractor also collects system information by PowerShell script, shown in Figure 9.


Figure 10 shows the concatenated data in a text file called “Credentials.txt”.


Figure 9.


PowerShell script for collecting system information Figure 10.


Content of “Credentials.txt” EvilExtractor downloads files with specific extensions from the Desktop and Download folders, including jpg, png, jpeg, mp4, mpeg, mp3, avi, txt, rtf, xlsx, docx, pptx, pdf, rar, zip, 7z, csv, xml, and html.


It also uses the command “CopyFromScreen” to capture a screenshot.


The code is shown in Figure 11. Figure 11.


Downloading files and getting a screenshot After EvilExtractor extracts all the data from the compromised endpoint, it uploads it to the attacker’s FTP server, shown in Figure 12.


The developer of EvilExtractor also provides an FTP server for those who purchase its malware. Figure 12.


Upload file to attacker’s


FTP server Kodex Ransomware EvilExtractor also has a ransomware function.


It is called “Kodex Ransomware”, as shown in Figure 13.


We extracted this PowerShell script from the .Net loader mentioned in the previous section, and the script for its ransomware is similar to the one for its stealer.


Introduction form evilextracom[.]com It downloads “zzyy.zip” from evilextractor[.]com.


Details of the unzipped file, a 7-zip standalone console, are shown in Figure 14.


Figure 15 shows it leverages “7za.exe” to encrypt files with the parameter “-p”, which means zipping files with a password.


It also generates a ransom-demanding message saved in “KodexRansom”, shown in Figure 16. Figure 14.


File in "zzyy.zip" Figure 15.


PowerShell script for Kodex Ransomware Figure 16.


Kodex ransomware's note Conclusion EvilExtractor is being used as a comprehensive info stealer with multiple malicious features, including ransomware.


Its PowerShell script can elude detection in a .NET loader or PyArmor.


Within a very short time, its developer has updated several functions and increased its stability.


This blog explains how threat actors launch an attack via phishing mail and what files are leveraged to extract the EvilExtracrtor PowerShell script.


We also detailed what functions are included, what data can be collected by EvilExtractor, and how the Kodex Ransomware works.


Users should be aware of this new info stealer and continue to be cautious about suspicious mail.


Figure 17.


Attack Chain Fortinet Protections


The malware described in this report are detected and blocked by FortiGuard Antivirus as: W32/EvilExtractor.


A!tr W32/Infostealer.


A!tr W32/Keylogger.


A!tr The FortiGuard AntiVirus service is supported by FortiGate, FortiMail, FortiClient, and FortiEDR, and the Fortinet AntiVirus engine is a part of each of those solutions.


The FortiGuard Web Filtering Service blocks the malicious URL and IP address.


If you think this or any other cybersecurity threat has impacted your organization, contact our Global FortiGuard Incident Response Team.


IOCs IP Address: 45[.]87[.]81[.]184 193[.]42[.]33[.]232 Files: 352efd1645982b8d23a841107007c8b4b024eb6bb5d6b312e5783ce4aa62b685 023548a5ce0de9f8b748a2fd8c4d1ae6c924c40acbde32e9599c868115d11f4e 75688c32a3c1f04df0fc02491180c8079d7fdc0babed981f5860f22f5e118a5e 826c7c112dd1ae80469ef81f5066003d7691a349e6234c8f8ca9637b0984fc45 b1ef1654839b73f03b73c4ef4e20ce4ecdef2236ec6e1ca36881438bc1758dcd 17672795fb0c8df81ab33f5403e0e8ed15f4b2ac1e8ac9fef1fec4928387a36d


Executive Summary LockBit 2.0 is ransomware as a service (RaaS) that first emerged in June 2021 as an upgrade to its predecessor LockBit (aka ABCD Ransomware), which was first observed in September 2019.

LockBit 20 How This RaaS Operates and How to Protect Against It


Since its inception, the LockBit 2.0 RaaS attracted affiliates via recruitment campaigns in underground forums, and thus became particularly prolific during the third quarter of calendar year 2021.


The LockBit 2.0 operators claimed to have the fastest encryption software of any active ransomware strain as of June 2021, claiming accordingly that this added to its effectiveness and ability to disrupt the ransomware landscape.


While several top-tier RaaS affiliate programs, such as Babuk, DarkSide and REvil (aka Sodinokibi) disappeared from the underground in 2021, LockBit 2.0 continued to operate and gradually became one of the most active ransomware operations.


While Conti was recognized as being the most prolific ransomware deployed in 2021 per our 2022 Unit 42 Ransomware Threat Report, LockBit 2.0 is the most impactful and widely deployed ransomware variant we have observed in all ransomware breaches during the first quarter of 2022, considering both leak site data and data from cases handled by Unit 42 incident responders.


According to data analysis of ransomware groups’ dark web leak sites, LockBit 2.0 was the most impactful RaaS for five consecutive months.


As of May 25, LockBit 2.0 accounted for 46% of all ransomware-related breach events for 2022.


And the LockBit 2.0 RaaS leak site has the most significant number of published victims, with over 850 in total.


Additionally, LockBit 2.0 has affected many companies globally, with top victims based in the U.S., Italy and Germany.


Its most highly targeted industry verticals include professional services, construction, wholesale and retail, and manufacturing.


Palo Alto Networks customers receive protections against LockBit 2.0 attacks from Cortex XDR, as well as from the WildFire cloud-delivered security subscription for the Next-Generation Firewall.


(Please see the Conclusion section for more detail.)


Table of Contents LockBit 2.0 OverviewVictimologyLeak Site DataUnit 42 Incident Response Data on LockBit 2.0LockBit 2.0 Tactics, Techniques and ProceduresLockBit 2.0 Technical DetailsLockBit 3.0Courses of ActionConclusionAppendix AAdditional Resources LockBit 2.0 Overview LockBit 2.0 is another example of RaaS that leverages double extortion techniques as part of the attack to pressure victims into paying the ransom.


In some cases, LockBit 2.0 operators have performed DDoS attacks on the victims' infrastructure as well as using a leak site.


This practice is known as triple extortion, a tactic observed in groups like BlackCat, Avaddon and SunCrypt in the past.


Like other ransomware families such as BlackByte, LockBit 2.0 avoids systems that use Eastern European languages, including many written with Cyrillic alphabets.


Unlike other RaaS programs that don't require the affiliates to be super technical or savvy, LockBit 2.0 operators allegedly only work with experienced penetration testers, especially those experienced with tools like Metasploit and Cobalt Strike.


Affiliates are tasked with gaining initial access to the victim network, allowing LockBit 2.0 to conduct the rest of the attack.


LockBit 2.0 has been observed changing infected computers’ backgrounds to a ransomware note.


The ransomware note was also used to recruit insiders from victim organizations.


The notes claimed the threat actors would pay “millions of dollars” to insiders who provided access to corporate networks or facilitated a ransomware infection by opening a phishing email and/or launching a payload manually.


The threat actors also expressed interest in other access methods such as RDP, VPN and corporate email credentials.


In exchange, they offer a cut of the paid ransom.


Victimology LockBit 2.0 targets organizations opportunistically.


The operators work with initial access brokers to save time and allow for a larger profit potential.


While typically seeking victims of opportunity, LockBit 2.0 does appear to have victim limitations.


The group announced that they would not target healthcare facilities, social services, educational institutions, charitable organizations and other organizations that “contribute to the survival of the human race”.


However, despite these claims, there have been instances of affiliates undermining these guidelines by still opting to attack industry verticals such as healthcare and education.


Organizations in Europe and the U.S. are hit more often by LockBit 2.0 than those in other countries, likely due to the high profitability and insurance payouts.


Leak Site Data During the first calendar year quarter of 2022, LockBit 2.0 persisted as the most impactful and the most deployed ransomware variant we observed in all ransomware breaches shared on leak sites.


Ransomware leak site data from the first calendar year quarter of 2022.According to leak site data analysis, LockBit 2.0 was the most impactful RaaS for five consecutive months.


As of May 25, LockBit 2.0 accounted for 46% of all ransomware-related breach events for 2022 shared on leak sites.


Additionally, the LockBit 2.0 RaaS leak site has the most significant number of published victims, with over 850 in total.


