The team used the krbtgt account hash throughout the rest of their assessment to perform golden ticket attacks [T1558.001] in which they forged legitimate TGTs.


The team also used the asktgt command to impersonate accounts they had credentials for by requesting account TGTs [T1550.003].

CISA Red Team Shares Key Findings to Improve Monitoring and Hardening of Networks


The team then moved from SCCM Server 1 to a central SCCM server (SCCM Server 2) at a third site (Site 3).


Specifically, the team: Queried the AD using Lightweight Directory Access Protocol (LDAP) for information about the network's sites and subnets [T1016].


This query revealed all organization sites and subnets broken down by classless inter-domain routing (CIDR) subnet and description.


Used LDAP queries and domain name system (DNS) requests to identify recently active hosts.


Attempted to move laterally with an SMB beacon


The team impersonated an administrative service account via a golden ticket attack (from SCCM Server 1); the account had administrative privileges on Workstation 3.


The user employed a KeePass password manager that the team was able to use to obtain passwords for other internal websites, a kernel-based virtual machine (KVM) server, virtual private network (VPN) endpoints, firewalls, and another KeePass database with credentials.


The server administrator relied on a password manager, which stored credentials in a database file.


The red team pulled the decryption key from memory using KeeThief and used it to unlock the database [T1555.005].


The team moved laterally from SCCM Server 2 to an SCCM DP server at Site 5 and from the SCCM Server 1 to hosts at two other sites (Sites 4 and 6).


The team installed persistent beacons at each of these sites.


Specifically, the team moved from the Site 5 SCCM DP server to a public DC; and then they moved from the public DC to the private DC.


See Figure 1 for a timeline of the red team’s initial access and lateral movement showing key access points.


Figure 1: Red Team Cyber Threat Activity: Initial Access and Lateral MovementWhile traversing the network, the team varied their lateral movement techniques to evade detection and because the organization had non-uniform firewalls between the sites and within the sites (within the sites, firewalls were configured by subnet).


The team’s primary methods to move between sites were AppDomainManager hijacking and dynamic-link library (


In some instances, they used Windows Management Instrumentation (WMI)


Event Subscriptions


The team impersonated several accounts to evade detection while moving.


This technique relies on anonymous SMB pipe binds


In other cases, the team attempted to determine valid accounts based on group name and purpose.


If the team had previously acquired the credentials, they used asktgt to impersonate the account.


If the team did not have the credentials, they used the golden ticket attack to forge the account.


Post-Exploitation Activity: Gaining Access to SBSs With persistent, deep access established across the organization’s networks and subnetworks, the red team began post-exploitation activities and attempted to access SBSs.


Trusted agents of the organization tasked the team with gaining access to two specialized servers (SBS 1 and SBS 2).


Phase I ended before the team could implement a plan to move to SBS 1.


However, the team assesses that by using Secure Shell (SSH) session socket files (see below), they could have accessed any hosts available to the users whose workstations were compromised. Plan for Potential Access to SBS 1 Conducting open-source research


[1591.001], the team identified that SBS 1 and 2 assets and associated management/upkeep staff were located at Sites 5 and 6, respectively.


The team planned to use the organization’s mobile device management (MDM) software to move laterally to the SBS 1 administrator’s workstation and, from there, pivot to SBS 1 assets.


The team identified the organization’s MDM vendor using open-source and AD information [T1590.006] and moved laterally to an MDM distribution point server at Site 5 (MDM DP 1).


This server contained backups of the MDM MySQL database on its D: drive in the Backup directory.


The backups included the encryption key needed to decrypt any encrypted values, such as SSH passwords [T1552].


The team moved laterally to an MDM server (MDM 1) at Site 3, searched files on the server, and found plaintext credentials [T1552.001] to an application programming interface (API) user account stored in PowerShell scripts.


The team attempted to leverage these credentials to browse to the web login page of the MDM vendor but were unable to do so because the website directed to an organization-controlled single-sign on (SSO) authentication page.


While in the MDM MySQL database, Elevating the selected MDM user’s account privileges to administrator privileges, and Modifying the user’s account by adding Create Policy and Delete Policy permissions [T1098], [T1548]. Creating a policy via the MDM API [T1106], which instructed Workstation 4 to download and execute a payload to give the team interactive access as root to the workstation.


Verifying their interactive access.


Note: A SSH socket file allows a user to open multiple SSH sessions through a single, already authenticated SSH connection without additional authentication.


The team could not take advantage of the open SSH socket.


Instead, they searched through SBS 1 architecture diagrams and documentation on Workstation 4.


The documentation listed the SecOps cloud infrastructure IP ranges [T1580].


These “trusted” IP addresses were a public /16 subnet; the team was able to request a public IP in that range from the same cloud provider, and Workstation 4 made successful outbound SSH connections to this cloud infrastructure.


The team intended to use that connection to reverse tunnel traffic back to the workstation and then access the bastion host via the open SSH socket file.


However, Phase 1 ended before they were able to implement this plan.


Attempts to Access SBS 2 Conducting open-source research, the team identified an organizational branch [T1591] that likely had access to SBS 2.


The team queried the AD to identify the branch’s users and administrators.


The team gathered a list of potential accounts, from which they identified administrators, such as SYSTEMS ADMIN or DATA SYSTEMS ADMINISTRATOR, with technical roles.


Using the same methodology as described by the steps in the Plan for Potential Access to SBS 1 section above, the team gained interactive root access to two Site 6 SBS 2-connected workstations: a software engineering workstation (Workstation 5) and a user administrator workstation (Workstation 6).


The Workstation 5 user had bash history files with what appeared to be SSH passwords mistyped into the bash prompt and saved in bash history


The team then attempted to authenticate to SBS 2 using a similar tunnel setup as described in the Access to SBS 1 section above and the potential credentials from the user’s bash history file.


However, this attempt was unsuccessful for unknown reasons.


On Workstation 6, the team found a .txt file containing plaintext credentials for the user.


Using the pattern discovered in these credentials, the team was able to crack the user’s workstation account password


The team also discovered potential passwords and SSH connection commands in the user’s bash history.


Using a similar tunnel setup described above, the team attempted to log into SBS 2.


However, a prompt for an MFA passcode blocked this attempt.


See figure 2 for a timeline of the team’s post exploitation activity that includes key points of access.


[T1583] throughout their assessment, including in certain cases for command and control (C2)


These included: Cobalt Strike and Merlin payloads for C2 throughout the assessment.


They configured each server with a different domain and used the servers for communication with compromised hosts.


These servers retained all assessment data.


Two commercially available cloud-computing platforms.


Redirecting servers make it difficult for defenders to attribute assessment activities to the backend team servers.


The redirectors used HTTPS reverse proxies to redirect C2 traffic between the target organization’s network and the Cobalt Strike team servers


The team encrypted all data in transit [T1573] using encryption keys stored on team’s Cobalt Strike servers.


A cloud service to rapidly change the IP address of the team’s redirecting servers in the event of detection and eradication.


Content delivery network (CDN) services to further obfuscate some of the team’s C2 traffic.


This technique leverages CDNs associated with high-reputation domains so that the malicious traffic appears to be directed towards a reputation domain but is actually redirected to the red team-controlled Cobalt Strike servers.


See Table 1 for a description of the events, the expected network defender activity, and the organization’s actual response.


Table 1: Measurable Events Measurable Event Description MITRE ATT&CK Technique(s) Expected Detection Points Expected Network Defender Reactions Reported Reactions Internal Port Scan Launch scan from inside the network from a previously gained workstation to enumerate ports on target workstation, server, and domain controller system(s).


Network Service Discovery [T1046] Network Monitoring and Analysis Tools Intrusion Detection or Prevention Systems Endpoint Protection Platform Detect target hosts and ports Identify associated scanning process Analyze scanning host once detected Develop response plan None Comprehensive Active Directory and Host Enumeration Perform AD enumeration by querying all domain objects from the DC; and enumerating trust relationships within the AD Forest, user accounts, and current session information from every domain computer (Workstation and Server).


[T1087.002] System Owner/User Discovery [T1033] Remote System Discovery [T1018] Network Monitoring and Analysis Tools Intrusion Detection or Prevention Systems Endpoint Protection Platform Detect target hosts and ports Identify associated scanning process Analyze scanning host once detected Develop response plan Collection process stopped before completion.


Host isolated and sent for forensics.


[T1048] Network Monitoring and Analysis Tools Intrusion Detection or Prevention Systems Endpoint Protection Platform Detect target hosts and ports Identify associated scanning process Analyze scanning host once detected Develop response plan None Malicious Traffic Generation—Workstation to External Host Establish a session that originates from a target Workstation system directly to an external host over a clear text protocol, such as HTTP.


Application Layer Protocol


[T1071] Intrusion Detection or Prevention Systems Endpoint Protection Platform Windows Event Logs Detect and Identify source IP and source process of enumeration Analyze scanning host once detected Develop response plan None Active Directory Account Lockout Lock out several administrative AD accounts Account Access Removal


Create Account: Local Account [T1136.001] Account Manipulation [T1098] Intrusion Detection or Prevention Systems Endpoint Protection Platform Web Proxy Logs Detect and identify source IP and source process of malicious traffic Investigate destination IP address Triage compromised host Develop response plan None Local Admin User Account Creation (server) Create a local administrator account on a target server system.


None Active Directory Account Creation Create AD accounts and add it to domain admins group Create Account:


[T1136.002] Account Manipulation [T1098] Windows Event Logs Detect account creation Identify source of change Verify change with system owner


Windows Service [T1543.003] Windows Event Logs Detect account compromise Analyze compromised host Develop response plan None Domain Admin Lateral Movement—Workstation to Domain Controller Use a previously compromised domain admin account to upload and execute a payload via SMB and Windows Service Creation, respectively, on a target DC.


Windows Service [T1543.003] Windows Event Logs Detect account compromise Triage compromised host Develop response plan None Malicious Traffic Generation—Domain Controller to External Host Establish a session that originates from a target Domain Controller system directly to an external host over a clear text protocol, such as HTTP.


Ingress Tool Transfer [T1105] Endpoint Protection Platform Endpoint Detection and Response Detect and identify source IP and source process of malicious traffic Investigate destination IP address Triage compromised host Develop response plan Malicious file was removed by antivirus Ransomware Simulation Execute simulated ransomware on multiple Workstation systems to simulate a ransomware attack.


Note: This technique does NOT encrypt files on the target system.


These findings contributed to the team’s ability to gain persistent, undetected access across the organization’s sites.


See the Mitigations section for recommendations on how to mitigate these issues.


Insufficient host and network monitoring.


Below is a list of some of the higher risk activities conducted by the team that were opportunities for detection: Phishing Lateral movement reuse Generation and use of the golden ticket Anomalous LDAP traffic Anomalous internal share enumeration Unconstrained Delegation server compromise DCSync Anomalous account usage during lateral movement Anomalous outbound network traffic Anomalous outbound SSH connections to the team’s cloud servers from workstations Lack of monitoring on endpoint management systems.


The team used the organization’s MDM system to gain root access to machines across the organization’s network without being detected.


Endpoint management systems provide elevated access to thousands of hosts and should be treated as high value assets (HVAs) with additional restrictions and monitoring.


KRBTGT never changed.


The Site 1 krbtgt account password had not been updated for over a decade.


The krbtgt account is a domain default account that acts as a service account for the key distribution center (KDC) service used to encrypt and sign all Kerberos tickets for the domain.


The red team was able to use the krbtgt account to forge TGTs for multiple accounts throughout Phase I. Excessive permissions to standard users.


