This includes inline traffic filtering and management security solutions deployed at access and distribution layers in the network, as well as out of band solutions like NAC, SIEM or User Behavior Analysis to provide identity-based network access and gain more visibility into the user’s access to critical network resources.


However, layered security defenses face the major and recurring challenge of detecting newer exploitation techniques as they heavily rely on known behaviors.

Detecting Credential Stealing Attacks Through Active InNetwork Defense


Additionally, yet another significant challenge facing the enterprise network is detecting post-exploitation activities, after perimeter security is compromised.


They will use several sophisticated techniques to perform internal reconnaissance and remote code execution on critical resources, which range from using legitimate operating system tools to discover network assets to using novel code execution techniques on the target.


Consequently, differentiating between the legitimate and malicious use of Windows’ internal tools and services becomes a high priority for enterprise networks.


To tackle this long-standing problem of detecting lateral movement, enterprise networks must formulate active in-network defense strategies to effectively prevent attackers from accessing critical network resources.


Detecting credential stealing attacks with deception essentially requires building the necessary infrastructure by placing the decoy systems within the same network as production assets and configuring them with decoy contents to lure the attackers towards the decoy machines and services.


Some of the techniques described by MITRE Shield Matrix with respect to network deception are as below: MITRE Shield Description ATT&CK Technique Decoy Account – DTE0010 A decoy account is created for defensive or deceptive purposes.


The decoy account can be used to make a system, service, or software look more realistic or to entice an action Account Discovery, Reconnaissance Decoy Credentials – DTE0012 Seed a target system with credentials (such as username/password, browser tokens, and other forms of authentication data) Credential Access, Privilege Escalation Decoy Diversity – DTE0013 deployment of decoy systems with varying Operating Systems and software configurations Reconnaissance Decoy Network – DTE0014 Multiple computing resources that can be used for defensive or deceptive purposes Initial Access Decoy Personna – DTE0015 Used to establish background information about a user.


In order to have the adversary believe they are operating against real targets Initial Access, Discovery, Reconnaissance Decoy System – DTE0017 Computing resources presented to the adversary in support of active defense Reconnaissance Over the course of this paper, we will discuss some of the widely adapted credential theft attacks executed by adversaries after the initial compromise and then move on to discuss defense techniques against the above MITRE Shield attacks and how to use them effectively to detect deceptive credential usage in the network.


Network Deception – An Active in-network defensive approach Most of the targeted attacks involve stealing credentials from the system at a certain point in time as attackers would use them to pivot to other systems in the network.


Active in-network defense strategies described by the MITRE Shield matrix are significant and play a critical role in detecting credential abuse in the network.


It involves placing decoy systems, decoy credentials and decoy contents all throughout the production network essentially converting it into a trap, playing a crucial role in mitigating the attacks.


More details on configuring policies and a demo are available here.


McAfee MVISION Endpoint Detection and Response (EDR) has the capabilities to detect credential access from tools like Mimikatz.


With McAfee MVISION EDR and ENS integration with Attivo’s network and endpoint deception sensor, McAfee can manage its agents and receive alerts for detections in ePO and EDR.


Lateral Movement – Introduction Lateral movement refers to the tools and techniques used by attackers to progressively expand their foothold within an enterprise network after gaining initial access.


As shown in the figure below, lateral movement activity comprises of several stages starting from credential theft, target enumeration and discovery, privilege escalation, gaining access to network resources and eventually remote code execution on the target before exfiltrating data to accomplish a successful attack.


Once inside the network, attackers will deploy a range of techniques at each stage of lateral movement to achieve their end goal.


To achieve this, an attacker might choose to embed the tool within a malicious executable or use the operating system’s internal legitimate tools and services to perform its lateral movement operations, consequently making this network traffic harder to distinguish.


As per the Verizon DBIR report 2020, over 80% of data breaches involve credential theft attacks.


It will usually be the first step towards lateral movement strategies which will allow attackers to elevate their privileges and acquire access to other network resources.


Figure 1 – Stages of Lateral movement To be able to distinguish between the admissible and malicious use of these inbuilt services, it is extremely critical for organizations to deploy advanced Threat Detection solutions.


Credential Theft Attacks Attackers use a variety of tools and techniques to execute credential theft attacks.


Operating systems like Windows implement Single Sign


Additionally, user credentials are stored in memory in a variety of formats like NTLM hashes, reversibly encrypted plaintext, Kerberos tickets, PINs, etc., which can be used to authenticate to services depending upon the supported authentication mechanism.


Consequently, these attacks pose major security concerns, especially in the domain environment if the attacker gains access to privileged credentials which can then be reused to access critical network resources.


In the following sections, we discuss some of the widely adapted credential stealing techniques used by malware, with respect to the Windows operating system.


Similar credential stealing techniques can also be used with other operating systems as well.


Stealing Credentials from LSASS Process Memory The Local Security Authority Subsystem Service (LSASS) process manages and stores the credentials of all the users with active Windows sessions.


These credentials stored in the LSASS process memory will allow users to access other network resource such as files shares, email servers and other remote services without asking them for the credentials again.


LSASS process memory stores the credentials in many formats including reversibly encrypted plaintext, NTLM hashes, Kerberos Tickets (Ticket Granting Tickets, etc.).


Figure 2 – Checking for required privileges We can see that the NTLM hash of the user’s credentials is revealed, and this can be brute forced offline as shown below.


Instead, they use recompiled clones of it with minimal functionality to avoid noise.


Yet another approach is to dump the LSASS process memory using process dumping tools, exfiltrate the dump and extract the credentials offline.


Microsoft has documented multiple ways to configure additional LSASS process protection which can prevent credentials being compromised.


The SAM database file is in %SystemRoot%system32/config and the hashes of the credentials are within the registry HKLM\SAM.


Attackers need to acquire elevated privileges to be able to access the credentials from the SAM database.


The example below demonstrates how the credentials from the SAM database can be revealed through a simple Meterpreter session.


Figure 5 – Dumping SAM database Stealing Credentials from Windows Credential Manager (CredMan) Windows Credential Manager stores the Web and SMB/RDP credentials of users if they choose to save them on the Windows machine, thereby preventing the authentication mechanism from asking for those passwords again on subsequent logins.