The site itself typically features information such as victim domains, a time tracker and measures of how much data was compromised. Figure 2.


LockBit 2.0 leak site extortion site.


LockBit 2.0 claims that they have demanded ransom from at least 12,125 companies, as shown in the figure below.


Source: VX-underground.


According to leak site data for LockBit 2.0, since its inception in June 2021, the RaaS has affected many companies globally, with top victims based in the U.S., Italy and Germany. Figure 4.


LockBit 2.0 geographical impact chart.


LockBit 2.0 has also impacted various victims across multiple industry verticals.


Its most highly targeted industry verticals include professional services, construction, wholesale and retail and manufacturing. Figure 5.


LockBit 2.0 impacted industry vertical chart.


When looking at leak site data across all ransomware families, we’ve observed LockBit 2.0 targeting the highest number of organizations in the following regions: JAPAC, EMEA, and LATAM.


Unit 42 Incident Response Data on LockBit 2.0 Cases handled by Unit 42 security consultants involving LockBit 2.0 since its appearance in June 2021 demonstrate shorter dwell times and less flexibility in negotiation in the beginning of FY 2022 (measured October-September) in comparison to the end of FY 2021.


The following data is broken into fiscal years and quarters based on when the threat actor breached the network, not when the activity was noticed by a client.


LockBit 2.0 has shown a decrease in dwell time in FY 2022.


From the last two quarters of FY 2021 to the first two quarters of FY 2022, there has been an average 37-day difference.


LockBit 2.0 average dwell time by fiscal quarter.


The difference in initial and final ransom demands over the past fiscal year has been converted to percentages and then averaged.


The graph below demonstrates that at the end of FY 2021, threat actors using LockBit 2.0 were much more open to negotiations of ransom amounts; during that time the ransom was dropped approximately 83% from the initial ask on average.


In comparison, we see less flexibility in FY 2022 Q1 and Q3 – threat actors only offered an average of about 30% as a price drop.


FY 2022 Q2 is not included due to lack of sufficient information.


LockBit 2.0 average difference in initial vs final ransom amount, shown as percentages.


LockBit 2.0 Tactics, Techniques and Procedures Technically speaking, we have observed LockBit 2.0 affiliates leveraging the following tactics, techniques and procedures: TA0001 Initial Access T1078 Valid Accounts Credentials that have either been reused across multiple platforms or have previously been exposed.


Additionally, this includes VPN accounts – not just domain and local accounts.


External Remote Services Affiliates have been seen brute forcing exposed RDP services and compromising accounts with weak passwords.


T1190 Exploit Public-Facing Applications Vulnerabilities such as ProxyShell (CVE-2021-34473) and improper SQL sanitization (CVE-2021-20028)


have been observed being utilized as footholds into the environment.


TA0002 Execution T1053.005 Scheduled Task/Job Scheduled Task.


LockBit 2.0 can be executed via scheduled tasks.


Command and Scripting Interpreter LockBit 2.0 is typically executed via command line arguments via a hidden window.


Windows SysInternals PsExec has been utilized for both persistence and execution purposes.


Its ability to execute processes on other systems spread the ransomware and assisted in reconnaissance activities.


TA0003 Persistence T1053.005 Scheduled Task/Job Scheduled Task.


It was quite common to see scheduled tasks used to create persistence for the ransomware executable, PsExec, and occasionally some defense evasion batch scripts.


Valid Accounts Compromised accounts may be used to maintain access to the network.


Create Account


In rare cases, LockBit 2.0 has been observed to create accounts for persistence with simple names, such as “a.” T1505.003 Server Software Component With the upsurgence of ProxyShell, webshells have become more common entry points.


TA0004 Privilege Escalation T1068 Exploitation for Privilege Escalation The ProxyShell elevation of privilege on the Exchange PowerShell Backend (CVE-2021-34523), Windows Background Intelligent Transfer Service (BITS) improperly handling symbolic links (CVE-2020-0787), and abusing the CMSTPLUA COM interface have all been seen as methods of privilege escalation.


T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control LockBit 2.0 has utilized a UAC bypass tool.


TA0005 Defense Evasion T1070 Indicator Removal on Host Indicators, such as logs in Windows Event Logs or malicious files, are typically removed using wevtutil, a batch script, or CCleaner.


T1140 Deobfuscate/Decode Files or Information Most PowerShell scripts involved in LockBit 2.0 cases are Base64 encoded.


T1484.001 Domain Policy Modification:


Group Policy Modification LockBit 2.0 has been seen using the PowerShell module InvokeGPUpdate to update the group policy.


Impair Defenses: Disable or Modify Tools Windows Defender, other anti-malware solutions and monitoring tools are disabled utilizing a process explorer tool, a batch script or a specially crafted command line script.


Hide Artifacts: Hidden Window Affiliates use hidden windows to hide malicious activity from plain sight.


TA0006 Credential Access T1003 OS Credential Dumping As seen with other ransomware cases, Mimikatz is a key player in dumping credentials but LockBit 2.0 has been occasionally seen utilizing MiniDump as well.


T1555 Credentials from Password Stores LockBit 2.0 has been seen utilizing numerous tools to dump passwords from password stores and Chrome using GrabChrome and GrabRFF.


TA0007 Discovery T1046 Network Service Discovery Both Advanced Port Scanner and NetScan have been used to discover local network infrastructure devices and services running on remote hosts.


Active Directory queries for remote systems have been performed by ADFind.


T1057 Process Discovery Process Explorer, Process Monitor and PCHunter have been utilized to discover any anti-malware or monitoring software and terminate it.


T1082 System Information Discovery LockBit 2.0 enumerates system information such as hostname, shares, and domain information.


T1614 System Location Discovery Attempts to check the language settings.


TA00008 Lateral Movement T1021


Remote Services Although Cobalt Strike has many capabilities beneficial to threat actors in ransomware attacks, it was mainly seen in LockBit 2.0 investigations acting as a command and control beacon, a method of lateral movement and a tool for downloading/executing files.


T1021.002 Remote Services: SMB/Windows Admin Shares LockBit 2.0 has been known to self-propagate via SMB.


TA0010 Exfiltration T1030 Data Transfer Size Limits In some cases, LockBit 2.0 will limit the data transfer sizes to fly under the radar of any monitoring services a client may have set up.


T1041 Exfiltration over C2 Channel MEGASync is the leading way for LockBit 2.0 affiliates to exfiltrate data from clients with it being occasionally replaced by RClone. TA0011 Command and Control T1219


Remote Access Software AnyDesk has been the most common legitimate desktop software used to establish an interactive command and control channel, with ConnectWise seen slightly less frequently.


TA0040 Impact T1486 Data Encrypted for Impact LockBit 2.0 is known for its extortion tactics, encrypting devices and demanding a ransom.


T1489 Service Stop During the defense evasion phase, anti-malware and monitoring software is often disabled.


Firewall rules have occasionally been seen being disabled as well.


LockBit 2.0 Technical Details LockBit 2.0 was developed using the Assembly and Origin C programming languages and leverages advanced encryption standard (AES) and elliptic-curve cryptography (ECC) algorithms to encrypt victim data.


It can affect both Windows and Linux OS, as the operator released a Linux version of LockBit 2.0 to target VMware ESXi hypervisor systems in October 2021, coded exclusively in the C programming language.


The LockBit group claimed that LockBit 2.0 is “the fastest encryption software all over the world” and provided a comparative table showing the encryption speed of various ransomware samples.


LockBit encryption comparative table | Source:


LockBit blog.


LockBit 2.0 also contains a self-spreading feature, clears logs and can print the ransom note on network printers until the paper runs out.


A management panel that affiliates can use to manage victims and affiliate accounts, generate new ransomware builds and generate the decryptor if the demanded ransom is paid also exists.


LockBit 2.0 management panel.


Source: ProDaft.


LockBit 2.0 operators also released an information-stealer dubbed StealBit, which was developed to support affiliates of the LockBit 2.0 RaaS when exfiltrating data from breached companies.


StealBit contains the following capabilities: Operates as a file grabber and dumps/uploads victim data to the LockBit victim-shaming site.


No reliance on third-party cloud file-sharing services, where data can be easily removed if the victim submitted a complaint.


The download speed is limited only by internet connection bandwidth, so it is possible to clone folders from corporate networks and upload them to the LockBit victim shaming blog quickly.