This misconfiguration allowed the team to use the low-level access of a phished user to move laterally to an Unconstrained Delegation host and compromise the entire domain.


Hosts with Unconstrained Delegation enabled unnecessarily.


Hosts with Unconstrained Delegation enabled store the Kerberos TGTs of all users that authenticate to that host, enabling actors to steal service tickets or compromise krbtgt accounts and perform golden ticket or “silver ticket” attacks.


The team performed an NTLM-relay attack to obtain the DC’s TGT, followed by a golden ticket attack on a SharePoint server with Unconstrained Delegation to gain the ability to impersonate any Site 1 AD account. Use of non-secure default configurations.


The organization used default configurations for hosts with Windows Server 2012 R2.


The default configuration allows unprivileged users to query group membership of local administrator groups.


The red team used and identified several standard user accounts with administrative access from a Windows Server 2012 R2 SharePoint server.


Additional Issues The team noted the following additional issues.


If a user with administrative access is compromised, an actor can access servers without needing to elevate privileges.


Administrative and user accounts should be separated, and designated admin accounts should be exclusively used for admin purposes.


Most servers, including domain controllers, allowed unrestricted egress traffic to the internet.


The team noticed potentially unusual software, including music software, installed on both workstations and servers.


These extraneous software installations indicate inconsistent host configuration (see above) and increase the attack surfaces for malicious actors to gain initial access or escalate privileges once in the network.


Mandatory password changes enabled.


During the assessment, the team keylogged a user during a mandatory password change and noticed that only the final character of their password was modified.


Smart card use was inconsistent across the domain.


The team used these unprotected accounts throughout their assessment to move laterally through the domain and gain persistence.


Noted Strengths The red team noted the following technical controls or defensive measures that prevented or hampered offensive actions: The organization conducts regular, proactive penetration tests and adversarial assessments and invests in hardening their network based on findings.


The team was unable to discover any easily exploitable services, ports, or web interfaces from more than three million external in-scope IPs.


This forced the team to resort to phishing to gain initial access to the environment.


The team did not discover any useful credentials on open file shares or file servers.


This slowed the progress of the team from moving around the network.


MFA was used for some SBSs.


The team was blocked from moving to SBS 2 by an MFA prompt.


There were strong security controls and segmentation for SBS systems.


Direct access to SBS were located in separate networks, and admins of SBS used workstations protected by local firewalls.


MITIGATIONS CISA recommends organizations implement the recommendations in Table 2 to mitigate the issues listed in the Findings section of this advisory.


CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures.


See CISA’s Cross-Sector Cybersecurity Performance Goals for more information on the CPGs, including additional recommended baseline protections.


Table 2: Recommendations to Mitigate Identified Issues Issue Recommendation Insufficient host and network monitoring Establish a security baseline of normal network traffic and tune network appliances to detect anomalous behavior [CPG 3.1].


Create alerts for Windows event log authentication codes, especially for the domain controllers.


From a detection standpoint, focus on identity and access management (IAM) rather than just network traffic or static host alerts.


Consider who is accessing what (what resource), from where (what internal host or external location), and when (what day and time the access occurs).


Look for access behavior that deviates from expected or is indicative of AD abuse.


Reduce the attack surface by limiting the use of legitimate administrative pathways and tools such as PowerShell, PSExec, and WMI, which are often used by malicious actors.


CISA recommends selecting one tool to administer the network, ensuring logging is turned on [CPG 3.1], and disabling the others.


Consider using “honeypot” service principal names (SPNs) to detect attempts to crack account hashes


Consider using red team tools, such as SharpHound, for AD enumeration to identify users with excessive privileges and misconfigured hosts (e.g., with Unconstrained Delegation enabled).


Ensure all commercial tools deployed in your environment are regularly tuned to pick up on relevant activity in your environment.


Lack of monitoring on endpoint management systems Treat endpoint management systems as HVAs with additional restrictions and monitoring because they provide elevated access to thousands of hosts.


KRBTGT never changed Change the krbtgt account password on a regular schedule such as every 6 to 12 months or if it becomes compromised.


Note that this password change must be carefully performed to effectively change the credential without breaking AD functionality.


However, the required waiting period between resets must be greater than the maximum lifetime period of Kerberos tickets, which is 10 hours by default.


Excessive permissions to standard users and ineffective separation of privileged accounts Implement the principle of least privilege: Grant standard user rights for standard user tasks such as email, web browsing, and using line-of-business (LOB) applications.


Periodically audit standard accounts and minimize where they have privileged access.


Periodically Audit AD permissions to ensure users do not have excessive permissions and have not been added to admin groups.


Evaluate which administrative groups should administer which servers/workstations.


Ensure group members administrative accounts instead of standard accounts.


Separate administrator accounts from user accounts [CPG 1.5].


Only allow designated admin accounts to be used for admin purposes.


[CPG 3.4].


PAM solutions can also log and alert usage to detect any unusual activity and may have helped stop the red team from accessing resources with admin accounts.


Note: password vaults associated with PAM solutions should be treated as HVAs with additional restrictions and monitoring (see below).


Configure time-based access for accounts set at the admin level and higher.


For example, the just-in-time (JIT) access method provisions privileged access when needed and can support enforcement of the principle of least privilege, as well as the Zero Trust model.


This is a process in which a network-wide policy is set in place to automatically disable administrator accounts at the AD level when the account is not in direct need.


When individual users need the account, they submit their requests through an automated process that enables access to a system but only for a set timeframe to support task completion.


CISA recommends Windows Server 2019 or greater. Consider disabling or limiting NTLM and WDigest Authentication if possible, including using their use as criteria for prioritizing updates to legacy systems or for segmenting the network.


Instead use more modern federation protocols (SAML, OIDC) or Kerberos for authentication with AES-256 bit encryption [CPG 3.4].


If NTLM must be enabled, enable Extended Protection for Authentication (EPA) to prevent some NTLM-relay attacks, and implement SMB signing to prevent certain adversary-in-the-middle and pass-the-hash attacks CPG 3.4].


See Microsoft Mitigating NTLM Relay Attacks on Active Directory Certificate Services (AD CS) and Microsoft Overview of Server Message Block signing for more information.


Use of non-secure default configurations Keep systems and software up to date


If updates cannot be uniformly installed, update insecure configurations to meet updated standards. Lack of server egress control Configure internal firewalls and proxies to restrict internet traffic from hosts that do not require it.


If a host requires specific outbound traffic, consider creating an allowlist policy of domains.


Large number of credentials in a shared vault Treat password vaults as HVAs with additional restrictions and monitoring [CPG 3.4]: If on-premise, require MFA for admin and apply network segmentation [CPG 1.3].


Use solutions with end-to-end encryption where applicable [CPG 3.3].


If cloud-based, evaluate the provider to ensure use of strong security controls such as MFA and end-to-end encryption


[CPG 1.3, 3.3]. Inconsistent host configuration Establish a baseline/gold-image for workstations and servers and deploy from that image


[CPG 2.5].


Use standardized groups to administer hosts in the network.


Potentially unwanted programs Implement software allowlisting to ensure users can only install software from an approved list


Mandatory password changes enabled Consider only requiring changes for memorized passwords in the event of compromise.


Additionally, CISA recommends organizations implement the mitigations below to improve their cybersecurity posture: Provide users with regular training and exercises, specifically related to phishing emails


[CPG 4.3].


Phishing accounts for majority of initial access intrusion events.


Enforce phishing-resistant MFA to the greatest extent possible [CPG 1.3].


Reduce the risk of credential compromise via the following: Place domain admin accounts in the protected users group to prevent caching of password hashes locally; this also forces Kerberos AES authentication as opposed to weaker RC4 or NTLM.


Refrain from storing plaintext credentials in scripts [CPG 3.4].


The red team discovered a PowerShell script containing plaintext credentials that allowed them to escalate to admin.


Upgrade to Windows Server 2019 or greater and Windows 10 or greater.


These versions have security features not included in older operating systems.


As a long-term effort, CISA recommends organizations prioritize implementing a more modern, Zero Trust network architecture that: Leverages secure cloud services for key enterprise security capabilities (e.g., identity and access management, endpoint detection and response, policy enforcement).


Upgrades applications and infrastructure to leverage modern identity management and network access practices.


Centralizes and streamlines access to cybersecurity data to drive analytics for identifying and managing cybersecurity risks.


Invests in technology and personnel to achieve these goals.


CISA encourages organizational IT leadership to ask their executive leadership the question: Can the organization accept the business risk of NOT implementing critical security controls such as MFA?


CISA recommends testing your existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory.


To get started: Select an ATT&CK technique described in this advisory (see Table 3).


RESOURCES See CISA’s RedEye tool on CISA’s GitHub page.


See CISA’s RedEye tool overview video for more information.


REFERENCES


[1] Bleeping Computer: New DFSCoerce NTLM Relay attack allows Windows domain takeover APPENDIX: MITRE ATT&CK TACTICS AND TECHNIQUES See Table 3 for all referenced red team tactics and techniques in this advisory.


Note: activity was from Phase I unless noted.


Table 3: Red Team ATT&CK Techniques for Enterprise Reconnaissance Technique Title ID Use Gather Victim Identity Information: Email Addresses T1589.002


The team found employee email addresses via open-source research.


The team identified employee names via open-source research that could be used to derive email addresses.


Gather Victim Network Information: Network Security Appliances T1590.006 The team identified the organization’s MDM vendor and leveraged that information to move laterally to SBS-connected assets.


Gather Victim Org Information T1591 The team conducted open-source research and identified an organizational branch that likely had access to an SBS asset.


Gather Victim Org Information: Determine Physical Locations T1591.001


Search Open Technical Databases: Scan Databases T1596.005 The team queried an MDM SQL database to identify target administrators who recently connected with the MDM.


Resource Development Technique Title ID Use Acquire Infrastructure T1583


Establish Accounts: Email Accounts T1585.002


The team used commercially available email platforms for their spearphishing activity.


The team sent spearphishing emails with links to a red-team-controlled domain to gain access to the organization’s systems.


Persistence Technique Title ID Use Account Manipulation T1098 The team elevated account privileges to administrator and modified the user’s account by adding Create Policy and Delete Policy permissions.


Create Account: Local Account T1136.001 During Phase II, the team created a local administrator account on a workstation and a server.


Domain Account T1136.002 During Phase II, the team created an AD account.


Windows Service T1543.003 During Phase II, the team leveraged compromised workstation and domain admin accounts to execute a payload via Windows Service Creation on target workstations and the DC.


Hijack Execution Flow: DLL Search Order Hijacking T1574.001


The team used DLL hijacking to move laterally between sites.


Defense Evasion Technique Title ID Use Valid Accounts: Domain Accounts T1078.002 During Phase II


, the team compromised a domain admin account and used it to laterally to multiple workstations and the DC.


Credential Access Technique Title ID Use OS Credential Dumping: LSASS Memory T1003.001


OS Credential Dumping: DCSync T1003.006 The team harvested AES-256 hashes via DCSync.


Brute Force: Password Cracking T1110.002


The team cracked a user’s workstation account password after learning the user’s patterns from plaintext credentials.


Unsecured Credentials T1552 The team found backups of a MySQL database that contained the encryption key needed to decrypt SSH passwords.


Unsecured Credentials: Credentials in Files T1552.001


The team found plaintext credentials to an API user account stored in PowerShell scripts on an MDM server.


Unsecured Credentials: Bash History T1552.003 The team found bash history files on a Workstation 5, and the files appeared to be SSH passwords saved in bash history.