Consequently, any process running in the context of the logged in user will be able to decrypt the credentials using CryptUnProtectData DPAPI.


In the domain environment, these credentials can be used by attackers to pivot to other systems in the network.


Data Protection APIs provide the cryptographic functionalities that can be used to securely store credentials and keys.


These APIs are used by several other Windows components like browsers (IE/Chrome), certificates and many other applications as well.


Figure 6 – Dumping browser credentials DPAPI can be abused in multiple ways.


In the Active Directory domain joined environment, if other users have logged into the compromised machine, provided a malware is running with escalated privileges, it can extract other user’s master keys from the LSASS memory which can then be used to decrypt their secrets.


Figure 7 – Extracting DPAPI Master Key Malware also tends to use multiple variants of credential enumeration APIs available within Windows.


Below is one instance of the malware using CredEnumerateW API to retrieve credentials and then search for terminal services passwords which It would use to pivot to other systems.


Figure 8 – Extracting credentials using Windows API Stealing Service Account Credentials Through Kerberoasting In the domain joined environment, the Kerberos protocol has a significant role to play with respect to authentication and requesting access to services and applications.


It provides Single-Sign-On functionality for accessing multiple shared resources within the enterprise network.


The Kerberos authentication mechanism in Active Directory involves multiple requests and responses like Ticket Granting Ticket (TGT) and Ticket Granting Service (TGS) supported by a Key Distribution Server (KDC), usually a Domain Controller.


Upon successful authentication, a user will be able to access the respective services.


These SPN values are used by Kerberos to map the instance with the logon account allowing the client to authenticate to the respective service.


Well known SPN values are listed out here.


Details on how the SPN values are registered and used in Kerberos authentication is documented here.


This ticket can be extracted from the memory and can be brute forced offline to acquire service account credentials, allowing a domain user to gain admin level access to the service.


Kerberoasting is a well-documented attack technique listed in MITRE ATT&CK and it essentially abuses the Kerberos authentication allowing adversaries to request the TGS Tickets for the valid service accounts and brute force the ticket offline to extract the plain text credentials of the service accounts, consequently enabling them to elevate their privileges from domain user to domain admin.


A simple PowerShell command after importing the Active Directory PowerShell module, as shown below, can initiate the LDAP query to get information about all the user accounts from the Domain Controller with the SPN value set. Figure 9 – PowerShell command to generate LDAP query Attackers can specifically choose to scan the domain for MSSQL service with the registered SPN value used for Kerberos authentication.


PowerShell scripts like GetUserSPNs can scan all the user SPNs in the domain or MSSQL service registered in the domain with Discover-PSMSSQLServers or Invoke-Kerberoast scripts.


Figure 10 – Kerberoasting PowerShell script output Once an attacker has the SPN value of the SQL service, a Kerberos Ticket Granting Service Ticket request (TGS-REQ) can be initiated to the domain controller with the SPN value.


Stealing Credentials from Active Directory Domain Service (ntdis.dit) File As indicted earlier, once an attacker has penetrated the domain network, it will be natural to progress towards targeting critical assets, such as the Active Directory controller.


The Ntds.dit file is the authoritative store of credentials for all the users in the domain joined environment, storing all the information about the users, groups and memberships, including credentials (NT Hashes) of all the users in the domain with historical passwords and user’s DPAPI backup master keys.


An Attacker with domain admin rights can gain access to the Domain Controller’s file system and acquire credentials like hashes, Kerberos tickets and other reversibly encrypted passwords of all the users joined in the domain by dumping and exfiltrating the Ntds.dit file.


Multiple techniques can be used to dump the Ntds.dit file from the Domain Controller locally as well as remotely and extract the NTLM hashes/DPAPI backup keys for all the domain joined users.


One of the techniques is to use the Volume Shadow Copy Service using the vssadmin command line utility and then extract the Ntds.dit file from the volume shadow copy as shown below.


Figure 12 – Dumping Volume shadow copy for C drive Sensitive data on Active Directory is encrypted with the Boot Key (Syskey) stored in the SYSTEM registry hive and dumping the SYSTEM registry hive is a prerequisite as well to be able to extract all the credentials.


Publicly available Active Directory auditing frameworks like DSInternals provide PowerShell cmdlets to extract the Syskey from the SYSTEM registry hive and extract all the credentials from the Ntds.dit file.


Ntds.dit can also give access to the powerful service account within the Active Directory Domain, KRBTGT (Key Distribution Centre Service account).


Acquiring the NTLM hash of this account can enable the attacker to execute a Golden Ticket attack leading to complete domain compromise with unrestricted access to any service on the domain joined system.


By impersonating the Domain Controller, the attacker could acquire the NTLM hash of the KRBTGT service account, enabling them to gain access to all the shared resources and applications in the domain joined environment.


To be able to execute this credential stealing technique, an attacker would have to compromise the user account with the required permissions, specifically DS-Replication-Get-Changes and DS-Replication-Get-Changes-All, as shown below.


Credential dumping tools like Mimikatz do this by enumerating all the user logon sessions and replacing the user credentials with the stolen usernames and NTLM hashes provided, in the current logon session.


Behind the scenes, this is executed by duplicating the current process’s access token, replacing the user credentials pointed by duplicated access token and subsequently using the modified access token to start a new process with the stolen credentials which will be used for network authentication.


This is as shown below for example user “DCPrivUser”.


Attackers can now initiate the AD user objects Replication request to the Domain Controller using Directory Replication Services Remote Protocol (DRSUAPI).


Attackers would usually target the KRBTGT account since acquiring the NTLM hash of this account will enable them to execute a Golden Ticket attack resulting in unrestricted access to domain services and applications.


Figure 15 – DCSync Attack As indicated earlier, with the NTLM hash of the KRBTGT account, adversaries can initiate a Golden Ticket attack (Pass-the-Ticket) by injecting the forged Kerberos tickets into the current session which can be used to authenticate to any service with the client that supports pass the ticket (for instance, sqlcmd.exe connection to DB server, PsExec, etc.)