The operator of LockBit 2.0 has provided a comparative table speed showing the information stealer compared to other tools. Figure 10.


LockBit 2.0 download speed, according to LockBit 2.0 operator.


LockBit 3.0 There was a bug that existed in LockBit 2.0 that allowed researchers to revert the encryption process on an MSSQL database.


After the bug’s disclosure, LockBit forum members discussed how the bug will not exist in LockBit’s next iteration.


Moreover, on March 17, LockBit forum members mentioned the release of LockBit’s next version in one or two weeks.


On March 25, VX underground posted a tweet with details of this new version, dubbed LockBit Black. Figure 11.


LockBit Black post-infection desktop wallpaper (Source: VX-underground).Courses of Action Several adversarial techniques were observed in this activity and the following measures are suggested within Palo Alto Networks products and services to ensure mitigation of threats related to LockBit 2.0 ransomware, as well as other malware using similar techniques: Product / Service Course of Action Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion The courses of action below mitigate the following techniques: Exploit Public-Facing Application


[T1190], Command and Scripting Interpreter [T1059], Local Account [T1136.001], Web Shell


[T1505.003], Exploitation for Privilege Escalation


[T1068], Indicator Removal on Host [T1070], Deobfuscate/Decode Files or Information


[T1140], Disable or Modify Tools [T1562.001], Hidden Window [T1564.003], Valid Accounts


[T1078], External Remote Services [T1133], Scheduled Task


Bypass User Account Control


Group Policy Modification


[T1484.001] THREAT PREVENTION Ensure a secure Vulnerability Protection Profile is applied to all security rules allowing traffic Ensure a Vulnerability Protection Profile is set to block attacks against critical and high vulnerabilities, and set to default on medium, low, and informational vulnerabilities Ensure DNS sinkholing is configured on all anti-spyware profiles in use Ensure an anti-spyware profile is configured to block on all spyware severity levels, categories, and threats Ensure a secure anti-spyware profile is applied to all security policies permitting traffic to the internet Ensure passive DNS monitoring is set to enabled on all anti-spyware profiles in use CORTEX XSOAR Deploy XSOAR Playbook Cortex XDR - Isolate Endpoint Deploy XSOAR Playbook - Block Account Generic Deploy XSOAR Playbook - Access Investigation Playbook Deploy XSOAR Playbook - Impossible Traveler NEXT-GENERATION FIREWALLS Ensure 'Service setting of ANY' in a security policy allowing traffic does not exist Ensure application security policies exist when allowing traffic from an untrusted zone to a more trusted zone Ensure 'Security Policy' denying any/all traffic to/from IP addresses on Trusted Threat Intelligence Sources Exists Ensure that the User-ID service account does not have interactive logon rights Define at least one 'Include Network'.


Ensure that User-ID is only enabled for internal trusted interfaces Ensure that 'Include/Exclude Networks' is used if User-ID is enabled Ensure remote access capabilities for the User-ID service account are forbidden.


Ensure that the User-ID Agent has minimal permissions if User-ID is enabled CORTEX XDR PREVENT Enable Anti-Malware Protection Enable Anti-Exploit Protection Configure Host Firewall Profile Configure Behavioral Threat Protection under the Malware Security Profile Credential Access The courses of action below mitigate the following techniques: OS Credential Dumping [T1003], Credentials from Password Stores


[T1555] CORTEX XDR PREVENT Enable Anti-Exploit Protection Enable Anti-Malware Protection Discovery The below courses of action mitigate the following techniques: Network Service Scanning [T1046],


Process Discovery


[T1057], System Location Discovery


[T1614], System Information Discovery [T1082] CORTEX XDR PREVENT Configure Behavioral Threat Protection under the Malware Security Profile NEXT-GENERATION FIREWALLS Ensure that all zones have Zone Protection Profiles with all Reconnaissance Protection settings enabled, tuned, and set to appropriate actions Ensure 'Service setting of ANY' in a security policy allowing traffic does not exist Ensure 'Security Policy' denying any/all traffic to/from IP addresses on Trusted Threat Intelligence Sources Exists Ensure application security policies exist when allowing traffic from an untrusted zone to a more trusted zone CORTEX XSOAR Deploy XSOAR Playbook - Port Scan Lateral Movement The courses of action below mitigate the following techniques: Remote Services [T1021], SMB/Windows Admin Shares


[T1021.002] NEXT-GENERATION FIREWALLS Ensure remote access capabilities for the User-ID service account are forbidden.


Ensure that User-ID is only enabled for internal trusted interfaces Ensure that the User-ID Agent has minimal permissions if User-ID is enabled Ensure that the User-ID service account does not have interactive logon rights Ensure that 'Include/Exclude Networks' is used if User-ID is enabled Ensure that security policies restrict User-ID Agent traffic from crossing into untrusted zones CORTEX XSOAR Deploy XSOAR Playbook - Block Account Generic Deploy XSOAR Playbook - Access Investigation Playbook Command and Control


The courses of action below mitigate the following techniques: Remote Access Software [T1219] NEXT-GENERATION FIREWALLS Ensure that the Certificate used for Decryption is Trusted Ensure application security policies exist when allowing traffic from an untrusted zone to a more trusted zone Ensure 'Security Policy' denying any/all traffic to/from IP addresses on Trusted Threat Intelligence Sources Exists Ensure 'SSL Forward Proxy Policy' for traffic destined to the internet is configured Ensure 'SSL Inbound Inspection' is required for all untrusted traffic destined for servers using SSL or TLS Ensure 'Service setting of ANY' in a security policy allowing traffic does not exist THREAT PREVENTION Ensure DNS sinkholing is configured on all anti-spyware profiles in use Ensure passive DNS monitoring is set to enabled on all anti-spyware profiles in use Ensure a secure anti-spyware profile is applied to all security policies permitting traffic to the Internet Ensure that antivirus profiles are set to block on all decoders except 'imap' and 'pop3' Ensure an anti-spyware profile is configured to block on all spyware severity levels, categories, and threats Ensure a secure antivirus profile is applied to all relevant security policies URL FILTERING Ensure secure URL filtering is enabled for all security policies allowing traffic to the internet Ensure all HTTP Header Logging options are enabled Ensure that PAN-DB URL Filtering is used Ensure that URL Filtering uses the action of ‘block’ or ‘override’ on the URL categories Ensure that access to every URL is logged CORTEX XSOAR Deploy XSOAR Playbook - PAN-OS Query Logs for Indicators Exfiltration


The courses of action below mitigate the following techniques: Data Transfer Size Limits


[T1030], Exfiltration Over C2 Channel [T1041] THREAT PREVENTION Ensure DNS sinkholing is configured on all anti-spyware profiles in use Ensure that antivirus profiles are set to block on all decoders except 'imap' and 'pop3' Ensure an anti-spyware profile is configured to block on all spyware severity levels, categories, and threats Ensure passive DNS monitoring is set to enabled on all anti-spyware profiles in use Ensure a secure anti-spyware profile is applied to all security policies permitting traffic to the Internet


Ensure a secure antivirus profile is applied to all relevant security policies URL FILTERING Ensure that PAN-DB URL Filtering is used Ensure that access to every URL is logged Ensure that URL Filtering uses the action of ‘block’ or ‘override’ on the URL categories Ensure secure URL filtering is enabled for all security policies allowing traffic to the internet


Ensure all HTTP Header Logging options are enabled CORTEX XSOAR Deploy XSOAR Playbook - Block URL Deploy XSOAR Playbook - PAN-OS Query Logs for Indicators Deploy XSOAR Playbook - Block IP DNS SECURITY Enable DNS Security in Anti-Spyware profile NEXT-GENERATION FIREWALLS Setup NetFlow Monitoring Ensure application security policies exist when allowing traffic from an untrusted zone to a more trusted zone Ensure 'Service setting of ANY' in a security policy allowing traffic does not exist Ensure 'Security Policy' denying any/all traffic to/from IP addresses on Trusted Threat Intelligence Sources Exists Impact The courses of action below mitigate the following techniques: Data Encrypted for Impact [T1486], Service Stop [T1489] CORTEX XSOAR Deploy XSOAR Playbook - Ransomware Manual for incident response.