Credentials from Password Stores: Password Managers T1555.005


The team pulled credentials from a KeePass database.


Adversary-in-the-middle: LLMNR/NBT-NS Poisoning and SMB Relay T1557.001


The team ran the DFSCoerce python script, which prompted DC authentication to a server using the server’s NTLM hash.


Remote System Discovery T1018


The team queried the AD, during phase I and II, for information about computers on the network.


System Network Connections Discovery T1049 The team listed existing network connections on SCCM Server 1 to reveal an active SMB connection with server 2. Permission Groups Discovery: Domain Groups T1069.002 The team leveraged ldapsearch and dsquery to query and scrape active directory information.


Account Discovery: Domain Account T1087.002


The team queried AD for AD users (during Phase I and II), including for members of a SharePoint admin group and several standard user accounts with administrative access.


Domain Trust Discovery T1482 During Phase II, the team enumerated trust relationships within the AD Forest.


Group Policy Discovery T1615 The team scraped AD information, including GPOs.


, the team enumerated ports on target systems from a previously compromised workstation.


The team moved laterally with an SMB beacon.


Use Alternate Authentication Material:


Pass the Hash T1550.002


The team then deployed Rubeus to capture the incoming DC TGT.


Pass the Ticket T1550.003


Application Layer Protocol: Web Protocols T1071.001


The team’s C2 redirectors used HTTPS reverse proxies to redirect C2 traffic.


File Transfer Protocols T1071.002


The team used HTTPS reverse proxies to redirect C2 traffic between target network and the team’s Cobalt Strike servers.


Encrypted Channel T1573


The team’s C2 traffic was encrypted in transit using encryption keys stored on their C2 servers.


Ingress Tool Transfer T1105


During Phase II, the team uploaded and executed well-known malicious files to the DC to generate host-based alerts.


Impact Technique Title ID Use Account Access Removal T1531 During Phase II, the team locked out several administrative AD accounts.


Please share your thoughts.


We recently updated our anonymous Product Feedback Survey and we'd welcome your feedback.


Building Adaptable Security Architecture Against NetWalker NetWalker Overview The NetWalker ransomware, initially known as Mailto, was first detected in August 2019.


We do not want you to be one of those victims, so this blog is focused on how to build an adaptable security architecture to defeat this threat and, specifically, how McAfee’s portfolio delivers the capability to prevent, detect and respond to NetWalker ransomware.


Gathering Intelligence on NetWalker As always, building adaptable defensive architecture starts with intelligence.


In most organizations, the Security Operations team is responsible for threat intelligence analysis, as well as threat and incident response.


The Preview of McAfee MVISION Insights is a sneak peek of some of MVISION Insights capabilities for the threat intel analyst and threat responder.


The preview identifies the prevalence and severity of select top emerging threats across the globe which enables the Security Operations Center (SOC) to prioritize threat response actions and gather relevant cyber threat intelligence (CTI) associated with the threat, in this case NetWalker ransomware.


The CTI is provided in the form of technical Indicators of Compromise (IOCs) as well as MITRE ATT&CK framework tactics and techniques.


As a threat intel analyst or responder, you can drill down to gather more specific information on NetWalker, such as prevalence and links to other sources of information.


As a threat intel analyst or responder, you can further drill down to gather more specific actionable intelligence on NetWalker, such as indicators of compromise and tactics/techniques aligned to the MITRE ATT&CK framework.


From MVISION Insights preview, you can see that NetWalker leverages tactics and techniques common to other ransomware attacks, such as spear phishing attachments for Initial Access, use of PowerShell for deployment, modification of Registry Keys/Startup folder for persistence and encryption of files for impact of course.


Defensive Architecture Overview Today’s digital enterprise is a hybrid environment of on-premise systems and cloud services with multiple entry points for attacks like NetWalker.


The work from home operating model forced by COVID-19 has only expanded the attack surface and increased the risk for successful ransomware attack if organizations did not adapt their security posture.


The Center for Internet Security (CIS) Top 20 Cyber Security Controls provides a good guide to build that architecture.


The following outlines the key security controls needed at each layer of the architecture to protect your enterprise against ransomware.


To assess your capability against NetWalker, you must match your existing controls against the attack stages we learned from the Preview of MVISION Insights.


For detailed analysis on the NetWalker ransomware attack, see McAfee ATR’s blog but, for simplicity, we matched the attack stages to the MITRE ATT&CK Framework below.


Initial Access Stage Defensive Overview


According to Threat Intelligence and Research, the initial access is performed either through vulnerability exploitation or spear phishing attachments.


The following chart summarizes the controls expected to have the most effect against initial stage techniques and the McAfee solutions to implement those controls where possible.


MITRE Tactic MITRE Techniques CSC Controls McAfee Capability Initial Access Exploit Public-Facing Applications (T1190) Tomcat, Web Logic CSC 2 Inventory of Software Assets


Initial Access Spear Phishing Attachments (T1566.001)


CSC 7 – Email and Web Browser Protection CSC 8 – Malware Defenses Endpoint Security Platform 10.7, Threat Prevention, Adaptive Threat Protection, Web Gateway (MWG), Advanced Threat Defense, Web Gateway Cloud Service (WGCS) Initial Access Valid Accounts (T1078) RDP Compromised CSC 5 Secure Configuration of hardware and software CSC 9 Limitation of Network Ports and Protocols CSC 12 Boundary Defense Endpoint Security Platform 10.7, Threat Prevention


As attackers can quickly change spear phishing attachments, it is important to have adaptable defenses that include user awareness training and response procedures, behavior-based malware defenses on email systems, web access and endpoint systems, and finally sec ops playbooks for early detection and response against suspicious email attachments or other phishing techniques.


To further understand how McAfee defends against RDP as an initial access vector, as well as how the attackers are using it to deploy ransomware, please see our previous posts.


https://www.mcafee.com/blogs/other-blogs/mcafee-labs/rdp-security-explained/ https://www.mcafee.com/blogs/other-blogs/mcafee-labs/cybercriminals-actively-exploiting-rdp-to-target-remote-organizations/ https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ens-10-7-rolls-back-the-curtain-on-ransomware/ Exploitation Stage Defensive Overview


The exploitation stage is where the attacker gains access to the target system.


Protection at this stage is heavily dependent on system vulnerability management, adaptable anti-malware on both end user devices and servers and security operations tools like endpoint detection and response sensors.


McAfee Endpoint Security 10.7 provides a defense in depth capability including signatures and threat intelligence to cover known bad indicators or programs.


Additionally, machine-learning and behavior-based protection reduces the attack surface against NetWalker and detects new exploitation attack techniques.


For more information on how McAfee Endpoint Security 10.7 can prevent or identify the techniques used in NetWalker, review these additional blog posts.


https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ens-10-7-rolls-back-the-curtain-on-ransomware/ https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-amsi-integration-protects-against-malicious-scripts/ https://www.mcafee.com/blogs/other-blogs/mcafee-labs/how-to-use-mcafee-atp-to-protect-against-emotet-lemonduck-and-powerminer/ The following chart summarizes the critical security controls expected to have the most effect against exploitation stage techniques and the McAfee solutions to implement those controls where possible. MITRE Tactic MITRE Techniques CSC Controls McAfee Portfolio Mitigation Execution PowerShell (T1059.001)


CSC 4 Controlled Use of Admin Privileges CSC 5 Secure Configuration CSC 9 Limitation of Network Ports and Protocols CSC 8 Malware Defenses Endpoint Security Platform 10.7, Threat Prevention, Adaptive Threat Protection, Application Control (MAC), MVISION EDR Persistence Registry Key – Place Value on Run Once Key (T1060)


CSC 5 Secure Configuration CSC 8 Malware Defenses Endpoint Security Platform 10.7 Threat Prevention Privilege Escalation Exploitation for Privilege Exploitation ((T1068) CVE-2020-0796 CSC 3 Vulnerability Management CSC 5 Secure Configuration CSC 8 Malware Defenses CSC 12 Boundary Defenses Network Security Platform (CVE-2020-0796) Privilege Escalation Exploitation for Privilege Exploitation ((T1068) CVE-2019-1458 CSC 3 Vulnerability Management CSC 5 Secure Configuration CSC 8 Malware Defenses CSC 12 Boundary Defenses Network Security Platform (CVE-2019-1458); Endpoint Security Platform 10.7 (CVE-2019-1458) Threat Prevention, Application Control (MAC) Privilege Escalation Exploitation for Privilege Exploitation ((T1068) CVE-2017-0213 CSC 3 Vulnerability Management CSC 5 Secure Configuration CSC 8 Malware Defenses CSC 12 Boundary Defenses Network Security Platform (CVE-2017-0213); Endpoint Security Platform 10.7 (CVE-2017-0213) Threat Prevention, Application Control (MAC) Privilege Escalation Exploitation for Privilege Exploitation ((T1068) CVE-2015-1701 CSC 3 Vulnerability Management CSC 5 Secure Configuration CSC 8 Malware Defenses CSC 12 Boundary Defenses Network Security Platform (CVE-2015-1701); Endpoint Security Platform 10.7, Threat Prevention, Application Control (MAC) Privilege Escalation Process Injection: Reflective DLL (T1055)


CSC 5 Secure Configuration CSC 8 Malware Defenses Endpoint Security Platform 10.7, Threat Prevention, Adaptive Threat Protection, MVISION EDR Defensive Evasion Deobfuscate/Decode Files or Information (T1140) CSC 5 Secure Configuration CSC 8 Malware Defenses Endpoint Security Platform 10.7, Threat Prevention, Adaptive Threat Protection, MVISION EDR Defensive Evasion Obfuscated Files or Information (T1027): PowerShell Script uses Base64 and hexadecimal encoding and XOR-encryption CSC 5 Secure Configuration CSC 8 Malware Defenses CSC 12 Boundary Defenses Endpoint Security Platform 10.7, Threat Prevention, Adaptive Threat Protection, MVISION EDR Credential Access Credential Dumping (T1003) Mimikatz, Mimidogz, Mimikittenz, Pwdump, LaZagne, Windows Credentials CSC 4 Controlled Use of Admin Privileges CSC 5 Secure Configuration CSC 8 Malware Defenses Endpoint Security Platform 10.7, Threat Prevention, Adaptive Threat Protection, Application Control (MAC), MVISION EDR Credential Access Brute Force (T1110)


Protection at this stage is heavily dependent on adaptable anti-malware on both end user devices and servers, network controls and security operation’s capability to monitor logs for anomalies in privileged access or network traffic.


The following chart summarizes the controls expected to have the most effect against impact stage techniques and the McAfee solutions to implement those controls where possible.


MITRE Tactic MITRE Techniques CSC Controls McAfee Portfolio Mitigation Discovery Network Service Scanning (T1046) Network Scanner CSC 5 Secure Configuration CSC 8 Malware Defenses CSC 12 Boundary Defenses Endpoint Security Platform 10.7, Threat Prevention, Application Control (MAC), Network Security Platform Lateral Movement Third Party Software (T1072) TeamViewer, Anydesk CSC 5 Secure Configuration CSC 8 Malware Defenses CSC 12 Boundary Defenses Endpoint Security Platform 10.7, Threat Prevention, Network Security Platform Lateral Movement Service Execution (T1035) PS Exec CSC 5 Secure Configuration CSC 8 Malware Defenses CSC 12 Boundary Defenses Endpoint Security Platform 10.7, Threat Prevention, MVISION EDR Collection Data from Information Repositories (T1213)


CSC 4 Control Admin Privileges CSC 5 Secure Configuration CSC 6 Log Analysis Endpoint Security Platform 10.7, Threat Prevention, MVISION EDR Command and Control Ingress Tool Transfer (T1105)


CSC 8 Malware Defenses CSC 12 Boundary Defenses Web Gateway, Network Security Platform Impact Data Encrypted (T1486) Netwalker Ransomeware CSC 5 Secure Configuration CSC 8 Malware Defenses Endpoint Security Platform 10.7, Threat Prevention, Adaptive Threat Protection, MVISION EDR, Web Gateway Impact Inhibit System Recovery (T1490) Shadow CSC 5 Secure Configuration CSC 8 Malware Defenses Endpoint Security Platform 10.7, Threat Prevention, Adaptive Threat Protection, MVISION EDR, Web Gateway Hunting for NetWalker Indicators


As a threat intel analyst or hunter, you might want to quickly scan your systems for any of NetWalker indicators.