Figure 16 – Golden ticket with forged Kerberos ticket Detecting Credential Stealing Attacks with Network Deception


The credential theft techniques we discussed in the previous sections are just the tip of the iceberg.


Adversaries can use many other sophisticated credential stealing techniques to take advantage of system misconfigurations and legitimate administrative tools and protocols and, at the same time, remain undetected for a longer period.


Perimeter solutions have their limitations in terms of visibility once the attacker crosses the network boundary and is inside the domain environment.


It is extremely critical for organizations to protect and monitor critical network assets like the Domain Controller, Database server, Exchange Servers, build systems and other applications or services, as compromising these systems will result in significant damages.


Therefore, enterprise networks must deploy a solution to detect credential stealing attacks as they can be used to pivot to other systems on the network and move laterally once an attacker establishes an attack path to a high value target.


If the deployment of a solution within the critical zones of the network can detect the use of stolen credentials before adversaries can reach their target, the critical assets could still be prevented from being compromised.


Network Deception is one such deployment within the domain environment where, using the MITRE Shield techniques like decoy systems and network, decoy credentials, decoy accounts, decoy contents, could potentially help detect lateral movement early in the adversary’s attack path to the target asset and at the same time, report significantly low false detection rates.


As shown in the figure below, Network Deception consists of authentic looking decoy systems placed within the domain network, specifically in the network where the critical assets are placed.


These decoy systems (could be virtual machines) are the full-fledged OS with configured applications or services and could be replicating the crucial services like Domain Controller, Exchange or DB server and other decoy machines that could lead to those systems.


The image below highlights the key foundational aspects of the Network Deception Figure 17 – Network Deception Key Aspects of Network Deception As visualized in the figure above, Network Deception comprises the following key basic facts with respect to the deployment in the domain joined environment: As a part of deployment, decoy/deceptive machines are planted within the network alongside production systems and critical assets.


These decoy systems could be real systems or virtual systems with production grade operating systems with the required setup to make them blend well with real systems.


As one of the key aspects, deceptive machines are configured to lure attackers towards the decoy services instead of the production services, thereby deflecting or misleading the attacker’s lateral movement path to the target asset.


Many of the decoy machines could replicate critical services like Domain Controller, DB servers, Exchange/SharePoint servers and other critical services or applications within the data center.


Any legitimate domain user should not be generating traffic to or communicating with the configured decoy machines unless there are some misconfigurations in the network, which need to be corrected.


Basic Decoy Network Setup Since credential theft plays an important role in a successful targeted attack, deception essentially focuses on planting fake credentials on the production and decoy endpoints at multiple places within the OS and monitoring the use of these credentials to pivot to other systems.


With respect to the network setup, the following are the key aspects, however this list is not exhaustive, and much more could be added: Replicating critical network assets and services with decoy machines: Replicating critical network services like Active Directory, DB services, etc., will make more sense since these are the most targeted systems in the network.


The decoy Active Directory should be configured with deceptive AD objects (users, groups, SPNs, etc.).


with deceptive contents for other replicated services.


Planting authentic looking decoy machines in the production network: As indicated earlier, these decoy machines could be real or virtual machines with the production grade OS placed alongside production systems in the critical infrastructure to blend in well.


Injecting deceptive credentials on production endpoints: Production endpoints should be injected with deceptive credentials at multiple places like LSASS process memory, Credential Manager, browser credentials, etc., to increase the possibility of these credentials being picked up and used to pivot to decoy systems in the network.


These endpoints could be public facing machines or their replicas as well.


Mark decoy systems as “NO LANDING ZONE”: One of the key deployment aspects of deception is to mark all the decoy systems and services as “NO LANDING ZONE”, essentially meaning no legitimate domain users should be accessing decoys and any attempts to access these systems should be closely monitored.


Some of the other setup required for effective deployment of deception is as summarized below: Figure 18 – Deceptive network setup – Basic requirements Basic Decoy Systems Setup To detect the use of deceptive credentials, setting up decoy machines is an essential part of the solution as well.


Primarily, decoy machines should enable the access attackers are looking to have during the lateral movement phase.


Decoys should also be configured to enable relevant auditing services to be able to generate events.


For instance, the following enables the account logon events to be audited: Decoy machines must be setup to run the log collector agent that can collect the access logs generated and forward them to the correlation server.


However, in the domain joined environment, it is also essential to tune the decoy machines to forward only the relevant logs to the correlation server to minimize false positives.


The following sections describe some examples of how deception can be achieved in the domain network, along with a visualization of how credential theft can be detected.


Network Deception – Example 1: Injecting NETONLY credentials into LSASS process memory LSASS process memory is one of the prime targets for attackers, as well as malware armed with lateral movement capabilities since it caches a variety of credentials.


Credential extraction from the LSASS process requires opening a read handle to the process itself which is closely monitored by EDR products but there are stealthier ways around it.


One of the primary tasks towards achieving credential-based deception is to stage the deceptive credentials in LSASS process memory.


This can be accomplished on the production and decoy systems by executing a trivial credential injection code which uses the CreateProcessWithLogonW Windows API with the specified crafted credentials.


The below shows the example code calling the API with the specified credentials which is also visible when credentials are extracted with Mimikatz.


Figure 20 – Injecting credentials into LSASS memory One of the parameters to CreateProcessWithLogonW is “dwLogonFlags” which should be specified as LOGON_NETCREDENTIALS_ONLY as shown in the code above.


Below is a code snapshot from credential extraction tool Mimikatz, using a similar approach to forge a logon session and replacing the credentials with the supplied ones while executing Pass-the-Hash attacks.


Figure 21 – Mimikatz code for PTH attack Network Deception – Example 2: Configure deceptive hostnames for decoy VMs Attackers or malware moving laterally inside the network might do a recon for interesting hostnames via nbtstat/nbtscan.


To deflect the lateral movement path, decoy systems can be configured with real looking hostnames that match the production systems.


These hostnames will then be visible on NetBIOS scans as shown below.


These decoy systems can also run the relevant client applications pointing to the decoy services, with authentication directed to the decoy Domain Controller in the network.