†These capabilities are part of the NGFW security subscriptions service Note: This is not an all-inclusive list of the protections provided by Palo Alto Networks.


This is a subset of our current Courses of Action initiative and will be updated as the project progresses.


Conclusion LockBit 2.0 and its evolution over time is a perfect example to illustrate the persistence, increasing complexity and impact brought by the ransomware landscape as a whole.


With claims of this RaaS offering the fastest encryption on the ransomware market, coupled with the fact that it has been delivered in high volume by experienced affiliates, this RaaS poses a significant threat.


LockBit’s continuation with operations and its next iteration coming up on the horizon means that organizations and their security teams need to stay vigilant in the ever-evolving threat landscape.


Palo Alto Networks detects and prevents LockBit 2.0 ransomware in the following ways: WildFire:


Cortex XDR: Identifies indicators associated with LockBit 2.0.


Anti-Ransomware Module to detect LockBit 2.0 encryption behaviors on Windows.


Local Analysis detection for LockBit 2.0 binaries on Windows.


If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call: North America Toll-Free: 866.486.4842 (866.4.UNIT42) EMEA: +31.20.299.3130 APAC:


+65.6983.8730 Japan: +81.50.1790.0200 Palo Alto Networks has shared these findings, including file samples and indicators of compromise, with our fellow Cyber Threat Alliance members.


Appendix A


In August 2021, a Russian blogger published a 22-minute interview with an alleged representative of the group behind LockBit 2.0 called “LockBitSupp” on a YouTube channel called “Russian-language open source intelligence (OSINT).”


The same Russian blogger previously published interviews with a representative of the group behind the REvil ransomware-as-a-service (RaaS), hackers and security experts.


Some key takeaways from the claims made in the interview were: The LockBit 2.0 threat actor claimed the group’s RaaS was unlikely to be rebranded since the team allegedly was a business that was honest with their customers – suggesting a supposed contrast between LockBit 2.0 and Avaddon, DarkSide and REvil affiliates.


The LockBit 2.0 ransomware disregarded keyboard layout, but it allegedly would not run on a host where the system language was set to any of the languages spoken in the Commonwealth of Independent States region.


The group did not devise attacks on companies of their choice; they simply worked with initial access to any corporate network they obtained elsewhere, since this was more profitable and saved time.


The team selected targets for ransomware attacks based on the company’s finances — the bigger, the better.


The location also did not matter.


However, team members allegedly did not attack healthcare facilities, social services, educational institutions and charitable organizations or any other organization that “contributed to the survival of the human race.”


[Note that Unit 42 case data does include indications that threat actors using LockBit 2.0 have targeted healthcare organizations at times.]


The threat actor claimed that the largest number of victims who paid ransom were company representatives who did not care about creating backup copies and did not protect their sensitive data.


According to the threat actor’s claims, companies that violated regulations about collecting and handling customer or user personal information were among those eager to pay.


The threat actor claimed that there generally were only a few companies who refused to pay ransom on principle, while most of the victims evaluated profit and loss to decide whether or not to pay a ransom.


LockBit 2.0 operators allegedly almost always offered discounts to their victims since the goal was to streamline attacks.


The threat actor claimed that the COVID-19 pandemic facilitated ransomware attacks significantly, saying it was easy to compromise home computers of employees who work remotely and use them as a springboard to access other networked systems.


Companies in Europe and the U.S. were hit with ransomware much more often than companies based in other countries allegedly because of high profit and insurance and not because of language barriers.


Ransomware operators usually recruit negotiators, who coerce victims to pay ransom, since professional penetration testers allegedly lack the time for chatter.


Additional Resources LockBit 3.0: Another Upgrade to the World’s Most Active RansomwareRansomware Groups to Watch: Emerging ThreatsAverage Ransom Payment Up 71% This Year, Approaches $1 Million2022 Unit 42 Ransomware Threat Report Highlights Get updates from Palo Alto Networks!


Sign up to receive the latest news, cyber threat intelligence and research from us


Cisco Talos has observed a threat actor deploying a previously unidentified botnet program Talos is calling “Horabot,” which delivers a known banking trojan and spam tool onto victim machines in a campaign that has been ongoing since at least November 2020.The threat actor appears to be targeting Spanish-speaking users in the Americas and, based on our analysis, may be located in Brazil.

New Horabot campaign targets the Americas


Horabot enables the threat actor to control the victim’s Outlook mailbox, exfiltrate contacts’ email addresses, and send phishing emails with malicious HTML attachments to all addresses in the victim’s mailbox.


The banking trojan can collect the victim’s login credentials for various online accounts, operating system information and keystrokes.


It also steals one-time security codes or soft tokens from the victim’s online banking applications.


The spam tool compromises Yahoo, Gmail and Outlook webmail accounts, enabling the threat actor to take control of those mailboxes, exfiltrate their contacts’ email addresses, and send spam emails.


VictimologyThe attacks predominantly target users in Mexico, with a few infections in Uruguay, Brazil, Venezuela, Argentina, Guatemala and Panama.


In analyzing the phishing emails used in the campaign, Talos identified that users in organizations across several business verticals — including accounting, construction and engineering, wholesale distributing and investment firms — have been affected.


However, the attacker uses Horabot and the spam tool in this campaign to further propagate the attack by sending additional phishing emails to the victim’s contacts, meaning Spanish-speaking users from organizations in additional verticals are likely also affected.


Attacker infrastructure dates back to Nov. 2020Talos discovered that the attacker in this campaign is using multiple hosts, including an Amazon Web Services (AWS) Elastic Compute Cloud (EC2) instance, accessed through its public URL, to host the malicious files.


During our analysis, Talos observed that a malicious server at IP address 185[.]45[.]195[.]226 hosted the PowerShell downloader script and had an open directory that the attacker eventually disabled.


Another malicious server, 216[.]238[.]70[.]224, hosted the ZIP file containing the payloads.


This is most likely a virtual private server (VPS) behind which the attacker has parked the actual command and control (C2) server, leaving us unable to identify the actual C2.


The attacker also used lookalike domains in this campaign to carry out malicious activities and evade network detection.


Based on Talos’ analysis of the domain registration information for the attacker’s infrastructure, Talos assesses with high confidence that this campaign began in November 2020 and has been ongoing through 2023.


According to WHOIS records for the domain tributaria[.]website, used in this campaign to host the attacker’s tools as well as exfiltrated data, the domain was registered in July 2022 and the registrant was based out of Brazil.


This domain name also resembled the legitimate Mexican Tax Agency domain, a tactic the attacker likely adopted to disguise malicious traffic.


The DNS requests to tributaria[.]website, as observed in Cisco Umbrella, are shown below.


In analyzing the SSL certificates of tributaria[.]website, we spotted that the certificates with serial numbers 03b6b83943ec043082a8614186921afa306b and 03eeab4d2874f31ee662ea7f602b73b05633 are shared with four other domains.


Based on our analysis of the domain registration period and the URLs associated with the four domains, they belong to the same campaign that has been ongoing since at least November 2020.Malicious domainsRegistration periodm9b4s2[.]site November 2020tributaria[.]websiteJuly


2022wiqp[.]xyzAugust 2022ckws[.]infoJanuary 2023amarte[.]store March 2023Multi-stage attack chain uses PowerShell downloader and DLL sideloadingThis campaign involves a multi-stage attack chain that begins with a phishing email and leads to payload delivery through the execution of a PowerShell downloader script and sideloading to legitimate executables.


The infection starts with an income tax-themed phishing email written in Spanish, disguising itself as a tax receipt notification and enticing users to open the attached malicious HTML file.


Sample phishing email.


When a victim opens the HTML file attachment, an embedded URL is launched in the victim’s browser, redirecting to another malicious HTML file from an attacker-controlled AWS EC2 instance.


The content displayed on the victim’s browser lures them to click an embedded malicious hyperlink which downloads a RAR file.


Disguised malicious web page.


The RAR file contains a batch file with a CMD extension that is executed when the victim opens the contents of the file.


The batch file downloads the PowerShell downloader script from an attacker-controlled server and executes it through the PowerShell commands.


The PowerShell downloader script will download a ZIP file that contains the payload DLLs and a few legitimate executables and DLLs.


It creates Windows shortcut files configured to run the payloads in the startup folder of the victim’s machine and restarts the machine after 10 seconds.