Of course, if you found infected systems or systems with indicators, you can take action to contain and start an investigation for incident response immediately from the MVISION EDR console.


Proactively Detecting NetWalker Techniques Many of the exploit stage techniques in this attack use legitimate Windows tools or valid accounts to either exploit, avoid detection or move laterally.


These techniques are not easily prevented but can be detected using MVISION EDR.


As security analysts, we want to focus on suspicious techniques, such as PowerShell, used to download files… or execute scripts… or evade defenses… Monitoring or Reporting on NetWalker Events Events from McAfee Endpoint Protection and Web Gateway play a key role in NetWalker incident and threat response.


As a threat responder, you may want to create a dashboard for NetWalker-related threat events to understand current exposure.


Here is a list (not exhaustive) of NetWalker-related threat events as reported by Endpoint Protection Platform Threat Prevention Module and McAfee Web Gateway.


McAfee Endpoint Threat Prevention Events Ransom-NetW!AB8D59ABA3DC GenericRXKU-HO!E33E060DA1A5 PS/Netwalker.a Ransom-NetW!1B6A2BFA39BC Artemis!2F96F8098A29 GenericRXKD-DA!645C720FF0EB GenericRXKD-DA!4E59FBA21C5E Ransom-NetW!A9E395E478D0 Ransom-NetW!A0BC1AFED896 PS/Netwalker.c Artemis!F5C877335920 GenericRXKD-DA!B862EBC24355 Artemis!2F96F8098A29 GenericRXKD-DA!63EB7712D7C9 RDN/Ransom GenericRXKD-DA!F0CC568491CD Artemis!0FF0D5085F7E GenericRXKD-DA!9172586C2F87 RDN/Generic.dx Ransom-NetW!BFF6F7B3A7DB Ransom-NetW!7B77B436360A GenericRXKD-DA!BC75859695F6 GenericRXKD-DA!FCEDEA8111AB GenericRXKD-DA!5ABF6ED342FD PS/Netwalker.d GenericRXKD-DA!C0DDA75C6EAE GenericRXKD-DA!ADDC865F6169 GenericRXKD-DA!DBDD7A1F53AA Artemis!1527DAF8626C GenericRXKD-DA!608AC26EA80C Ransom-NetW!3A601EE68000 GenericRXKD-DA!8102821249E1 Ransom-NetW!2E2F5FE8ABA4 GenericRXKD-DA!F957F19CD9D7 GenericRXKD-DA!3F3CC36F4298 GenericRXKD-DA!9001DFA8D69D PS/Agent.bu GenericRXKD-DA!5F55AC3DD189 GenericRXKD-DA!18C32583A6FE GenericRXKD-DA!01F703234047 Ransom-NetW!62C71449FBAA GenericRXKD-DA!6A64553DA499 GenericRXKD-DA!0CBA10DF0C89 Artemis!50C6B1B805EC PS/Netwalker.b GenericRXKD-DA!59B00F607A75 Artemis!BC96C744BD66 GenericRXKD-DA!DE0B8566636D Ransom-NetW!8E310318B1B5 GenericRXKD-DA!0537D845BA09 GenericRXKU-HO!DE61B852CADA GenericRXKD-DA!B4F8572D4500 PS/Netwalker.c GenericRXKD-DA!D09CFDA29F17 PS/Agent.bx GenericRXKD-DA!0FF5949ED496 GenericRXKD-DA!2B0384BE06D2 GenericRXKD-DA!5CE75526A25C GenericRXKD-DA!BDC345B7BCEC Ransom-CWall!993B73D6490B GenericRXKD-DA!0E611C6FA27A GenericRXKU-HO!961942A472C2 Ransom-NetW!291E1CE9CD3E Ransom-Mailto!D60D91C24570 PS/Agent.bu GenericRXKU-HO!997F0EC7FCFA PS/Agent.bx Ransom-CWall!3D6203DF53FC Ransom-Netwalker Ransom-NetW!BDE3EC20E9F8 Generic .kk GenericRXKU-HO!1DB8C7DEA2F7 GenericRXKD-DA!DD4F9213BA67 GenericRXKD-DA!729928E6FD6A GenericRXKU-HO!9FB87AC9C00E GenericRXKU-HO!187417F65AFB PS/Netwalker.b McAfee Web Gateway Events RDN/Ransom BehavesLike.Win32.RansomCWall.mh BehavesLike.Win32.Generic.kh Ransom-NetW!1B6A2BFA39BC BehavesLike.Win32.MultiPlug.kh Ransom:Win32/NetWalker.


H!rsm BehavesLike.Win32.Generic.qh BehavesLike.Win32.Trojan.kh GenericRXKD-DA!DD4F9213BA67 BehavesLike.Win32.Ipamor.kh BehavesLike.Win64.Trojan.nh BehavesLike.Win32.Generic.cz RDN/Generic.dx BehavesLike.Win32.RansomCWall.mm BehavesLike.Win64.BadFile.nh BehavesLike.Win32.Generic.dm Summary Ransomware has evolved into a lucrative business for threat actors, from underground forums selling ransomware, to offering services such as support portals to guide victims through acquiring crypto currency for payment, to the negotiation of the ransom.


The post McAfee Defender’s Blog: NetWalker appeared first on McAfee Blog.


Indicators of compromise, including malicious domain names, have not been modified.

Technical Analysis Black Basta Malware Overview


Any log modification has been made to redact client information, break potential links, or for readability.


RELATED TO THIS STORY


The timeline below shows a high-level overview of the incident: INITIAL ACCESS The Threat Actor began this attack by compromising a user account at a third-party vendor (TPV).


Although little is known to Quadrant about the compromise on the TPV, access allowed for the use of an "info@" account.


Following the infection, these hosts began to beacon on out to over 100 IP's using various ports.


Although this did trigger an alert in AMP, the Quadrant ingestion of these logs was not configured, so this did not generate an alert through the Sagan Solution.


Quadrant monitors companies' ingress and egress traffic using onsite Packet Inspection Engine (PIE) appliances running the Suricata Detection engine.


Although many other rulesets are used to screen for malicious activity, Quadrant has custom rules in place to detect SSH over nonstandard ports, such as TCP 2222.


These rules did not fire due to the absence of an SSH header in the traffic.


Eventually, the malware was able to find an active C2 server.


It took about 35 minutes between initial infection and the first successful communication between a compromised host and the C2 domain.


The second stage payload, which was later determined to likely be the penetration testing framework "Brute Ratel," was then downloaded via a connection to an IP from Russia.


PERSISTENCE AND ESCALATION OF PRIVILEGE Following the compromise of two hosts and gaining a foot hold, lateral movement began.


The client's full infrastructure is comprised of three domains: Construction, Commerce, and a Subsidiary.


Both initial compromised hosts were in the Construction environment.


These domains had shared trust and were connected via VPN tunnels which allowed the threat actor to move freely between domains.


We believe that multiple methods and tools were leveraged in order to do this.


At this point, visibility becomes muddled due to the focus of observation and detection is ingress and egress traffic.


However, following the investigation into the recorded logs and the follow-on detailed analysis of malware samples, we can make educated guesses on some of the missing pieces.


Initial lateral movement and the lay of the land was likely conducted using Brute Ratel.


One file, "zfgufgfvezdnbcvjkzctpvfdj.dll," matches the hash of previously submitted Brute Ratel samples.


Initial Command and Control was conducted from "23[.]19[.]58[.]43"[zedorocop[.]com] and "23[.]106[.]160[.]141" [danimos[.]com].


The IP’s used for C2 and the level of interaction changed over time as the compromise grew.


It’s important to note that the FQDN’s that were used as C2 were all registered the same month as the compromise.


Multiple administrative and system accounts were compromised during this incident.


One possible explanation for this comes from “Kerberoasting”.


We do not believe that this was successful in this environment, due in part to the lack of additional signs of compromise specific to this Domain.


However, this technique was likely performed on the other two client domains where visibility gaps existed.


This is further supported by the source and destination of these requests were cross domain: The source of the “Kerberoasting” was based in the Subsidiary environment and the Domain Controller that was attacked was in the Commerce environment.


PROPAGATION Unknown to everyone but the attacker, multiple files were being transmitted throughout the environment: Two file names were observed during the incident "Client_s.exe" and "Client.exe."


It is expected that the different naming schemes are related to the different variations of the Black Basta ransomware.


Two ".bat" files were sent throughout the organization.


Both were designed to turn off antivirus and anti-malware software.


One does not use any obfuscation and just contains the simple command to stop Cisco AMP Orbital.


This could indicate that it was written hastily in order to get it onto the target environments quickly.


Tox5, which appeared to be a component of Cobalt Strike, as well as Cobalt Strike beacon with the name of "Ticket-5731.xls." These files continued to replicate throughout the organization though the use of Server qMessage Block (SMB), eventually spreading to almost every endpoint and server in two of the three domains.


Most hosts in the Commerce environment HAD more restrictions placed on their operating system by default which likely contributed to the lack of success by the threat actors in the Commerce environment.


Suricata logs show that “RClone” was downloaded on the file servers in order to facilitate exfiltration of the logs.


This legitimate program was abused by the attacker to steal client data.


DETECTION AND RESPONSE The most critical asset of the Security Operations Center is the human SOC Analyst.


A human can look at the totality of a situation and make a judgement call that no AI or automated process can.


This FTP command is defined as "...causes the directory specified in the pathname to be created on the server.


If the specified directory is a relative directory, it is created in the client's current working directory.


" Although many old signatures are decommissioned or otherwise suppressed, Quadrant leaves some rules in place as "hunting" rules.


These are more focused on the overall techniques or "odd" traffic that could be an indicator of compromise.


However, looking at the destination, which had not been previously observed in the environment, the file names (which were quite varied), and the volume of the files outbound, the analyst decided to call the client to err on the side of caution.


Had the analyst not conducted their due diligence or had this archaic signature been suppressed, it is highly likely that this compromise would not have been detected until after the encryption process had begun.


The current list of rules developed following this incident can be found in I The alert was submitted at 18:27 EDT on 9/21/2022.


The client determined it to be out of the ordinary but was unaware of the extent of the compromise.


However, during the course of the evening, it became apparent that something was greatly amiss.


The following morning, the client’s CISO contacted the Quadrant team to report that there was indeed an active compromise within their environment.


The client provided malware samples from the phishing emails and the analysis began.


Threat hunting was conducted within the logs.


A dedicated “out of bands” communications channel was established between Quadrant and the clients.


As more evidence was uncovered, the full threat began to be realized.


One aspect of the actions taken by the Incident Response team was a live log review.


The term "look for anything suspicious" is often a nightmare of a request, because how does one truly define suspicious without a base line.