For instance, Chrome saves the credentials in the SQLite format on the disk which can be decrypted using DPAPI as discussed earlier sections.


The below examples demonstrate deceptive browser credentials which can lure adversaries towards the decoy services.


Figure 24 – Inserting deceptive browser credentials


In addition to some of the techniques discussed above, and many others highlighted in the previous sections, setting up deception involves much more advanced configuration of decoy systems to minimize false positives and needs to be tuned to the environment to accurately identify malicious activities.


Deception can also be configured to address multiple other phases of lateral movement activity including reconnaissance and target discovery, essentially redirecting the adversaries and giving them a path to the target.


Below is a high-level visualization of how the decoy network can look like the domain environment.


If an authentication is attempted and any of the decoy systems are accessed and logged on, the use of these planted deceptive credentials should be a red flag and something which must be investigated.


The visualization below shows the flow and an event being sent to an administrator on accessing one of the decoy systems.


T1003.002 SAM Database Accessing credentials from SAM database requires SYSTEM level privileges.


Stores credentials for all the local user accounts on the machine.


T1003.006 DCSync Attacker can extract the credentials from the DC by impersonating the domain controller and use DRSUAPI protocol to replicate credentials from DC.


T1558.001 Golden Ticket Attackers acquiring credentials for KRBTGT account can forge the Kerberos ticket called Golden Ticket, allowing them to get unrestricted access to any system in the domain T1558.002 Silver Ticket Allows attacker to get admin level access to the service accounts by abusing Kerberos authentication T1558.003 Kerberoasting Allows attackers to extract the Kerberos tickets for service accounts from memory and brute force offline to get credentials Conclusion As credential theft attacks play a significant role in an attacker’s lateral movement, so as in-network defense for the defenders.


In–network defense strategies like Deception could prove to be a promising and forward-looking approach towards detecting and mitigating data theft attacks.


Strategic planting of decoy systems within the production network, inserting decoy credentials and decoy contents on calculative selection of endpoints and decoy systems and accurately setting up the logging and correlation via SIEMs for monitoring the use of decoy contents, could certainly detect and mitigate the attacks early in the lateral movement life cycle.


For instance, one of the ways UEBA solutions could prove useful is to baseline user behavior and monitor access to credential stores on the system.


UEBA/EDR could raise the red flag on injection of forged Kerberos tickets in the memory.


This can provide user level visibility to a greater extent when integrated with SIEM, playing a crucial role in mitigating credential theft attacks.


The Domain Name System (DNS) translates domain names into IP addresses.

Understanding DNS attacks Identifying and patching vulnerabilities  Snyk


Every device and website has an IP address that other devices, websites, and online services use to communicate with it.


When we want to visit Google, we simply type the domain name into our browser’s address bar, and the DNS service translates the user-entered domain name “google.com” into the corresponding IP address that a computer uses.


If the DNS becomes unavailable, internet programs will no longer function.


DNS attacks refer to any attack that targets the stability and security of the DNS infrastructure.


They commonly aim to render the DNS unavailable or intercept and alter the answers provided by the DNS, directing unsuspecting users to malicious websites.


DNS infrastructure contains two components — authoritative and recursive DNS servers — and both are open to attack.


Below, we’ll explore the most common attacks against DNS and review mitigation strategies to avoid them.


Crash course in DNS attacksThere are several types of DNS attacks, each function differently, have unique impacts, and require specific countermeasures.


SpoofingDNS spoofing occurs when threat actors alter the legitimate DNS server records to redirect users to fraudulent websites instead of their intended destination.


Threat actors use this technique to steal the victim’s sensitive data or plant malware — like ransomware or keyloggers — on their victim’s device.


Check the website for the secure connection (padlock) symbol.


This symbol appears next to the address bar of the web browser.


If there’s no padlock, this may indicate threat actors have mirrored the website for malicious purposes.


Enable the Domain Name System Security Extensions (DNSSEC) on the domain.


These extensions add a layer of security by attaching a digital certificate signature to DNS information.


Cache poisoningIn this attack, the threat actor injects false DNS information into the DNS cache to force it to return incorrect information and direct users to malicious websites.


For example, when a user requests to visit google.com, the poisoned DNS server returns the IP address of another website that could contain an exploit kit or phishing page.


DNS cache poisoning and spoofing are often used interchangeably in cybersecurity.


To prevent a DNS poisoning attack, we should:Use DNSSEC, which uses public key cryptography.


This ensures that only a legitimate DNS nameserver answers a request with the correct DNS information.


Prevent local DNS servers from answering internet-based DNS queries — unless our DNS nameserver is registered with ICANN.DoS/DDoS/floodingDNS flooding is an attack by which malicious actors try to overwhelm DNS servers with false DNS requests to prevent them from serving legitimate requests.


There are two types of DNS flood attacks: denial of service (DoS) flooding and distributed denial of service (DDoS) flooding.


This technique is no longer effective because modern DNS servers have advanced technical specifications that one device cannot disrupt.


DDoS DNS flood attackThe DDoS DNS flood is the most effective attack mechanism wherein attackers use many devices to target one DNS server.


In cybersecurity, a bot can refer to any computing device, for example, a laptop, workstation, or internet of things (IoT) device infected with malware and under a threat actor’s control.


A collection of these bots is called a botnet.


Attackers commonly use networks of botnets containing thousands or millions of compromised devices that run malicious scripts.


DNS floods are considered relatively modern, made widely possible by the increasing numbers of IoT devices worldwide.


Many IoT devices have poor security configurations, making them easy targets for hackers to control.


To prevent DDoS and DoS flood attacks, we should:Use a DDoS mitigation service to prevent outside attackers from overwhelming our DNS servers with false requests.


Use one dedicated server as the authoritative name server and another as the DNS resolver.


Small and medium-sized organizations often use one server for multiple purposes, such as hosting applications and running the DNS service.


The authoritative server consumes resources (fills the server cache) in resolving these invalid requests, making it respond slowly to legitimate requests — and eventually stop responding altogether.


To prevent the DNS NXD flood attack, we should:Conduct regular DNS audits.


Blocklist suspicious domain names and servers.