After the victim’s machine is rebooted, the malicious Windows startup files run the payloads by sideloading them to the legitimate executables and downloading and executing two other PowerShell scripts from a different attacker-controlled server.


One is the PowerShell downloader script, which the attacker attempts to execute to re-infect the victim’s machine, and another is Horabot.


Three-layer infection chain delivers and detonates the payloadsMalicious batch file downloads the PowerShell downloaderThe RAR file containing a malicious batch file with a .cmd extension is downloaded to the user’s machine.


Per the instructions on the HTML page, if the user opens the CMD file, the malicious batch script executes an embedded PowerShell command to download the next-stage PowerShell script from the server and execute it on the victim’s machine.


Downloader batch script.


PowerShell script downloads the payloadsThe malicious PowerShell downloader script launches several processes that download the payloads and reboots the victim’s machine.


The script is heavily obfuscated with random symbols that substitute the instructions during the run-time and base64-encoded strings.


In the initial stage of the execution, the script decodes the base64-encoded strings and initializes them.


It executes a function that uses alphanumeric characters and the special character “_” to generate a random name and creates a folder with the random name in the root directory of the victim’s machine.


The random name generated by the sample during our analysis was “_upyqta2_J”.


The script uses this random name eventually to create other folders and files.


The script creates two other malicious batch scripts with the extension .cmd


in the folder “/Users/Public.”


Then it creates two Windows shortcut files in the Windows startup folder using the Internet Explorer application icon and the target paths pointing to the two dropped batch scripts.


<deskto_name>S.cmd and <desktop_name>Sy.cmd are the naming conventions used.


A snippet of the PowerShell downloader script.


The script also creates three more Windows shortcut files in the victim’s machine startup folder, with the details of the target path pointing to the folders where the payloads are eventually downloaded.


The attacker used the Internet Explorer icon for the dropped shortcut files.


Talos compiled a table showing the malicious Windows shortcut files and their relative paths with the command line arguments.


Shortcut filesRelative pathCommand line arguments_upyqta2_JAA.lnk..\..


\..\_upyqta2_J\_upyqta2_Ji7.exe_upyqta2_JAT.lnk ..


\_upyqta2_J\_upyqta2_J.exeC:\_upyqta2_J\_upyqta2_J.at_upyqta2_JEX.lnk..\..


\_upyqta2_J\_upyqta2_J.exeC:\_upyqta2_J\_upyqta2_J.ai_upyqta2_Jy.lnk..\..


\Public\DESKTOP-UT9NJ4Sy.cmd_upyqta2_J.lnk..\..


\Public\DESKTOP-UT9NJ4S.cmd Next, the script downloads a malicious ZIP file — “m.zip” — from a server using the URL “hxxp[://]216[.]238[.]70[.]224/20/t/e/m.zip” to the random name folder.


The script renames the downloaded file with a random name and deflates its contents.


The deflated contents are renamed using random characters, then the malicious ZIP file is deleted.


The script also writes the path of the executable file, “_upyqta2_Ji7.exe”, to the class’s registry key “HKEY_CURRENT_USER\software\Classes\ms-settings\shell\open\command” and restarts the victim’s machine after 10 seconds using the command “shutdown /r /t


The deflated contents of the malicious ZIP file are shown in the below table with their description.


Files dropped Description_upyqta2_J.aiCompiled AutoIt script_upyqta2_J.atCompiled AutoIt


script_upyqta2_J.exeAutoIt interpreter_upyqta2_J.iaEncrypted trojan DLL_upyqta2_J.mdatEncrypted Spam tool DLL_upyqta2_Ji7.exeKinit.exe, a legitimate executablejli.dllBanking trojan MSVCR100.dllLegitimate DLLWebView2Loader.dllLegitimate DLLMalicious shortcut files detonate the payloads after system restartAfter the PowerShell downloader reboots the victim’s machine, the malicious Windows shortcut files dropped in the Windows startup folder are run, executing the payloads used in the attack.


This section describes the behavior of each of the shortcut files._upyqta2_JAA.lnkThis link file “_upyqta2_JAA.lnk” will sideload a malicious DLL called “jli.dll,” a banking trojan, by executing “_upyqta2_Ji7.exe,” which is actually a legitimate copy of “kinit.exe” that the PowerShell downloader script drops._upyqta2_JEX.lnkThis link file executes the compiled AutoIt


script “_upyqta2_J.ai” by running the executable “ _upyqta2_J.exe”, which is a legitimate AutoIt interpreter.


The AutoIt script decrypts the encrypted “_upyqta2_J.ia” and drops the DLL “_upyqta2_J.ia.a1” with a spoofed file extension that has a hardcoded malicious function “A040822_1”.


Then, the AutoIt script will sideload the DLL “_upyqta2_J.ia.a1” to the AutoIt interpreter process and execute the malicious function “A040822_1” with the parameter “STRUCT.”


The decrypted malicious DLL “_upyqta2_J.ia.a1” is another copy of the banking trojan with additional stealer capabilities such as keylogging, copying of clipboard data, screenshot capturing and mouse tracking.


A snippet of the AutoIt code _Upyqta2_J.ai_upyqta2_JAT.lnkThis link file performs the same steps as “_upyqta2_JEX.lnk” by executing the AutoIt script “_upyqta2_J.at” to decrypt “ _upyqta2_J.mdat” and create the DLL “_upyqta2_J.mdat.a1” with a spoofed extension.


Then, the AutoIt script sideloads the DLL to the AutoIt interpreter process and executes the malicious function “B080223_AT” with the parameter “STRUCT”.


The malicious DLL “_upyqta2_J.mdat.a1” is a spam tool with information-stealing capability.


A snippet of the AutoIt code _


This link file executes one of the dropped batch files, “<desktop-name>S.cmd.”


The batch file executes an embedded PowerShell command to download the PowerShell downloader script from the attacker-controlled server using the URL hxxp[://]tributaria[.]website/esp/12/151222/up/up” and executes it.


The attacker uses the PowerShell downloader to reinfect the victim’s machine.


link file executes another dropped batch file, “<desktop_name>Sy.cmd”, which executes a PowerShell command to download and run the Horabot “au” using the URL hxxp[://]tributaria[.]website/esp/12/151222/au/au.


PayloadsTalos found that the payloads employed by the attacker in this campaign are designed to steal sensitive information, evade detection and disseminate additional phishing emails to the victim’s contacts.


The banking trojan targets the victim’s sensitive information, such as login credentials and financial transaction security codes, and logs keystrokes and manipulates the victim machine’s clipboard data.


The trojan also has anti-analysis and anti-detection capabilities to evade the sandbox and virtual environments.


The spam tool and newly identified Horabot are employed in the attack to compromise the victim’s mailboxes, steal their contact’s email addresses, and send phishing emails to the victim’s contacts.


Banking trojan targets victim’s login credentials and financial informationThe banking trojan identified in this campaign, a 32-bit Windows DLL written in the Delphi programming language and packed with Themida packer, can collect system information, credentials and user activity.


This trojan is based on a tool called Delphi_Remote_Access_PC, which is publicly available on GitHub.


It also uses similar techniques as Brazilian banking trojans reported by other security researchers at ESET and Check Point in the past.


The trojan performs surveillance on the victim’s machine by collecting system information such as hostnames, IPv4 address, operating system version, disk volume information, disk size and anti-virus software information, and gets the system’s default language.


The reconnaissance data is exfiltrated to the attacker-controlled server through an HTTP POST request to the URL in the below format.hxxp[://]216[.]238[.]70[.]224/20/a/20/index[.]php?AT=<username>%20<hostname>%20<Operating system version>&MD=<Antivirus


software>


The trojan has remote desktop management capabilities such as creating and deleting directories on the victim’s machine, checking if a file on the victim’s filesystem exists and gets the file’s attributes, collecting size and version information, and downloading files from a URL.


It also has information-stealing capabilities, such as logging keystrokes via polling and application hooks, capturing screenshots, manipulating the victim’s machine clipboard and tracking the mouse's events.


It monitors the open application windows on the victim’s desktop, overlays fake windows, and manages the pop-up windows to steal sensitive information.


These pop-ups are stored in TFORMS in the RCData section of the executable.