Windows Event logs and “clipboard” logs are collected using NXLog Enterprise.


While clipboard logs are not stored on the local host, they are sent to the Sagan Log Analysis Engine for further analysis and retention.


While examining this data, the I.R. team member became aware of the use of RDP by the Threat Actor by observing RDPClip.exe logging that looked, by definition, incredibly suspicious.


Among the many “clipboard” logs observed, "Client.exe -bomb," stood out.


Although the full extent of the command was not realized at the time, due to the implied malice it was decided that now was the time to attempt to purge the threat actor.


The Clients response team locked out the accounts that were known to be compromised.


However, the threat actor had complete control over the environment.


This resulted in a catastrophic lockout of the client's staff and administrators.


This was not completely unexpected.


Knowing that there was an ongoing data exfiltration attempt along with a full network compromise with a relatively short “dwell” time, plans had been put into place to restrict all access to the network in order to mitigate and prevent the threat actor from doing more damage.


The client's staff was simply waiting on the “order” to halt the network.


After quick conference between Quadrant and the client, all parties agreed and the decision was made: At approximately 8:45pm on September 22, only 56 hours after the initial phishing email had been opened, the physical cables from between the domains as well as their connection to the Internet were pulled.


With the assistance of a third-party incident response firm and constant ongoing contact with the Quadrant team, the client was able to slowly, systematically, and safely bring their servers on-line while purging any remains of the threat actor over the course of the next two weeks.


Through the later review of the logging and after-action analysis of the event, more detections rules have been created to better alert on what visibility does exist in this, and many other, client environments.


TECHNICAL ANALYSIS INITIAL ACCESS: QAKBOT INFECTION


The two phishing samples provided by the client show two different techniques: Email response as part of an Email Chain: "Re: RE: Logistics":


The phishing email came from a legitimate vendor "stoneworkers".


The attacker submitted the email from "info[@]stoneworkers[.]org" while posing as "jpeterman[@]stoneworkers[.]org".


The email had applicable context and the email chain contains back and forth to another member of the TPV as well.


The phishing email came with no pretext from a site not used by the client.


The attacker submitted the email from "support[@]capitalizedadventures[.]com" while posing as "Jay Peterman".


From the two phishing emails, both attachments contain similar malware.


Only changes to the filenames and corresponding commands were observed between the two.


The subdirectories to the fathomed directory, elude, omicron, and shabbily, are all empty as confirmed by navigating to them and running "ls -a" and returning no files.


This was verified through "du -h" which resulted in 4.0k size, which is consistent of an empty directory.


When opened in a Windows environment the following is displayed: The ISO mounts as a DVD Drive.


The "Claim_Copy" shows the icon for windows file explorer.


In both cases the JavaScript files set several variables before running the ".cmd" file contained within the ISO.


This is likely done as a method to avoid detection from Log Analysis Engines, such as the Sagan Engine, as well as other monitoring services such as Microsoft's Defender or Sentinel.


Ultimately, this CMD file calls the "db" file.


In both samples, the "db" file is not a database, but is the actual Qakbot trojan.


Something interesting to note: the "campus.txt" contains an excerpt from "Through the Looking Glass" by Lewis Carol.


This inclusion may be to add easily changeable padding to the ISO.


Doing so would allow the easy addition or subtraction of data in order to change the ISO’s hash value without changing any important content of the executables.


Following detonation of Qakbot, the malware copied itself to "$CURRENTUSER\AppData\Roaming\Microsoft\Isoaahffo\djkuuhd.dll," as confirmed by the file's hashes shown below, and sets itself to auto run.


Following this, the malware begins to beacon out to hard coded C2 servers.


A breakdown of the observed IP’s and their ports can be found in the INDEX A below.


This contains over 100 IP’s for potential C2 servers.


During the initial detonation of 5898, the process imbedded itself into wermgr.exe, the Windows Error Reporting Manager (Process ID 6660).


Further analysis of the registry keys added by the sample were able to be decrypted by leveraging the decryption script found at the link "https://github.com/drole/qakbot-registry-decrypt".


These show the full path to the dropped file "xjkuuhd.dll" as well as the Qakbot campaign identifier: "obama206."


As with the case with other Qakbot investigations, multiple potential IP’s were observed during the testing.


During the incident, the first warning sign of compromise came from the victims Cisco Advanced Malware Protection alerting.


Cisco AMP detected an attempt to contact "76[.]169[.]76[.]44"[Van Nuys, CA] over TCP port 2222.


A later review of the logs revealed that the first attempt to contact the C2 ip’s ("61[.]70[.]29[.]53"[Taiwan]).


Due to TCP port 2222’s common use as an alternate port for SSH communication, the Malware Analyst recorded a manual SSH connection to the emulated C2 host in order to show the difference between an SSH connection and the connection made by the Malware sample.


Evidence suggests that the sample does not communicate over SSH and the communication is consistent with HTTP/S traffic.


The malware analyst attempted to connect via SSH to the emulated C2 host.


Note the first packet from the experimental machine to the emulated C2 device following the 3-way TCP handshake shows header information containing the OpenSSH client information.


This was produced manually as an example of an SSH connection while SSH was running on the emulated C2 host on port 2222.


An overview of the lab setup and tools can be found in INDEX B. While continuing to run the SSH client on the emulated C2 device, the malware was detonated on the VM, we can see that the same packet following the 3-way handshake no longer contains SSH information but is detected as a Client Hello.


The emulated C2 Server is now running an HTTPS server on TCP port 2222.


This PCAP above shows the conversation from the 3-way handshake to the resetting of the connection.


Following observation of the malware samples, we now know that most of the connection attempts to the C2 IP’s are conducted over TCP port 443.


Because of the common use of this port, and the use of TLS in these connections, both attempts and the successful connections went undetected by Suricata and Cisco AMP.


Many of the connections over 443 resulted in minimal connections consistent with nothing more than TCP negations.


However, IP’s "119[.]42[.]124[.]18"[Thailand] and "193[.]3[.]19[.]37"[Russia] showed multiple packets and data transferred, including the exchange of TLS certificates.


The size and length of connection indicates that the second stage was downloaded from "193[.]3[.]19[.]37"[Russia].


POST-EXPLOITATION TECHNIQUES, TACTICS, AND PROCEDURES COMMAND AND CONTROL Initial Command and Control was initially conducted from "23.19.58.43"[zedorocop[.]com] and "23.106.160.141" [danimos[.]com].


A dynamic analysis of "Tox5" shows the malware drops itself in a randomly generated name folder under the "ProgramData" directory and adds itself to a scheduled task.


This is observed below by comparing the file hashes for "tox5.exe" and "C:\ProgramData\lplshr\basinqt.exe."


Following the resolution of gerhiles[.]com, and the activation of "INetSim" to simulate a website, the PCAP above shows connections were attempted over port 4001.


Leveraging "netstat -a -n -o" revealed the PID of the service connecting on port 4001.


Task manager was then use to reveal the service running on PID 3488, which was renamed instance of Tox5.


Because of the beaconing activity, persistence, and apparent ability to wipe event logs, it is likely that tox5 is a component of Cobalt Strike or similar framework.


LATERAL MOVEMENT: SMB AND RDP Brute Ratel allows for lateral movement leveraging RPC to create SMB traffic.


Logging shows actions taken by the attacker that were recorded by RDPClip in the form of clipboard logging, indicating the use of Remote Desktop Protocol.[CI1]


[SD2] After the connection to the internet and shared domains were severed, automated processes continued to propagate malware.


Files commonly observed transferred via SMB include: Black Basta Ransomware "Client_s.exe" and "Client.exe" Cobalt Strike beacon with the name of "Ticket-5731.xls" ".bat" files designed to disable Cisco AMP / Microsoft Defender Clipboard logging


This shows the decoded and uncompressed data.


Additional Files and commands observed transferred detected via clipboard logging:


The following 31 commands were ran between Sep 22, 2022 @ 20:01:39.000 and Sep 22, 2022 @ 20:02:46.000.


The syntax indicates these are the commands used to reset the administrative passwords following the attempted lock out of the threat actor.


According to Google translate, the Russian phrases translate to "bury along the way" and "launch with balloons".


A search of Active Directory for users whose passwords never expire, and the last set date while writing to a file for later exfiltration: Stopping Cisco AMP / Disabling Microsoft Defender, these are the same commands as observed in the ".bat" files: Transfer and use of Ticket-5731.xls


(determined to be Cobalt Strike): Url to download "cob_12.dll" and "tox5.exe".


Although cob_12.dll was not collected for technical sample, tox5.exe was reviewed: Clipboard logging showing the “uninstall” commands for Windows Defender: Adding an Admin to ESXi environment: Domain Controller detection: Connection attempt to a "SH/WEB" domain:


Command showing the use of "Bitsadmin" to transfer the Black Basta Ransomware: Connection from Client by threat actor: DISABLING ANTIVIRUS/MALWARE SOFTWARE USING ".BAT"


FILES


The two ".bat" files that were sent throughout the organization were both designed to turn off Antivirus and Antimalware software.


It is interesting to note that “cc.bat” does not use any obfuscation and just contains the simple command to stop AMP Orbital.


This could indicate that it was written hastefully in order to get it onto the target environment.


"cc.bat" is a simple script designed to stop Cisco AMP.


“W.bat”, on the other hand, has some simple but clever obfuscation in place.


When using "vim” or another text editor, the .bat file appears to contain Chinese characters.


However, performing "cat" or "strings" reveals the actual data.


The strings of characters following "set" act as the key.


When the script is executed, the system will swap out the numbers in the body for the place in the key string.


The link from Superuser[.]com in INDEX D goes into more specifics on how this is done.


"w.bat" as viewed through a text editor.


For this example, the text editor "vim” was used to open the file: "w.bat" as viewed through the bash command "cat":


After copying and pasting the body of "w.bat" into its own text document "w.txt", the team was able to run a lengthy "sed” command against the file to reveal the below: The sed statement used to decode the body of "w.bat":


EXFILTRATION THROUGH RECLONE Once the file server was identified, an FTP connection was established to an external site.


This likely shows the connection containing the download of RCLONE.


First connection on Subsidiary PIE to the external file dump: First connection on Construction PIE to the external file dump.


Although no sample was able to be provided for Client.exe (which is believed to be the ESXi variant), Quadrant was able to obtain a copy of "Client_s.exe" for Windows hosts.


From a static malware analysis review, very little was initially able to be obtained from the sample aside from the ".basta" suffix and a relation to "Fax." Static analysis conducted inside of x32dbg, showing a relation to "FAX" and the potential use of the directory "ProgramData": Upon detonation, running the malware sets itself up as the service "Fax" and enables it to start during safe boot.


The ransomware then proceeds to restart into safe mode using bcdedit.exe.


While in safe mode, the encryption of files occurs.


Once the encryption is complete, the system is then restarted into the standard operating mode.


The background has been replaced to show "Your Network is Encrypted by the Black Basta group.


The writeups conducted by "Northwave-Security" and "Deepinstinct" share more light onto these flags.


These show that "bomb" designates a full detonation of all reachable hosts, and "forcepath" is for a specific instance or directory.


We are attempting to better understand the use of the "-bomb" flag and how it communicates with the other infected machines.


It is likely that the reason the machine is restarted into safe mode with networking indicates that this communication may occur at this time.