Temporarily blocklist a client’s IP address if it sends too many NXDomain requests.


Increase the Time to Live (TTL) on current DNS records to ensure that they’ll remain for an extended time in external DNS caches.


Amplification attacksThis is another DDoS attack that aims to prevent the target DNS server from serving legitimate DNS queries.


In this attack, threat actors exploit open DNS servers to send multiple responses to the target server.


Threat actors initiate this attack by sending numerous DNS requests to the open DNS server using the target IP address as the source address.


The open DNS server returns the response to the requester (in this example, the target spoofed IP address).


To prevent this attack, we should:Enforce source IP verifications on all network devices.


Enforce response rate limiting (RRL) settings on all DNS servers.


Configure open DNS resolvers to only respond to queries from a trusted source.


HijackingIn this attack, threat actors manipulate DNS response queries to direct unsuspecting users to fraudulent or malicious websites.


This attack occurs by:Installing malware, such as a trojan horse, on the victim’s computer to incorrectly resolve DNS queries and lead the unsuspecting user to malicious sitesCompromising the target router and changing its DNS settings.


This affects all users connected to the router.


Intercepting the communications between the legitimate DNS server and user device — as in the case of a man-in-the-middle attack — and manipulating DNS responses to lead the unsuspecting user to malicious sitesTargeting the DNS server directly and then changing its DNS settings to lead unsuspecting users to different URLsAlthough


RebindingIn this attack, the threat actor infects the target router with malware to control it remotely.


Many people don’t protect their router using a complex password — or just safeguard it using the default factory credentials.


This leaves them vulnerable to rebinding attacks.


Keep the DNS server and all client operating systems and installed applications up to date.


Tunneling This DNS attack routes unsuspecting user traffic to the attacker’s server.


This attack is typical among ransomware operators for facilitating communication with the Command and Control Center (C&C) and exfiltrating data from the target device.


DNS tunneling evades detection by security tools like firewalls.


Threat actors send stolen data from the target network in small chunks and deliver them as a series of DNS queries and responses to avoid detection.


A DNS tunneling attack works as follows:The attacker has a server with a domain name pointing to it.


This server runs tunneling malware.


The attacker infects a computer with malware.


The infected computer might sit behind a company firewall but can use the DNS resolver.


Now, the DNS resolver can communicate with the remote attacker’s C&C server.


By doing this, each infected device and the remote attacker’s server have created a covert channel that can be used to exfiltrate data from the victim device or deliver more malware, such as ransomware, to the target device.


Configure all devices within an organization’s network to send all their DNS queries to an internal DNS server that blocks suspicious domain names.


Phantom domainIn this attack, the threat actor sets up numerous phantom domain names and requests the target DNS server to resolve them.


These domains (commonly a large number of sub-domain names) respond very slowly or never.


To prevent this attack, we should:Increase the number of recursive DNS servers.


ConclusionThe DNS service is a critical component of internet infrastructure.


It’s responsible for translating users’ domain names into IP addresses that other servers can understand.


However, it was not made for security.


Any attack against the DNS service prevents all internet programs from functioning correctly.


Cybercriminals know this and have developed many ways to attack DNS services for malicious purposes.


However, generally speaking, the keys to preventing DNS attacks include keeping the DNC server software up to date, using a dedicated DNS server to provide the DNS service, increasing the number of recursive DNS servers, and checking for vulnerabilities to mitigate DDoS attacks.


Affected platforms: WindowsImpacted parties: Any organizationImpact: Controls victim’s device and collects sensitive informationSeverity level: Critical EvilExtractor (sometimes spelled Evil Extractor) is an attack tool designed to target Windows operating systems and extract data and files from endpoint devices.


It was developed by a company named Kodex, which claims it is an educational tool.


Based on our traffic source data to the host, evilextractor[.]com, malicious activity increased significantly in March 2023.


FortiGuard Labs observed this malware in a phishing email campaign on 30 March, which we traced back to the samples included in this blog.


It usually pretends to be a legitimate file, such as an Adobe PDF or Dropbox file, but once loaded, it begins to leverage PowerShell malicious activities.


It also contains environment checking and Anti-VM functions.


Its primary purpose seems to be to steal browser data and information from compromised endpoints and then upload it to the attacker’s FTP server.


We recently reviewed a version of the malware that was injected into a victim’s system and, as part of that analysis, identified that most of its victims are located in Europe and America.


The developer released its project in October 2022 (Figure 1) and has kept updating it to increase its stability and strengthen its module.


EvilExtractor for sale on the web Initial Access The phishing email with the malicious attachment is shown in Figure 2.


It is disguised as an account confirmation request.


The PE header is shown in Figure 3.


The phishing email Figure 3.


We extracted it with pyinstxtractor and found that the “PYARMOR” string in its main code file “contain.pyc”, shown in Figure 4, is an obfuscating tool for Python script that makes the malware harder to be analyzed and detected.


In addition to the Python program, we observed a .NET loader that can extract EvilExtractor.


It contains Base64-encoded data, which is a PowerShell script.


This execution file is generated from the tool “PS2EXE-GUI”, which can convert PowerShell scripts to EXE Files.


Figure 5. .Net


Code for EvilExtractor EvilExtractor After decrypting the pyc file, we get the primary code of EvilExtractor.


If not, it uses the following command to delete the data in PSReadline and terminate: DEL \"$env:APPDATA\Microsoft\Windows\PowerShell\PSReadline\*\" -Force –Recurse It then compares the product model to see if it matches any of the following: VirtualBox, VMWare, Hyper-V, Parallels, Oracle VM VirtualBox, Citrix Hypervisor, QEMU, KVM, Proxmox VE, or Docker, as shown in Figure 6.


It also checks the victim’s hostname against 187 names from VirusTotal machines or other scanner/virtual machines, as shown in Figure 7. Figure 6.


These files are also Python programs that are obfuscated using PyArmor.


The first is “KK2023.zip”, which is used for stealing browser data and saving it in the folder “IMP_Data”.


It also collects browser history and passwords from the following browsers: The second file is “Confirm.zip”.


It is a key logger that saves data in the “KeyLogs” folder.