The below screenshots show some of the forms configured to steal one-time security codes or soft tokens from the victim’s online banking web applications.


Banking trojan forms in the binary resource section.


Talos spotted hardcoded SQL commands in the trojan binary designed to collect login data from the Google Chrome user profile folders by writing it to a database source file called “login_data.sql”, and creating SQL queries to produce the database tables to store the stolen data.


The dynamic analysis behavior in our analysis environment showed us that the database source file “login_data.sql” contains the login details and the associated URLs from the Google Chrome database files.


Database table containing the victim’s credentials.


The trojan has several anti-analysis and anti-virtual machine (VM) techniques built-in to avoid analysis in automated sandboxes and to thwart debugging:


Detects the presence of debuggers through APIs IsDebuggerPresent, and OutputDebugStringW, and checks for system breakpoints.


Creates processes enabling the debug privileges by adjusting the process token “Debug,” readings the Process Environment Block, and queries the DebugPort to check if the malware is being debugged.


Checks for the existence of the anti-virus products such as AVG and Avast by checking for the DLLs avghookx.dll, avghooka.dll and snxhk.dll.


Detects the sandbox environments such as SunBelt and Joe sandboxes.


Checks the registry keys to detect virtual environments such as VMWare, Virtual Box, Wine, Microsoft Hyper-V or Windows Virtual PC.A spam tool acts as another payload in this campaign, enabling the attacker to take over the victim’s other email accounts and send spam emails to the contacts found within them.


The spam tool is a 32-bit DLL written in Delphi and, when run on the victim’s machine, will attempt to compromise the victim’s login credentials for webmail services such as Yahoo, Gmail, and Hotmail.


Upon compromising the credentials, the spam tool takes full control of the victim’s email account, creates spam messages and sends them to the email IDs found in the victim’s mailbox.


The tool also exfiltrates the email address to the C2 server using an HTTP POST request.


The spam tool also showed us information-stealing capabilities such as logging keystrokes, capturing screenshots and tracking or intercepting the mouse events on the victim’s machine.


The decryption function decrypts the URL pointing to the attacker-controlled server.


New Horabot deployed to spread the infectionTalos discovered Horabot, an Outlook Phishing botnet program written in PowerShell.


It has embedded Visual Basic code that enables the threat actor to control the victim’s Outlook mailbox, exfiltrate contacts’ email addresses, and send phishing emails with malicious HTML attachments to all addresses in the victim’s mailbox.


Phishing emails are themed as a tax receipt or service invoice and the attacker is using the email subject and body, in the format shown below:Phishing email subject:Se adjunta la factura del servicio <calendar month in Spanish> :ATT <dd/mm/yyy> <hh:mm:ss> <AM/PM>Comprobante Fiscal Digital <calendar month in Spanish> :ATT <dd/mm/yyy> <hh:mm:ss> <AM/PM>


Phishing email body: consulate los datos adjuntos, por favor.


<dd/mm/yyy> <hh:mm:ss> <AM/PM>The end game of the attacker is to deliver the banking trojan to steal the victim's creds and financial data, along with it they are delivering Horabot and separate spam tool to propagate the infection by sending the phishing emails to all of the validated email IDs in the victim's mailbox.


Attacker is using this technique to minimise the chances of their phishing infracture being tracked.


Horabot, during its initial phase of execution, initializes the victim’s desktop Outlook application by loading “Microsoft.


Office.


Interop.


Outlook” namespace to the PowerShell instance to create the Outlook application object for loading the MAPI namespace.


The script also initializes an array to store the stolen email addresses and creates a folder called “a160323” in “C:\Users\Public\.” as an infection marker.


A function that initializes the outlook application object.


After initialization, the script looks for the Outlook data files from the victim profile’s Outlook application data folder.


It loads and accesses the victim’s address book and contacts if they exist.


It enumerates all folders and emails in the victim’s Outlook data file and extracts email addresses from the emails’ sender, recipients, CC and BCC fields.


During this process, the script checks the “AddressEntryUserType” object values to determine if the email address is one of the types listed below:Exchange agentExchange organizationExchange distribution listExchange public folderAddress that belongs to the same or different exchange forestAddress that uses Lightweight Directory Access Protocol


[LDAP]Address that uses Simple Mail Transfer Protocol


[SMTP]Function that enumerates and collects email addresses.


The script has an email address format validation function that compares all of the extracted email addresses with a regular expression.


After they are successfully validated, the addresses are added to the email address collection array.


A function that validates email address format.


Next, the script writes the extracted email addresses from the array to a file called “.Outlook” created by the script in the roaming user profile’s


Microsoft application data folder.


Then the script encodes the email addresses in the “.Outlook” file to a data stream.


Using the GetRequestStream function, the script requests a data stream from the C2 server through the URL hxxp[://]139[.]177[.]193[.]74/esp/12/151222/au/tst/index[.]php?list and upon the successful response, the encoded email addresses are exfiltrated.


A function that exfiltrates email addresses.


After exfiltrating the email addresses, the script creates a folder “fb” in the Public user folder and creates an HTML file in it, named “adjuntos_1503.html” in our sample analysis.


Then the script downloads the contents of an HTML file stored in an attacker-controlled server and writes it to the HTML file dropped in the “fb” folder.


The HTML file has an embedded malicious URL “hxxps[://]facturacionmarzo[.]cloud/e/archivos[.]pdf[.]html” in its metadata section.


Next, the script constructs an email with a hardcoded subject and body and attaches the HTML file from the “fb” folder.


Then the phishing email is sent to the list of extracted email addresses one at a time, deleting the “fb” folder to cover its paths and avoid detection.


A function that sends phishing emails.


CoverageCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post.


Try Secure Endpoint for free here.


Cisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks.


Cisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign.


You can try Secure Email for free here.


Cisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.


Cisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.


Umbrella, Cisco's secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network.


Sign up for a free trial of Umbrella here.


Cisco Secure Web Appliance (formerly Web Security Appliance) automatically blocks potentially dangerous sites and tests suspicious sites before users access them.


Additional protections with context to your specific environment and threat data are available from the Firewall Management Center.


Cisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network.


Open-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.


Snort SIDs for this threat are 61839-61856 for Snort 2 and 300569-300577 for Snort 3.ClamAV detections are available for this threat:Txt.Loader.


Trojan.


Tool.


HorabotSpamTool-10003092-0IOCsIndicators of Compromise associated with this threat can be found here.


By Edmund Brumaghin, Joe Marshall, and Arnaud Zobec.

Vice Society leverages PrintNightmare in ransomware attacks


Executive SummaryAnother threat actor is actively exploiting the so-called PrintNightmare vulnerability (CVE-2021-1675 / CVE-2021-34527) in Windows' print spooler service to spread laterally across a victim's network as part of a recent ransomware attack, according to Cisco Talos Incident Response research.


While previous research found that other threat actors had been exploiting this vulnerability, this appears to be new for the threat actor Vice Society.


Talos Incident Response's research demonstrates that multiple, distinct threat actors view this vulnerability as attractive to use during their attacks and may indicate that this vulnerability will continue to see more widespread adoption and incorporation by various adversaries moving forward.


For defenders, it is important to understand the attack lifecycle leading up to the deployment of ransomware.


If users have not already, they should download the latest patch for PrintNightmare from Microsoft.


In this post, we'll analyze the various TTPs used in a recent ransomware attack from Vice Society that leveraged this vulnerability.


Many of these same TTPs are commonly observed in other ransomware attacks, such as a previously published analysis of a WastedLocker attack.


Who is Vice Society?Vice Society is a relatively new player in the ransomware space.


They emerged in mid-2021 and have been observed launching big-game hunting and double-extortion attacks, primarily targeting small or midsize victims.


This group also has notably targeted public school districts and other educational institutions.


As they are a new actor in this space, Vice Society's TTPs are difficult to quantify.


However, based on incident response observations, they are quick to leverage new vulnerabilities for lateral movement and persistence on a victim's network.


They also attempt to be innovative on end-point detection response bypasses.


As with other threat actors operating in the big-game hunting space, Vice Society operates a data leak site, which they use to publish data exfiltrated from victims who do not choose to pay their extortion demands.


Below is an example screenshot of this site.