A: INDICATORS OF COMPROMISE FILE NAMES AND HASH VALUES File Name SHA-256 Hash Claim_Copy_1796.iso 2cf56e6c050d0c9d8ada6cdb79a8ed2b8bbc25cd7d33ccc79aeedb31b5ad00df damagesMeaning.js 7a39324822941014609f0fd7d05f1adbbccc3f36d79103e2589251680f3b6c63 centipede.gif e8f5fa12faea9430645853fbb24ce46a5a62cb906168dd17b62d865ddfe201e3 DecomposedLoners.cmd cd5b4bd824bad0be78e4cdf6d7fe8a950bd63f294713b8cb49de887d8a8410bc excite.jpg 4fd4fdedb11b76a24fba289e0b3a8ed07261f98d279932420c7af779663605f8 sinkers.db c4875bd0683467c1e5d44f80b1d5abf6ac9b6f5bf5b6750a1e653416a68ed006 Claim_Copy_5898.iso 474b800fa4f8c2638607b012029cb134b58534e7817fbf3658c9c1d8c78204fa Claim_Copy.lnk e2eb9029fd993a9ab386beb7ca4fa21a1871dc0c7568eb802cac1ea3c53cad8b campus.txt 319704f093b71286985716d87c6fb20d6ddc334be6f1ccc042de8c73f7f5df36 centipede.gif e8f5fa12faea9430645853fbb24ce46a5a62cb906168dd17b62d865ddfe201e3 clockwatcherMinty.js 14d53c3d675458863ee2b336a4203f680932181ff5db99bb2f1640ffd44947b5 excite.jpg 4fd4fdedb11b76a24fba289e0b3a8ed07261f98d279932420c7af779663605f8 meddled.db 4f7d97bf4803bf1b15c5bec85af3dc8b7619fe5cfe019f760c9a25b1650f4b7c unspoolingPeak.cmd 4b3eb841b765c4aeb6b273e42a60e1f8ba3d3d94c613a27cd6446a354c2b7285 w.bat 4e54d7ed5055bc0e7858d49aaec17bd3ed69e8da94262c6a379ddd81abc31b5e cc.bat 90e9bd336e51c88002e5e9a109c5fb0e57d2c90cd54d4bc7480b69fa302beb73 tox5.exe d4dd79c97b091dd31791456c56d727eb0b30af9c0172dd221556d28495b8a50f Client.exe 5b8bf891808be44f24156cf5430730e610c0df6eaaa4b062623a7a675d234b62 Cleint_s.exe 17eccc7e2ce38dafd41d68861da636d7c05290b95d4fd75ec87b819094702cf6 Zfgufgfvezdnbcvjkzctpvfdj.dll 62cb24967c6ce18d35d2a23ebed4217889d796cf7799d9075c1aa7752b8d3967 HARDCODED IP'S OBSERVED FROM QAKBOT SAMPLES IP Port Observed Country AbuseIPDB Score 1.10.253.207 443 Thailand 0 2.89.78.130 993 Saudi Arabia 0 14.183.63.12 443 Viet Nam 0 27.73.215.46 32102 Viet Nam 0 31.166.116.171 443 Saudi Arabia 30 31.32.180.179 443 France 0 31.54.39.153 2078 United Kingdom 0 37.37.206.87 995 Kuwait 0 37.76.197.124 443 Palestine 0 41.103.226.172 443 Algeria 0 41.105.197.244 443 Algeria 0 41.107.78.223 995 Algeria 0 41.142.132.190 443 Morocco 0 41.69.103.179 995 Egypt 0 41.96.171.218 443 Algeria 0 45.160.124.211 995 Brazil 0 45.183.234.180 443 Brazil 0 45.241.140.181 995 Egypt 0 45.51.148.111 993 United States of America 0 46.116.229.16 443 Israel 0 46.186.216.41 32100 Kuwait 0 47.146.182.110 443 United States of America 0 61.105.45.244 443 Korea (Republic of) 0 61.70.29.53 443 Taiwan 0 62.114.193.186 995 Egypt 0 64.207.215.69 443 Afghanistan 0 66.181.164.43 443 Mongolia 0 68.129.232.158 443 United States of America 0 68.151.196.147 995 Canada 0 68.224.229.42 443 United States of America 0 68.50.190.55 443 United States of America 0 68.53.110.74 995 United States of America 0 70.49.33.200 2222 Canada 0 70.51.132.197 2222 Canada 0 70.81.121.237 2222 Canada 0 71.10.27.196 2222 United States of America 0 72.66.96.129 995 United States of America 0 72.88.245.71 443 United States of America 0 76.169.76.44 2222 United States of America 0 78.182.113.80 443 Turkey 0 81.214.220.237 443 Turkey 0 81.56.22.251 995 Italy 0 83.110.219.59 993 United Arab Emirates 0 84.238.253.171 443 Bulgaria 0 84.38.133.191 443 Netherlands 0 85.114.110.108 443 Palestine 0 85.139.203.42 32101 Portugal 0 85.98.206.165 995 Turkey 0 85.98.46.114 443 Turkey 0 87.220.229.164 2222 Spain 0 87.243.113.104 995 Bulgaria 0 87.75.195.211 443 United Kingdom 0 88.231.221.198 443 Turkey 0 88.231.221.198 995 Turkey 0 88.232.207.24 443 Turkey 0 88.242.228.16 53 Turkey 0 88.245.168.200 2222 Turkey 0 88.246.170.2 443 Turkey 0 88.251.38.53 443 Turkey 0 89.211.217.38 995 Qatar 0 89.211.223.138 2222 Qatar 0 91.116.160.252 443 Spain 0 94.99.110.157 995 Saudi Arabia 0


95.136.41.50 443 Portugal 0 98.180.234.228 443 United States of America 0 99.232.140.205 2222 Canada 0 99.253.251.74 443 Canada 0 100.1.5.250 995 United States of America 0 102.101.231.141 443 Morocco 0 102.184.151.194 995 Egypt 0 102.38.97.229 995 South Africa 0 102.40.236.32 995 Egypt 0 105.105.104.0 443 Algeria 0 105.111.60.60 995 Algeria 0 105.99.80.23 443 Algeria 0 109.155.5.164 993 United Kingdom 0 109.200.165.82 443 Yemen 0 110.4.255.247 443 Japan 0 113.22.102.155 443 Viet Nam 0 118.174.200.169 995 Thailand 0 118.216.99.232 443 Korea (Republic of) 0 118.68.220.199 443 Viet Nam 0 119.42.124.18 443 Thailand 0 119.82.111.158 443 India 0 123.240.131.1 443 Taiwan 1 134.35.9.144 443 Yemen 0 138.0.114.166 443 Brazil 0 139.195.132.210 2222 Indonesia 0 139.195.63.45 2222 Indonesia 0 141.164.254.35 443 Saudi Arabia 0 151.234.63.48 990 Iran (Islamic Republic of) 0 154.181.203.230 995 Egypt 0 154.238.151.197 995 Egypt 0 154.246.182.210 443 Algeria 0 156.213.107.29 995 Egypt 0 156.219.49.22 995 Egypt 0 160.152.135.188 2222 Nigeria 0 160.176.204.241 443 Morocco 0 167.60.82.242 995 Uruguay 0 169.1.47.111 443 South Africa 0 171.238.230.59 443 Viet Nam 0 171.248.157.128 995 Viet Nam 0 173.218.180.91 443 United States of America 0 176.42.245.2 995 Turkey 0 177.255.14.99 995 Colombia 0 179.108.32.195 443 Brazil 0 179.223.89.154 995 Brazil 0 179.24.245.193 995 Uruguay 0 180.180.131.95 443 Thailand 0 181.111.20.201 443 Argentina 0 181.118.183.123 443 Argentina 0 181.127.138.30 443 Paraguay 0 181.231.229.133 443 Argentina 0 181.56.125.32 443 Colombia 0 181.80.133.202 443 Argentina 0 181.81.116.144 443 Argentina 0 182.213.208.5 443 Korea (Republic of) 0 184.82.110.50 995 Thailand 0 184.99.123.118 443 United States of America 0 186.105.182.127 443 Chile 0 186.120.58.88 443 Dominican Republic 0 186.154.92.181 443 Colombia 0 186.167.249.206 443 Venezuela (Bolivarian Republic of) 0 186.50.245.74 995 Uruguay 0 187.205.222.100 443 Mexico 0 188.157.6.170 443 Hungary 0 189.19.189.222 32101 Brazil 0 190.158.58.236 443 Colombia 0 190.44.40.48 995 Chile 0 190.59.247.136 995 Trinidad and Tobago 0 191.254.74.89 32101 Brazil 0 191.84.204.214 995 Argentina 0 191.97.234.238 995 Argentina 0 193.3.19.37 443 Russian Federation 0 194.166.205.204 995 Austria 0 194.49.79.231 443 United States of America 0 196.112.34.71 443 Morocco 0 196.92.172.24 8443 Morocco 0 197.11.128.156 443 Tunisia 0 197.204.243.167 443 Algeria 0 197.49.50.44 443 Egypt 0 197.94.84.128 443 South Africa 0 201.177.163.176 443 Argentina 0 210.195.18.76 2222 Malaysia 0 211.248.176.4 443 Korea (Republic of) 0 212.156.51.194 443 Turkey 0 219.69.103.199 443 Taiwan 0 220.116.250.45 443 Korea (Republic of) 0 ADDITIONAL IP'S OBSERVED IP Domain Country Abuseipdb Score 23.106.123.13 NA Singapore 0 23.106.160.141 danimos[.]com United States of America 0 23.19.58.43 zedorocop[.]com United Kingdom 0 23.29.115.172 NA United States of America 0 45.132.226.209 NA Switzerland 3 45.134.22.54 NA Italy 0 45.153.241.64 NA Germany 0 45.61.138.29 NA United Kingdom 0 45.86.200.21 NA Netherlands 0 45.86.200.77 NA Netherlands 0 45.89.242.2 NA United Kingdom 1 47.87.229.39 temp[.]sh United States of America 0 64.52.80.212 NA United States of America 0 78.141.213.249 NA Netherlands 0 104.194.10.130 NA United States of America 0 104.243.38.65 NA United States of America 0 138.199.59.52 NA Poland 0 146.70.106.61 NA Netherlands 0 146.70.86.44 gerhiles[.]com Netherlands 0 151.236.28.34 NA Netherlands 0 172.93.100.71 NA United States of America 0 176.10.80.37 NA United Kingdom 0 176.90.193.145 NA Turkey 0 185.163.110.124 NA Romania 0 185.77.218.10 NA Finland 0 194.37.97.161 NA United States of America 0 194.5.53.215 NA France 0 194.5.53.86 NA France 0 207.229.167.36 NA United States of America 100 212.30.37.227 NA Netherlands 0 INDEX B: MALWARE ANALYSIS LAB AND TOOL OVERVIEW


The analysis host ran the Linux distro "REMnux."


Upon startup, an iptables setup script was ran containing all the hardcoded C2 IP’s for the Qakbot malware.


Additional software used during the analysis includes:


Wireshark:


Network packet capture and analysis Inetsim: An "Internet Simulation" tool which creates fake http and other services for malware samples to interact with.


Readpe.py: Used to read Portable Executable files.


HOST 2: EXPERIMENTAL HOST


The experimental host rans Windows 10 build 19041.


NXlog is installed on this host.


Windows logging is forwarded to Host 3.


Host 1 is configured to be the internet gateway.


Interactive debugging program.


Regshot: Captures a "snapshot" of the registry before and after detonation of a sample to observe the changes on the host.


Network packet capture and analysis.


Qakbot Registry Decryption Tool: Used to decrypt Qakbot registry entries.


HOST 3: LOGGING HOST The logging host runs Debian 11.