The last file, “MnMs.zip”, is a webcam extractor.


Its corresponding code is shown in Figure 8. Figure 8.


Figure 10 shows the concatenated data in a text file called “Credentials.txt”.


Figure 9.


PowerShell script for collecting system information Figure 10.


Content of “Credentials.txt” EvilExtractor downloads files with specific extensions from the Desktop and Download folders, including jpg, png, jpeg, mp4, mpeg, mp3, avi, txt, rtf, xlsx, docx, pptx, pdf, rar, zip, 7z, csv, xml, and html.


It also uses the command “CopyFromScreen” to capture a screenshot.


Downloading files and getting a screenshot After EvilExtractor extracts all the data from the compromised endpoint, it uploads it to the attacker’s FTP server, shown in Figure 12.


The developer of EvilExtractor also provides an FTP server for those who purchase its malware. Figure 12.


Upload file to attacker’s


FTP server Kodex Ransomware EvilExtractor also has a ransomware function.


It is called “Kodex Ransomware”, as shown in Figure 13.


We extracted this PowerShell script from the .Net loader mentioned in the previous section, and the script for its ransomware is similar to the one for its stealer.


Introduction form evilextracom[.]com It downloads “zzyy.zip” from evilextractor[.]com.


Details of the unzipped file, a 7-zip standalone console, are shown in Figure 14.


Figure 15 shows it leverages “7za.exe” to encrypt files with the parameter “-p”, which means zipping files with a password.


It also generates a ransom-demanding message saved in “KodexRansom”, shown in Figure 16. Figure 14.


File in "zzyy.zip" Figure 15.


PowerShell script for Kodex Ransomware Figure 16.


Kodex ransomware's note Conclusion EvilExtractor is being used as a comprehensive info stealer with multiple malicious features, including ransomware.


Its PowerShell script can elude detection in a .NET loader or PyArmor.


Within a very short time, its developer has updated several functions and increased its stability.


This blog explains how threat actors launch an attack via phishing mail and what files are leveraged to extract the EvilExtracrtor PowerShell script.


Users should be aware of this new info stealer and continue to be cautious about suspicious mail.


Figure 17.


The malware described in this report are detected and blocked by FortiGuard Antivirus as: W32/EvilExtractor.


A!tr W32/Keylogger.


A!tr The FortiGuard AntiVirus service is supported by FortiGate, FortiMail, FortiClient, and FortiEDR, and the Fortinet AntiVirus engine is a part of each of those solutions.


The FortiGuard Web Filtering Service blocks the malicious URL and IP address.


If you think this or any other cybersecurity threat has impacted your organization, contact our Global FortiGuard Incident Response Team.


IOCs IP Address: 45[.]87[.]81[.]184 193[.]42[.]33[.]232 Files: 352efd1645982b8d23a841107007c8b4b024eb6bb5d6b312e5783ce4aa62b685 023548a5ce0de9f8b748a2fd8c4d1ae6c924c40acbde32e9599c868115d11f4e 75688c32a3c1f04df0fc02491180c8079d7fdc0babed981f5860f22f5e118a5e 826c7c112dd1ae80469ef81f5066003d7691a349e6234c8f8ca9637b0984fc45 b1ef1654839b73f03b73c4ef4e20ce4ecdef2236ec6e1ca36881438bc1758dcd 17672795fb0c8df81ab33f5403e0e8ed15f4b2ac1e8ac9fef1fec4928387a36d


Executive Summary LockBit 2.0 is ransomware as a service (RaaS) that first emerged in June 2021 as an upgrade to its predecessor LockBit (aka ABCD Ransomware), which was first observed in September 2019.

LockBit 20 How This RaaS Operates and How to Protect Against It


Since its inception, the LockBit 2.0 RaaS attracted affiliates via recruitment campaigns in underground forums, and thus became particularly prolific during the third quarter of calendar year 2021.


The LockBit 2.0 operators claimed to have the fastest encryption software of any active ransomware strain as of June 2021, claiming accordingly that this added to its effectiveness and ability to disrupt the ransomware landscape.


While several top-tier RaaS affiliate programs, such as Babuk, DarkSide and REvil (aka Sodinokibi) disappeared from the underground in 2021, LockBit 2.0 continued to operate and gradually became one of the most active ransomware operations.


While Conti was recognized as being the most prolific ransomware deployed in 2021 per our 2022 Unit 42 Ransomware Threat Report, LockBit 2.0 is the most impactful and widely deployed ransomware variant we have observed in all ransomware breaches during the first quarter of 2022, considering both leak site data and data from cases handled by Unit 42 incident responders.


As of May 25, LockBit 2.0 accounted for 46% of all ransomware-related breach events for 2022.


And the LockBit 2.0 RaaS leak site has the most significant number of published victims, with over 850 in total.


Additionally, LockBit 2.0 has affected many companies globally, with top victims based in the U.S., Italy and Germany.


Its most highly targeted industry verticals include professional services, construction, wholesale and retail, and manufacturing.


Palo Alto Networks customers receive protections against LockBit 2.0 attacks from Cortex XDR, as well as from the WildFire cloud-delivered security subscription for the Next-Generation Firewall.


Table of Contents LockBit 2.0 OverviewVictimologyLeak Site DataUnit 42 Incident Response Data on LockBit 2.0LockBit 2.0 Tactics, Techniques and ProceduresLockBit 2.0 Technical DetailsLockBit 3.0Courses of ActionConclusionAppendix AAdditional Resources LockBit 2.0 Overview LockBit 2.0 is another example of RaaS that leverages double extortion techniques as part of the attack to pressure victims into paying the ransom.


In some cases, LockBit 2.0 operators have performed DDoS attacks on the victims' infrastructure as well as using a leak site.


Unlike other RaaS programs that don't require the affiliates to be super technical or savvy, LockBit 2.0 operators allegedly only work with experienced penetration testers, especially those experienced with tools like Metasploit and Cobalt Strike.


LockBit 2.0 has been observed changing infected computers’ backgrounds to a ransomware note.


The ransomware note was also used to recruit insiders from victim organizations.