Recent attack methodologyThroughout the course of our analysis of a recent human-operated ransomware attack associated with Vice Society, we observed several notable tactics, techniques, and procedures (TTPs) used throughout each stage of the attack lifecycle.


Some of the most interesting characteristics of this attack were:The use of utilities such as proxychains and impacket during the post-compromise phases of the attack lifecycle.


The targeting of backups to prevent recovery following ransomware deployment.


The degradation of ESXi servers used for virtualization in victim environments.


The use of a DLL that takes advantage of the recently discovered PrintNightmare vulnerability for which Microsoft has previously released a security update.


Attempts to bypass native Windows protections for credential theft and privilege escalation.


Below are some key examples of the TTPs used in this attack as they relate to the Mitre ATT&CK Framework.


DiscoveryATT&CK Technique: System Owner/User Discovery (T1033)ATT&CK Technique: Account Discovery (T1087)ATT&CK Technique: Domain Trust Discovery (T1482)Once initial access was achieved, several techniques were observed being leveraged to conduct post-compromise discovery and reconnaissance within the environment.


We observed attempts to access the backup solution employed in the environment, likely to prevent the organization from successfully recovering without paying the demanded ransom.


The "sudo" command was used to obtain credentials associated with a commercial backup solution, likely trying to gain access to backups present within the environment.sudo -s


-k -p


[Backup Prompt] whoamiWe also observed the use of impacket, a common network protocol manipulation tool to enumerate the environment and obtain additional information about the Active Directory configuration in place.


This is typically done to identify high-value targets that may be attractive, as attacks attempt to maximize their sphere of influence over as much of the environment as possible prior, eventually deploying ransomware and making their presence known.


Below are some examples of the command line syntax used for the performance of this activity.cmd.exe /q


/c net group enterprise admins /domain


1> \\127.0.0.1\admin$\__[STIRNG] 2>&1cmd.exe /q


/c net group domain admins /domain


1> \\127.0.0.1\admin$\__[STRING] 2>&1 We observed enumeration of the domain trust relationships present within the environment.


The adversaries used the "nltest" command for this purpose.


/dclist


linux


[HOSTNAME]ExecutionATT&CK Technique: Command and Scripting Interpreter:


Windows Command Shell (T1059.003)ATT&CK Technique: Command and Scripting Interpreter: PowerShell (T1059.001)ATT&CK Technique: Windows Management Instrumentation (T1047)ATT&CK Technique: System Services: Service Execution (T1569.002)Similar to what was observed during the post-compromise reconnaissance phase of the attack, the adversary used impacket to execute Windows Management Instrumentation (WMI) to achieve command execution on other systems present in the environment.


The attacker also used the "proxychains" utility, which is often employed to redirect network traffic during penetration testing, red teaming, and other offensive operations.


cmd.exe /q


/c proxychains ~/impacket/examples/wmiexec.py -hashes [SHA256 HASH]


[USERNAME]@[IP ADDRESS] 1> \\127.0.0.1\admin$\__[STRING] 2>&1We also observed the adversary using Windows Batch files to execute PSExec.


In this case, PSExec remotely authenticated and executed PowerShell on remote systems within the environment.


cmd.exe /c


C:\s$\0.bat PsExec.exe -d \\[HOSTNAME] -u


[DOMAIN]\[USERNAME] -p


[PASSWORD] -accepteula -s


cmd /c


powershell.exe -ExecutionPolicy


Bypass -file \\[HOSTNAME]\s$\p.ps1


There were also artifacts in the environment that indicate that the recently disclosed PrintNightmare vulnerability may have been used during this attack.


A DLL associated with PrintNightmare was observed on systems within the environment as described in the section "Credential Access.


"PersistenceATT&CK Technique: Create or Modify System Process (T1543)In many big-game hunting ransomware attacks, upon achieving initial access into the target environment, the adversary will first attempt to achieve persistence so that they can regain access to the environment if they are detected or their initial point of access is otherwise removed.


In this particular case, we observed the adversary leveraging a Windows Service to execute PowerShell to stay persistent in the environment.


The Windows service was configured with the following options:Service Type: user mode service Service Start Type: demand start Service Account:


LocalSystem Service Name: Updater Service Filename: %COMSPEC% /C


start /b


%WINDIR%\System32\WindowsPowershell\v1.0\powershell -noP


-sta


-w 1 -enc


[BASE64 ENCODED BLOB]As can be seen above, the PowerShell being executed was Base64 encoded.


The decoded PowerShell instructions are below:This PowerShell is responsible for the performing the following tasks:Disabling PowerShell logging.


Bypassing AMSI protection for PowerShell.


Downloading, decrypting, and executing a backdoor payload from an attacker-controlled server.


By implementing this persistence, the attacker can regain access to the environment if the targeted organization destroys their initial means of access.


Lateral movementATT&CK Technique: Remote Services (T1021)ATT&CK Technique: Lateral Tool Transfer (T1570)Once operational within the target environment, attackers will typically perform reconnaissance, identifying additional target systems, and then move laterally from system to system as they attempt to escalate privileges and then, ultimately, deploy ransomware on many systems in the environment.


During the investigation, we observed the attacker leveraging Windows Remote Desktop Connections to pivot to additional systems in the environment.


This was typically performed via the following command-line syntax:C:\Windows\system32\mstsc.exe /v


[HOSTNAME]The attacker also attempted to execute PowerShell scripts on remote systems in the environment while moving system-to-system.


Bypass -file \[IPADDRESS]\share$\p.ps1 During the attack, adversaries copied and executed the aforementioned PowerShell script on multiple systems across the environment.


Credential accessATT&CK


Technique: OS Credential Dumping (T1003)ATT&CK Technique: OS Credential Dumping: LSASS Memory (T1003.001)The actor attempted to extract credentials from the victim in two ways: Accessing the active directory global catalog file ntds.dit and utilizing comsvcs.dll. Comsvcs.dll is a well-known way to extract LSASS (Local Security Authority Subsystem Service) data.


By invoking comsvcs.dll with rundll32.exe, an adversary can create a dump of any process.


This is a classic and clever living-off-the-land binary (LoLBin) tactic that avoids popular credential extraction tools like Mimikatz, which may alert defenders.


We also observed attempts to dump the NTDS.dit, which is a database of Active Directory information.


Examples of the command-line syntax used in these cases are below.cmd.exe /q /c


powershell ntdsutil.exe '


ac i ntds' 'ifm' 'create full c:\temp' q q 1> \\127.0.0.1\admin$\__[STRING] 2>&1cmd.exe /q


/c powershell ntdsutil.exe '


ac i ntds' 'ifm' 'create full c:\temp_logs' q q 1> \\127.0.0.1\admin$\__[STRING]5 2>&1The actor also utilized PrintNightmare, a recently published series of vulnerabilities by Microsoft that would allow remote code execution when an improper print spooler performs privileged file operations.


This attack vector is notable in the ubiquitous nature of print services in all modern corporate enterprises.


Microsoft has recently released a security patch for PrintNightmare — we encourage all enterprises to patch immediately to avoid exploitation.


Defense evasionATT&CK Technique: Indicator Removal on Host: Clear Windows Event Logs (T1070.001)ATT&CK Technique: Modify Registry (T1112)ATT&CK Technique: Impair Defenses or Modify Tools (T1562.001)Throughout the attack, the adversary made multiple attempts to evade detection and subvert security controls in place as described throughout previous sections of this blog post.


We also observed the attacker attempting to clear the contents of security logs on compromised systems.


The following command-line syntax was observed being used to clear the System, Security and Application Windows Event Logs.


c:\windows\system32\wevtutil.exe cl systemc:\windows\system32\wevtutil.exe cl securityc:\windows\system32\wevtutil.exe cl


applicationThe adversary was also observed remotely modifying the Windows Registry on remote systems to disable remote administration restrictions to facilitate lateral movement and privilege escalation activities.


Disabling this security control allows attackers to leverage pass-the-hash attacks and hinder RDP's security on systems.cmd.exe /q /c


powershell new-itemproperty -path hklm:\system\currentcontrolset\control\lsa -name disablerestrictedadmin -value 0


-propertytype dword -force 1> \\127.0.0.1\admin$\__[STRING] 2>&1


We also observed the attacker disabling Windows Defender by modifying the Windows Registry on compromised systems.