[CISCO-SECUREENDPOINT] Event Engine Detection 5008356


[WINDOWS-CLIPBOARD] Get-ADGroupMember Command 5008362


[WINDOWS-CLIPBOARD] Get-ADUser Command 5008363


[WINDOWS-CLIPBOARD] Service being stopped 5008364


[WINDOWS-CLIPBOARD] Powershell Policy Bypass Command 5008365


[WINDOWS-CLIPBOARD]


[WINDOWS-CLIPBOARD] Uninstall Windows Defender Command 5008368


[WINDOWS-CLIPBOARD] Remoe-exec psexec command 5008369 [WINDOWS-CLIPBOARD]


Powershell encodedcommand 5008370 [WINDOWS-CLIPBOARD] rundll32 command 5008371


[WINDOWS-CLIPBOARD] rundll32 command with DllRegisterServer 5008372


[WINDOWS-CLIPBOARD] net commands 5008373 [WINDOWS-CLIPBOARD] net commands 5008374 [WINDOWS-CLIPBOARD] query user command 5008375


[WINDOWS-CLIPBOARD] copy from share drive to local C: command 5008380


[WINDOWS-SECURITY] Service being stopped by net command v2 5008344


Disable Windows Security 5008347


[WINDOWS-SECURITY] Exfil software rclone detected 5008354 [WINDOWS-SECURITY]


A service was installed in the system (powershell) 5008357 [WINDOWS-SECURITY]


A service was installed in the system (DllRegisterServer) 5008358 [WINDOWS-SECURITY]


A service was installed in the system (rundll32 .xls) 5008359 [WINDOWS-SECURITY]


A service was installed in the system (rundll32 public directory) 5008360 [WINDOWS-SECURITY]


Blackbasta ransomware file extension detected (.basta)


[WINDOWS-SYSMON] Rundll32 network connection detected 5008346


[WINDOWS-SYSMON]


Possible Traversal - File created in Public directory 5008349


[WINDOWS-SYSMON] Possible hidden service installed 5008350


[WINDOWS-SYSMON] Process Injection - Rundll32 remote thread into winlogon 5008353 [WINDOWS-SYSMON] Safeboot Registry Entry - Possible Blackbasta 5008399 INDEX D: REFERENCES -Deepinstinct’s review of similar Black Bast activityhttps://www.deepinstinct.com/blog/black-basta-ransomware-threat-emergence -Northwaves review of similar Black Basta activity to include the use of Qbot and Ransomware https://northwave-security.com/en/black-basta-blog/ -VirusTotal results for the file has of zfgufgfvezdnbcvjkzctpvfdj.dll, indicating Brute Ratel https://www.virustotal.com/gui/file/62cb24967c6ce18d35d2a23ebed4217889d796cf7799d9075c1aa7752b8d3967 -Brute Ratel and the use of PSEexc showing use of SMB for Remote Control:https://bruteratel.com/tabs/badger/commands/psexec/ -Brute Ratel and RPC Services:https://bruteratel.com/tabs/badger/commands/services/ -Recent warning regarding use of RCLONE by threat actors "Daixin Team" https://www.cisa.gov/uscert/ncas/alerts/aa22-294a -Qakbot Registry Decryption Tool https://github.com/drole/qakbot-registry-decrypt -Cybercheif recipe to extract and decode Shellcode from Bobal Strike Beacon https://gist.github.com/0xtornado/69d12572520122cb9bddc2d6793d97ab -Decoding of files similar to "w.bat" https://superuser.com/questions/1676713/how-to-decode-contents-of-a-batch-file-with-chinese-characters -Quadrant’s Github page for the Sagan Log Analysis Enginehttps://github.com/quadrantsec/sagan-rules For more information regarding this analysis interested parties should contact cclark@quadrantsec.com


APT & Targeted Attacks Earth Preta’s Cyberespionage Campaign Hits Over 200

Earth Pretas Cyberespionage Campaign Hits Over 200


We present a case study of the cyberespionage efforts by Earth Preta.


Through extensive analysis and as of this writing, we discovered over 200 victims, leading to a wider intelligence analysis of the groups’ goals, different operation groups, and tactics, techniques, and procedures (TTPs).


Key findings While not exhaustive of the entire study’s findings due to security and confidentiality concerns, we determined the following findings key to the entire research:


Earth Preta has a centralized development unit that produces the implants and tools, and disseminates them to other operational groups responsible for penetration and implantation.


This is evident in the Earth Preta group as it appears that multiple sub-operational groups use the same toolset with different techniques.


A management of expertise.


The different operational groups manage their own methods of entry and privilege escalation, demonstrating a high degree of specialization within each group.


Towards the end of 2022, there were changes in how information was collected.


The latest active targets were related to maritime, shipping, border control, and immigration agencies.


These key findings can help intelligence communities and decision-makers in understanding Earth Preta’s capabilities, objectives, and impact on international security and intellectual property.


Method and findings We found that some operational part of the collective group were focused on stealing intellectual property and sensitive business information, while others targeted government and diplomatic entities.


We also found the operations having specific geographical regions for which they tailored their collection requirements.


Earth Preta’s top 10 targeted industries We used a qualitative approach to identify the collection requirements, methods, and objectives of the operational groups and their respective places in the organization.


We established links between the operational threat groups by grouping overlaps in victimology and identifying core indicators, such as implants or payloads. Figure 2.


Earth Preta’s targeted regions Case studies Overlaps Throughout our investigation, we observed several instances where victims were compromised by two groups simultaneously, indicating possible overlaps in collection requirements between these groups.


While there are no indications of overlaps in individual devices, there are strong indications of targets intersecting, suggesting these groups are pursuing similar objectives.


Additionally, the overlaps among victims indicate a lack in targeting coordination and/or planning within the overall groups' leadership or management.


These targeting overlaps have been observed in multiple groups, such as Groups 724, 1358, and 5171.


Since these groups operate across a variety of sectors, it is likely that the overlap in collection requirements is the result of similar objectives rather than coordination between the toolset and collected materials.


However, we have not been able to identify any evidence of coordination between these groups or a shared toolset.


Several victims in key countries, such as Singapore, Vietnam, Netherlands, Ghana, and Myanmar, have indications of files exfiltrated via a dedicated USB mass storage device.


For instance, in January 2023, a device from Vietnam loaded the Adobe CEF Helper under the path <C:\Users\XXX\AAM


UpdatesXXX\AAM Updates.exe>


The same device also carried out another collection in December 2022, where data was copied from folder <C\:$RECYCLE.BIN\S-XXXXX$XXXH.pdf>, indicating that the user deleted the collected data.


Our analysis indicated that toward the end of 2022 and early 2023, all documented intrusions from Group 1358 used USB mass storage devices.


In addition, there were multiple instances where initial compromise occurred while the assets of the target were roaming abroad through a technique known as the “traveling laptop attack.”


Small sample of Earth Preta’s traveling laptop attack deployments and victims APT subgroups responsible for attack Victim organization’s industry, country Country where attack was deployed from Group 724 Maritime, Australia Papua New Guinea Group 1358 Construction, France Togo Group 5171 NGOs, Africa N/A This mix of traditional intelligence trade craft and cyber techniques could mean that these groups have access to advanced resources and support from nation states, since such techniques are not typically available to independent hackers.


Moreover, this approach could signify the growing convergence of cyber- and physical security as cyberattacks continue to move beyond digital systems and into the physical world.


Operation groups While this is not a comprehensive list, we summarize and attribute the operational functions to specific groups as contributing units to Earth Preta’s cyberespionage activities and deployments.


As we continue following this campaign and track its activities, these group names will be updated accordingly once analyses and attribution are confirmed.


Group 724 Group 724 is possibly related to Earth Preta.


The group utilizes sideloading with Adobe CEF Helper to establish a persistent foothold in the user's home directory, employing a naming convention with one of the following patterns: AcroRD32XXX AAM UpdatesXXX AcrobatXXX Eset Malware ProtectionXXX "XXX" denotes three random letters.


This group is considered one of the most dangerous in the Southeast Asian region and has been known to target a myriad of organizations.


This targeted approach indicates that the group has developed a clear understanding of the vulnerabilities and high-value assets present in these industries.


With this preference for a physical entry vector, the group can increase the chances of a successful intrusion and maintain its covert operations.


This technique highlights the level of sophistication and planning that goes into Group 724's attacks.


The group has been observed utilizing Avast’s WSC DLL for sideloading, a technique leveraging the Windows Management Instrumentation (WMI) service to execute malicious code.


Persistence is established at ProgramData\AvastSvcXXX, where "XXX" represents three random letters.


The group uses generic USB mass storage devices as an entry point, suggesting that they prioritize ease of access over customization.


The group's victimology is extensive, targeting organizations across various sectors globally.


However, recent observations suggest that the group has shifted its collection efforts towards maritime-related information since December 2022.


Targets have included shipping information, sea vessel movements, border and immigration control, export-related government agencies, food production, and humanitarian groups.


While some of the targets are related to maritime research and development, most of the information we found as targeted pertain to operational maritime information, even to the extent of compromising specific vessels or tugboat companies.


Exfiltration methods utilized involve the use of USB sticks that are plugged in, enabling the PlugX tool to copy all collected data into a previously known and expected USB stick.


This technique allows the group to remain undetected and avoid detection by traditional security measures.


Group 5171 Group 5171 is a threat actor that utilizes advanced techniques to infiltrate and compromise targets across the Middle East and Europe.


Group 5171 differentiates itself from other threat actors with their use of the travelling laptop attack.


This technique involves infecting a laptop with malicious code in transit.


Usually, the device will be travelling as part of a routine work travel and upon return to the origin country, a more elaborate exploitation and lateral movement can be initiated.


Conclusion We deem the findings of this research on Earth Preta’s cyberespionage operations have significant implications for international security and intellectual property.


There are strong indications of intertwined traditional intelligence tradecraft and cyber collection efforts, indicative of a highly coordinated and sophisticated cyberespionage operation.


We identified several distinct operational groups, each with unique TTPs and objectives, which reveals a highly specialized and organized cyberespionage operation.


This study also suggests that Earth Preta’s cyberespionage operations have a broad reach and have the capacity to target high value targets.


The shift in collection priorities toward intelligence regarding specific areas also indicates that Earth Preta is targeting critical infrastructure and key institutions that can affect national and international relations, economies, and securities.


The international community must raise awareness on the threats posed by Earth Preta’s cyberespionage operations, promote information sharing, and develop effective countermeasures.


For a list of the IOCs, download the appendix here.


Authors Trend Micro Research, News, and Perspectives


Specifically, the domain oracle.zzhreceive[.]top was originally linked to TeamTNT operations due to the usage of the term zzhreceive, which has been witnessed within several TeamTNT operations.

Updated New Evidence Emerges to Suggest WatchDog Was Behind Crypto Campaign


Given recent developments and the growing analytic visibility within the cloud research community, this domain has now been attributed to the cryptojacking operations associated with the group WatchDog.


Executive Summary The copying and incorporation of cryptomining operational codebase or script functions have become a central behavioral indicator of cryptojacking groups and their operations.


Unit 42 researchers have identified tactics, techniques and procedures (TTPs) used by the TeamTNT cryptojacking group being used by the WatchDog cryptojacking group.


For instance, the new scripts do not: Researchers have also observed that the new WatchDog scripts do not use the exploit-laden GoLang binaries traditionally associated with WatchDog.


While WatchDog is believed to be the author of these new scripts, several of the scripts were found within TeamTNT-owned public malware repositories.