The notes claimed the threat actors would pay “millions of dollars” to insiders who provided access to corporate networks or facilitated a ransomware infection by opening a phishing email and/or launching a payload manually.


Victimology LockBit 2.0 targets organizations opportunistically.


The operators work with initial access brokers to save time and allow for a larger profit potential.


While typically seeking victims of opportunity, LockBit 2.0 does appear to have victim limitations.


The group announced that they would not target healthcare facilities, social services, educational institutions, charitable organizations and other organizations that “contribute to the survival of the human race”.


However, despite these claims, there have been instances of affiliates undermining these guidelines by still opting to attack industry verticals such as healthcare and education.


Leak Site Data During the first calendar year quarter of 2022, LockBit 2.0 persisted as the most impactful and the most deployed ransomware variant we observed in all ransomware breaches shared on leak sites.


Ransomware leak site data from the first calendar year quarter of 2022.According to leak site data analysis, LockBit 2.0 was the most impactful RaaS for five consecutive months.


The site itself typically features information such as victim domains, a time tracker and measures of how much data was compromised. Figure 2.


LockBit 2.0 claims that they have demanded ransom from at least 12,125 companies, as shown in the figure below.


Source: VX-underground.


According to leak site data for LockBit 2.0, since its inception in June 2021, the RaaS has affected many companies globally, with top victims based in the U.S., Italy and Germany. Figure 4.


Its most highly targeted industry verticals include professional services, construction, wholesale and retail and manufacturing. Figure 5.


LockBit 2.0 impacted industry vertical chart.


When looking at leak site data across all ransomware families, we’ve observed LockBit 2.0 targeting the highest number of organizations in the following regions: JAPAC, EMEA, and LATAM.


Unit 42 Incident Response Data on LockBit 2.0 Cases handled by Unit 42 security consultants involving LockBit 2.0 since its appearance in June 2021 demonstrate shorter dwell times and less flexibility in negotiation in the beginning of FY 2022 (measured October-September) in comparison to the end of FY 2021.


The following data is broken into fiscal years and quarters based on when the threat actor breached the network, not when the activity was noticed by a client.


LockBit 2.0 has shown a decrease in dwell time in FY 2022.


From the last two quarters of FY 2021 to the first two quarters of FY 2022, there has been an average 37-day difference.


LockBit 2.0 average dwell time by fiscal quarter.


The difference in initial and final ransom demands over the past fiscal year has been converted to percentages and then averaged.


In comparison, we see less flexibility in FY 2022 Q1 and Q3 – threat actors only offered an average of about 30% as a price drop.


FY 2022 Q2 is not included due to lack of sufficient information.


LockBit 2.0 Tactics, Techniques and Procedures Technically speaking, we have observed LockBit 2.0 affiliates leveraging the following tactics, techniques and procedures: TA0001 Initial Access T1078 Valid Accounts Credentials that have either been reused across multiple platforms or have previously been exposed.


Additionally, this includes VPN accounts – not just domain and local accounts.


External Remote Services Affiliates have been seen brute forcing exposed RDP services and compromising accounts with weak passwords.


T1190 Exploit Public-Facing Applications Vulnerabilities such as ProxyShell (CVE-2021-34473) and improper SQL sanitization (CVE-2021-20028)


Its ability to execute processes on other systems spread the ransomware and assisted in reconnaissance activities.


TA0003 Persistence T1053.005 Scheduled Task/Job Scheduled Task.


It was quite common to see scheduled tasks used to create persistence for the ransomware executable, PsExec, and occasionally some defense evasion batch scripts.


Valid Accounts Compromised accounts may be used to maintain access to the network.


Create Account


In rare cases, LockBit 2.0 has been observed to create accounts for persistence with simple names, such as “a.” T1505.003 Server Software Component With the upsurgence of ProxyShell, webshells have become more common entry points.


TA0004 Privilege Escalation T1068 Exploitation for Privilege Escalation The ProxyShell elevation of privilege on the Exchange PowerShell Backend (CVE-2021-34523), Windows Background Intelligent Transfer Service (BITS) improperly handling symbolic links (CVE-2020-0787), and abusing the CMSTPLUA COM interface have all been seen as methods of privilege escalation.


TA0005 Defense Evasion T1070 Indicator Removal on Host Indicators, such as logs in Windows Event Logs or malicious files, are typically removed using wevtutil, a batch script, or CCleaner.


T1140 Deobfuscate/Decode Files or Information Most PowerShell scripts involved in LockBit 2.0 cases are Base64 encoded.


Impair Defenses: Disable or Modify Tools Windows Defender, other anti-malware solutions and monitoring tools are disabled utilizing a process explorer tool, a batch script or a specially crafted command line script.


Hide Artifacts: Hidden Window Affiliates use hidden windows to hide malicious activity from plain sight.


TA0006 Credential Access T1003 OS Credential Dumping As seen with other ransomware cases, Mimikatz is a key player in dumping credentials but LockBit 2.0 has been occasionally seen utilizing MiniDump as well.


T1555 Credentials from Password Stores LockBit 2.0 has been seen utilizing numerous tools to dump passwords from password stores and Chrome using GrabChrome and GrabRFF.


TA0007 Discovery T1046 Network Service Discovery Both Advanced Port Scanner and NetScan have been used to discover local network infrastructure devices and services running on remote hosts.


Active Directory queries for remote systems have been performed by ADFind.


T1057 Process Discovery Process Explorer, Process Monitor and PCHunter have been utilized to discover any anti-malware or monitoring software and terminate it.


T1082 System Information Discovery LockBit 2.0 enumerates system information such as hostname, shares, and domain information.


T1614 System Location Discovery Attempts to check the language settings.


T1021.002 Remote Services: SMB/Windows Admin Shares LockBit 2.0 has been known to self-propagate via SMB.


TA0010 Exfiltration T1030 Data Transfer Size Limits In some cases, LockBit 2.0 will limit the data transfer sizes to fly under the radar of any monitoring services a client may have set up.


T1041 Exfiltration over C2 Channel MEGASync is the leading way for LockBit 2.0 affiliates to exfiltrate data from clients with it being occasionally replaced by RClone. TA0011 Command and Control T1219


Remote Access Software AnyDesk has been the most common legitimate desktop software used to establish an interactive command and control channel, with ConnectWise seen slightly less frequently.