This was performed using the following commands:C:\Windows\system32\reg.exe delete HKLM\Software\Policies\Microsoft\Windows Defender /fC:\Windows\system32\reg.exe add HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection /v


DisableRoutinelyTakingAction /t


REG_DWORD /d


1 /f C:\Windows\system32\reg.exe add HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet /v


DisableBlockAtFirstSeen /t


1 /f We also observed the threat actor attempting to evade detection while enumerating the environment using an AMSI bypass, which is often used as a way to evade detection by endpoint security solutions that may be present on compromised systems.


In this case, the Windows Command Processor was used to invoke PowerShell, which then leveraged Invoke-Expression (IEX) for this purpose.cmd.exe /Q /c powershell.exe -exec bypass -noni -nop


-w 1 -C IEX ([Net.ServicePointManager]::ServerCertificateValidationCallback={$true}try{[Ref].Assembly.


GetType('Sys'+'tem.


Am'+'siUt'+'ils').GetField('am'+'siIni'+'tFailed','NonP'+'ublic,Sta'+'tic').SetValue($null,$true)}catch{}quser) ExfiltrationATT&CK Technique: Exfiltration Over Alternative Protocol (T1048)Over the past couple of years, we have observed an increasing number of ransomware threat actors adopting a double-extortion methodology in their attacks.


In these attacks, adversaries attempt to exfiltrate large quantities of sensitive information for the purposes of further extortion against victims.


This data, once exfiltrated, is published to attacker-controlled websites that are commonly referred to as "data leak sites" in situations where the victim chooses not to pay the ransom demand.


In this attack, we observed the adversary attempting to exfiltrate sensitive information over SMB (TCP/445) directly from a compromised domain controller.


This was likely chosen as a way to bypass egress filtering that may have been in place at the perimeter of the victim environment.


Defender takeawaysIt can be difficult to account for the myriad ways an attacker can compromise and inflict malware on a network.


Given the techniques demonstrated here, it can feel overwhelming as a defender to account for every avenue of attack.


The good news is that there are several lessons we can learn about this incident: Logging is critical for forensics — ensure there is reliable and secure logging infrastructure in place.


Utilize multi-factor authentication to make credential theft more difficult to exploit.


Look at egress filtering for firewalls and ensure malicious traffic cannot call out to adversary infrastructure.


Utilize an endpoint detection response platform that detects LoLBin abuse and malware implants.


Keep up-to-date and offline backups that cannot be targeted by adversaries.


ConclusionAs demonstrated throughout this post, attackers often make use of a variety of tactics, techniques, and procedures as they work to accomplish their mission objectives.


In some instances, there is significant overlap and similarities between the approaches taken by distinct threat actors.


They often leverage dual-use tools for various purposes to minimize their footprint and evade detection.


Likewise, adversaries are constantly refining their approach to the ransomware attack lifecycle as they strive to operate more effectively, efficiently, and evasively.


The use of the vulnerability known as PrintNightmare shows that adversaries are paying close attention and will quickly incorporate new tools that they find useful for various purposes during their attacks.


Multiple distinct threat actors are now taking advantage of PrintNightmare, and this adoption will likely continue to increase as long as it is effective.


It is important that defenders be aware of the various TTPs being used throughout the attack lifecycle so that they are prepared to prevent, detect, and respond to nefarious activity that may be indicative of a successful compromise of their environment.


Failure to do so could result in widespread operational disruption, reputational damage, and the loss of confidentiality of sensitive information.


CoverageWays our customers can detect and block this threat are listed below.


Cisco Secure Endpoint is ideally suited to prevent the execution of the malware detailed in this post.


New users can try Cisco Secure Endpoint for free here.


Cisco Secure Firewall and Meraki MX can detect malicious activity associated with this threat.


Cisco Secure Malware Analytics helps identify malicious binaries and build protection into all Cisco Security products.


Cisco Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network.


Additional protections with context to your specific environment and threat data are available from the Cisco Secure Firewall Management Center.


Open Source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.


The following SIDs have been released to detect this threat: 57876, 57877.Indicators of Compromise (IOCs)The following IOCs have been observed being associated with the attack.


PrintNightmare DLL:


This blog post details the post-compromise tradecraft and operational tactics, techniques, and procedures (TTPs) of a Chinese espionage group we track as UNC215.

UNC215 Spotlight on a Chinese Espionage Campaign in Israel


While UNC215’s targets are located throughout the Middle East, Europe, Asia, and North America, this report focuses on intrusion activity primarily observed at Israeli entities.


This report comes on the heels of the July 19, 2021, announcements by governments in North America, Europe, and Asia and intragovernmental organizations, such as the North Atlantic Treaty Organization (NATO), and the European Union, condemning widespread cyber espionage conducted on behalf of the Chinese Government.


These coordinated statements attributing sustained cyber espionage activities to the Chinese Government corroborate our long-standing reporting on Chinese threat actor targeting of private companies, governments, and various organizations around the world, and this blog post shows yet another region where Chinese cyber espionage is active.


Threat Detail


In early 2019, Mandiant began identifying and responding to intrusions in the Middle East by Chinese espionage group UNC215.


These intrusions exploited the Microsoft SharePoint vulnerability CVE-2019-0604 to install web shells and FOCUSFJORD payloads at targets in the Middle East and Central Asia.


There are targeting and high level technique overlaps with between UNC215 and APT27, but we do not have sufficient evidence to say that the same actor is responsible for both sets of activity.


APT27 has not been seen since 2015, and UNC215 is targeting many of the regions that APT27 previously focused on; however, we have not seen direct connection or shared tools, so we are only able to assess this link with low confidence.


In addition to data from Mandiant Incident Response and FireEye telemetry, we worked with Israeli defense agencies to review data from additional compromises of Israeli entities.


This analysis showed multiple, concurrent operations against Israeli government institutions, IT providers and telecommunications entities beginning in January 2019.


During this time, UNC215 used new TTPs to hinder attribution and detection, maintain operational security, employ false flags, and leverage trusted relationships for lateral movement.


We believe this adversary is still active in the region.


Attack Lifecycle Between 2019 and 2020, Mandiant responded to several incidents where Microsoft SharePoint vulnerability CVE-2019-0604 was used to deliver web shells, and then FOCUSFJORD payloads to select government and academic targets in the Middle East and Central Asia.


After gaining initial access, the operators conduct credential harvesting and extensive internal network reconnaissance.


This includes running native Windows commands on compromised servers, executing ADFind on the Active Directory, and scanning the internal network with numerous publicly available tools and a non-public scanner we named WHEATSCAN.


The operators made a consistent effort to delete these tools and remove any residual forensic artifacts from compromised systems.


In another incident response investigation, UNC215 pivoted to multiple OWA servers and installed web shells.


In the following days, the operators interacted with these web shells from internal IP addresses, attempting to harvest credentials.


After identifying key systems within the target network, such as domain controllers and Exchange servers, UNC215 moved laterally and deployed their signature malware FOCUSFJORD.


UNC215 often uses FOCUSFJORD for the initial stages of an intrusion, and then later deploys HYPERBRO, which has more information collection capabilities such as screen capture and keylogging.


While UNC215 heavily relies on the custom tools FOCUSFJORD and HYPERBRO, Chinese espionage groups often have resource sharing relationships with other groups, and we do not have enough information to determine if these tools are developed and used exclusively by UNC215. Figure 1: Attack Lifecycle Tradecraft and Operational Security We identified numerous examples of efforts by UNC215 to foil network defenders by minimizing forensic evidence left on compromised hosts, exploiting relationships with trusted third parties, continuously improving the FOCUSFJORD backdoor, concealing command and control (C2) infrastructure, and incorporating false flags.


Reducing Forensic Evidence on Disk UNC215 consistently cleaned up evidence of their intrusion after gaining access to a system.


This type of action can make it more difficult for incident responders to reconstruct what happened during a compromise.


The operators deleted tools used for credential harvesting and internal reconnaissance including a custom scanner dubbed WHEATSCAN after use.


The first FOCUSFJORD payload delivered to a system contains a blob that includes C2 and other configuration data.


On initial execution, FOCUSFJORD writes its encrypted C2 configuration into the system’s registry, sets up a persistence mechanism and then rewrites itself on disk without the embedded configuration and with limited functionality to only read configuration data.