Most notably, TeamTNT was reported to have copied the code used to detect and remove Alibaba Cloud Security from compromised instances from the Kinsing group.


Also, cryptojacking groups such as “Rocke” began as a forked GitHub repository from the cryptojacking operation created by “The 8220 Mining Group.”


This operation shares up to 30% of its cryptomining code base with tools developed by the group “Pacha.”


Pacha and Rocke were subsequently involved in a documented crypto war, which has lasted nearly two years.


While little research has been written on recent Pacha operations, Rocke is still developing new malware.


Palo Alto Networks customers running Prisma Cloud are protected from the threats presented in this report through the Runtime Protection feature, Cryptominer Detection feature and the Prisma Cloud Compute Kubernetes Compliance Protection, which alerts on an insufficient Kubernetes configuration and provides secure alternatives.


Additionally, Palo Alto Networks VM-Series and CN-Series products offer cloud protections that can prevent network connections from cloud instances toward known malicious IP addresses and URLs.


These samples, first witnessed on Dec. 5 and 11, 2020, respectively, show the direct replacement of the known WatchDog C2 infrastructure with new C2 infrastructure.


WatchDog infrastructure replacement.


These two samples contain a hardcoded Monero (XMR) wallet address and an associated mining pool, as shown in Figure 3. Figure 3.


Monero wallet and associated mining pool.


Mining Pools If these changes are indeed new TeamTNT behaviors, which is highly unlikely, it would represent the first time the TeamTNT cryptojacking operations have used a mining pool outside their traditional Monero mining pool, MoneroOcean[.]stream.


This cryptojacking operation introduces two new mining pools never before known to be used by TeamTNT actors, but have been witnessed within WatchDog operations.


The new mining pools are both instructed to use the Monero wallet address, 43Xbgtym2GZWBk87XiYbCpTKGPBTxYZZWi44SWrkqqvzPZV6Pfmjv3UHR6FDwvPgePJyv9N5PepeajfmKp1X71EW7jx4Tpz.


Nanopool mining operation.


F2pool mining operation.


Mining Pool Worker Information Of note are the names of the mining pool workers associated with this Monero wallet address within the mining pools.


According to nanopool[.]org records related to this Monero wallet address, there are a total of 20 unique workers, as shown in Figure 6. Figure 6.


Nanopool mining operation workers.


The following table, Table 1, lists 19 of the currently known malicious samples which contain the Monero wallet address, the Nanopool mining pool and the name of one of the workers listed within Figure 6. SHA256 Worker 0414946ab4bced2c1c41f4b8a75be672b34bbdee6f29e0a0bf7946b93f7044b1 3910 34b547b567309618422d7075322ddf5b9e0b3a4fb652f3845d12fd649f23923e 3910 62957aa4421c044927269e9bf3300515cf01225fd4c3c3811f8ebfac7a9f8585 3910 f235c021baa6c8801e724d45003b1b1541eea5483810abc9c3eb4df6bf05afbf 3910 2bc6c21d35ed63b135b4723444a9ac532e4cb6aaa2bbd63c557136edb4e4756f crondk1 cbf54a9e5771fcb3760e4e282f003a879164e76b9df9fed0fe4e4e8aaaef11ae crondk1 428633aee75f7c69a7c0612e591d5fcecbcf13619d6c05b86c8303a248c7c8d7 dk2 7b6f7c48256a8df2041e8726c3490ccb6987e1a76fee947e148ea68eee036889 dk2 10fb8d16f7d168340be28c6d0ba94e10c15370c8747d97bc0e5fad4b4466cf09 dream 3b280a4017ef2c2aef4b3ed8bb47516b816166998462899935afb39b533890ad dream 8adc8be4b7fa2f536f4479fa770bf4024b26b6838f5e798c702e4a7a9c1a48c6 dream af611a41c55e9afcfaced8b067a470caa70825fce0a44167f44a8d3880ae6674 dream e1d7014b84618cd7fbf94439c78fe7d67f351cbc5536885fa3d94ea15325d83b dream eca42c42f0909cf4e6df6bf8de35ab93ef6a3dd10d0d5e556721ec1871a9990c dream ae6822d1fd097e8c52cea3731cd49f50600b7da83e9f0ea6dbc689685f907739 dream3 3b280a4017ef2c2aef4b3ed8bb47516b816166998462899935afb39b533890ad dream5 ae3e4a1c8a2b661265e6c8c756e3ba472dc7177cae79fe1861ab0c2d1af5167a dream6 8adc8be4b7fa2f536f4479fa770bf4024b26b6838f5e798c702e4a7a9c1a48c6 dream8 33da23085fb6fd7aad89e0c55b7ccbc2ee50fec4e8e31030e4b2a4ef034ac5f6 pokemon2 Table 1.


There were also 13 malicious samples containing the 43Xb Monero wallet address, but these samples are designed to use the f2pool[.]com mining pool instead of the nanopool[.]org Monero mining pool (see Table 2).


SHA256 Worker WatchDog Wallet f235c021baa6c8801e724d45003b1b1541eea5483810abc9c3eb4df6bf05afbf 3910 3d8a6f5d8162e8eb78e7b95384ec6418f65b904dffa8fd983a6a19a5645ad707 clean c141eaeab461a2481124a73ee2d254301573d8722dbf3221f5fc54d7770e67a2 clean Yes 64072e7c56895f59124c4e26e0dd65a4de0bd8280c83372c18f9835978cda0e9 clean 30f0207b74d6d2d17cd8f4dc9f9131bd8763702f19c87ce74ea13a634f52c995 clean Yes 7a8c91f4228be4d36e1087acc9bb046373ddfde506fe4645ad1b0967c08bfa8b clean Yes 7848fc64c9977796dcc0ee67c293f006d715d3b3e257a3c0f4654cefab637c45 clean Yes 3e6cf5ae8ce6ff7305da4e218a20ec7f57933235ec07d7ff6e6a18c7c844ff29 clean Yes 8d9bdcae4a4559e52b3d03209a1ef880e948d9f3969f7779119d9322c5f7cf7c clean Yes ab73aedbee66081cd047b19a4bb036f85791a9ae9abc90545c5d8756bbc2a428 clean Yes eca42c42f0909cf4e6df6bf8de35ab93ef6a3dd10d0d5e556721ec1871a9990c dream e47802d7f44fc9e594b89ef33298367d21695d5ec1ae5e6c526b9f3124c555ca Undefined cf890e288f4fb7a2cfb0aa7e91229cc51c224e767c6ca69bbbb9d06e999ede64 Undefined Table 2.


Seven samples within the previous table contain instructions to find and remove any processes using the WatchDog-identified 43XB Monero wallet address, as shown in Figure 7. Figure 7.


The scripts will then rebuild mining operations and begin using two known WatchDog Monero wallet addresses, 82etS8QzVhqdiL6LMbb85BdEC3KgJeRGT3X1F3DQBnJa2tzgBJ54bn4aNDjuWDtpygBsRqcfGRK4gbbw3xUy3oJv7TwpUG4 and 87q6aU1M9xmQ5p3wh8Jzst5mcFfDzKEuuDjV6u7Q7UDnAXJR7FLeQH2UYFzhQatde2WHuZ9LbxRsf3PGA8gpnGXL3G7iWMv.


These two Monero wallets are just two of the three known Monero wallets that are associated with the WatchDog cryptojacking group.


Of note, the IP address listed within Figure 8, 139.99.102[.]72, resolves to the previously mentioned xmr-asia1.nanopool[.]org mining pool.


WatchDog Monero wallet addresses.


Linking WatchDog Infrastructure to TeamTNT The URL addresses and Monero wallet address, 87A5fSCR98nFSR9NCRxt6UFytca3hJXaRdDgf9NxhWTjT3q3AA8HECyZ1FdF93D5LPXsSqS8dKNsxCxafrbuVeZfMW3V7ib, specifically called out within the sample 36bf7b2ab7968880ccc696927c03167b6056e73043fd97a33d2468383a5bafce (see Figure 9), are known WatchDog indicators.


Known WatchDog indicators of compromise (IoCs), as well as the TeamTNT email address.


Now to the malware sample, 8adc8be4b7fa2f536f4479fa770bf4024b26b6838f5e798c702e4a7a9c1a48c6, which contains the new WatchDog Monero wallet, as shown in Figure 10.


With the presence of the C2 infrastructure from these new scripts, Figure 9 and Figure 10, both of which use the WatchDog directory, b2f628, there is a clear link to the TeamTNT infrastructure.


The domain oracle.zzhreceive[.]top resolves to the IP address 199.19.226[.]117, which is also the resolution IP address for the known TeamTNT subdomain zzhrecieve.anondns[.]net.


The usage of the anondns[.]net domain has been linked to several TeamTNT campaigns across multiple reports including, irc.anondns[.]net, ircbd.anondns[.]net, sampan.anondns[.]net and teamtntisback.anondns[.]net.


Additionally, the 199.19.226[.]117 system has also been linked to WatchDog operations through the toolkit file 1.0.4.tar.gz, 51de345f677f46595fc3bd747bfb61bc9ff130adcbec48f3401f8057c8702af9, which was hosted on hxxp://global.bitmex[.]com[.]de/cf67355a3333e6/1.0.4.tar.gz and contains C code for the masscan utility, which is the same toolkit used in the TeamTNT operations.


The bitmex[.]com[.]de URL had previously been linked to the WatchDog cryptojacking group.


TeamTNT Malware Repository


The malware repository 85.214.149[.]236:443/sugarcrm/themes/default/images/ contains known TeamTNT malware that includes the same files as the known TeamTNT repository hxxp://dockerupdate.anondns[.]net:443/sugarcrm/themes/default/images/, which is linked to TeamTNT via the malware sample 1aaf7bc48ff75e870db4fe6ec0b3ed9d99876d7e2fb3d5c4613cca92bbb95e1b, as shown in Figure 11.


See the appendix for a full listing of the known TeamTNT malware metadata collected from the malware repository.


The malware sample 0414946ab4bced2c1c41f4b8a75be672b34bbdee6f29e0a0bf7946b93f7044b1 is of note in this context as it contains the hardcoded IP address, 199.19.226[.]117, as well as the hardcoded Monero wallet address associated with the nanopool and f2pool mining pools, and the mining workers previously discussed (Figures 12 and 13).


WatchDog directory using TeamTNT infrastructure.


Within the spread/redis directory, the file b.sh, 3b14c84525f2e56fe3ae7dec09163a4a9c03f11e6a8d65b021c792ad13ed2701, was found, which directly links TeamTNT to the cryptojacking operations expressed in this report.


TeamTnT repository containing the b.sh script.


It also contains a hardcoded link to a known TeamTNT cloud enumeration script hosted on the known TeamTNT domain borg[.]wtf, see Figure 16. Figure 15.


TeamTNT and WatchDog XMR wallet and IP address.


The borg[.]wtf domain was linked to TeamTNT via a previous Unit 42 report.


Conclusion Considering the above evidence, it appears that WatchDog operations have incorporated the TTPs of the TeamTNT cryptojacking group and have significantly increased their own cryptojacking operations.


The new WatchDog operation does not appear to use the advanced functionalities TeamTNT has used recently, namely cloud credential scraping as well as targeted Kubernetes- and Docker-focused lateral movement and exploit scripts.


The following tips are highly recommended by Unit 42 researchers to assist in the protection of cloud infrastructure.


Monitor and block network traffic to known malicious endpoints.


Use cloud endpoint agents to monitor and prevent the running of known malicious applications within cloud infrastructure.