TA0040 Impact T1486 Data Encrypted for Impact LockBit 2.0 is known for its extortion tactics, encrypting devices and demanding a ransom.


T1489 Service Stop During the defense evasion phase, anti-malware and monitoring software is often disabled.


Firewall rules have occasionally been seen being disabled as well.


LockBit 2.0 Technical Details LockBit 2.0 was developed using the Assembly and Origin C programming languages and leverages advanced encryption standard (AES) and elliptic-curve cryptography (ECC) algorithms to encrypt victim data.


It can affect both Windows and Linux OS, as the operator released a Linux version of LockBit 2.0 to target VMware ESXi hypervisor systems in October 2021, coded exclusively in the C programming language.


The LockBit group claimed that LockBit 2.0 is “the fastest encryption software all over the world” and provided a comparative table showing the encryption speed of various ransomware samples.


LockBit blog.


LockBit 2.0 also contains a self-spreading feature, clears logs and can print the ransom note on network printers until the paper runs out.


A management panel that affiliates can use to manage victims and affiliate accounts, generate new ransomware builds and generate the decryptor if the demanded ransom is paid also exists.


LockBit 2.0 management panel.


Source: ProDaft.


LockBit 2.0 operators also released an information-stealer dubbed StealBit, which was developed to support affiliates of the LockBit 2.0 RaaS when exfiltrating data from breached companies.


No reliance on third-party cloud file-sharing services, where data can be easily removed if the victim submitted a complaint.


The operator of LockBit 2.0 has provided a comparative table speed showing the information stealer compared to other tools. Figure 10.


LockBit 2.0 download speed, according to LockBit 2.0 operator.


LockBit 3.0 There was a bug that existed in LockBit 2.0 that allowed researchers to revert the encryption process on an MSSQL database.


Moreover, on March 17, LockBit forum members mentioned the release of LockBit’s next version in one or two weeks.


On March 25, VX underground posted a tweet with details of this new version, dubbed LockBit Black. Figure 11.


LockBit Black post-infection desktop wallpaper (Source: VX-underground).Courses of Action Several adversarial techniques were observed in this activity and the following measures are suggested within Palo Alto Networks products and services to ensure mitigation of threats related to LockBit 2.0 ransomware, as well as other malware using similar techniques: Product / Service Course of Action Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion The courses of action below mitigate the following techniques: Exploit Public-Facing Application


[T1505.003], Exploitation for Privilege Escalation


[T1068], Indicator Removal on Host [T1070], Deobfuscate/Decode Files or Information


[T1078], External Remote Services [T1133], Scheduled Task


Group Policy Modification


[T1484.001] THREAT PREVENTION Ensure a secure Vulnerability Protection Profile is applied to all security rules allowing traffic Ensure a Vulnerability Protection Profile is set to block attacks against critical and high vulnerabilities, and set to default on medium, low, and informational vulnerabilities Ensure DNS sinkholing is configured on all anti-spyware profiles in use Ensure an anti-spyware profile is configured to block on all spyware severity levels, categories, and threats Ensure a secure anti-spyware profile is applied to all security policies permitting traffic to the internet Ensure passive DNS monitoring is set to enabled on all anti-spyware profiles in use CORTEX XSOAR Deploy XSOAR Playbook Cortex XDR - Isolate Endpoint Deploy XSOAR Playbook - Block Account Generic Deploy XSOAR Playbook - Access Investigation Playbook Deploy XSOAR Playbook - Impossible Traveler NEXT-GENERATION FIREWALLS Ensure 'Service setting of ANY' in a security policy allowing traffic does not exist Ensure application security policies exist when allowing traffic from an untrusted zone to a more trusted zone Ensure 'Security Policy' denying any/all traffic to/from IP addresses on Trusted Threat Intelligence Sources Exists Ensure that the User-ID service account does not have interactive logon rights Define at least one 'Include Network'.


Ensure that User-ID is only enabled for internal trusted interfaces Ensure that 'Include/Exclude Networks' is used if User-ID is enabled Ensure remote access capabilities for the User-ID service account are forbidden.


[T1555] CORTEX XDR PREVENT Enable Anti-Exploit Protection Enable Anti-Malware Protection Discovery The below courses of action mitigate the following techniques: Network Service Scanning [T1046],


[T1057], System Location Discovery


[T1614], System Information Discovery [T1082] CORTEX XDR PREVENT Configure Behavioral Threat Protection under the Malware Security Profile NEXT-GENERATION FIREWALLS Ensure that all zones have Zone Protection Profiles with all Reconnaissance Protection settings enabled, tuned, and set to appropriate actions Ensure 'Service setting of ANY' in a security policy allowing traffic does not exist Ensure 'Security Policy' denying any/all traffic to/from IP addresses on Trusted Threat Intelligence Sources Exists Ensure application security policies exist when allowing traffic from an untrusted zone to a more trusted zone CORTEX XSOAR Deploy XSOAR Playbook - Port Scan Lateral Movement The courses of action below mitigate the following techniques: Remote Services [T1021], SMB/Windows Admin Shares


Ensure that User-ID is only enabled for internal trusted interfaces Ensure that the User-ID Agent has minimal permissions if User-ID is enabled Ensure that the User-ID service account does not have interactive logon rights Ensure that 'Include/Exclude Networks' is used if User-ID is enabled Ensure that security policies restrict User-ID Agent traffic from crossing into untrusted zones CORTEX XSOAR Deploy XSOAR Playbook - Block Account Generic Deploy XSOAR Playbook - Access Investigation Playbook Command and Control


The courses of action below mitigate the following techniques: Data Transfer Size Limits


Conclusion LockBit 2.0 and its evolution over time is a perfect example to illustrate the persistence, increasing complexity and impact brought by the ransomware landscape as a whole.


LockBit’s continuation with operations and its next iteration coming up on the horizon means that organizations and their security teams need to stay vigilant in the ever-evolving threat landscape.


Cortex XDR: Identifies indicators associated with LockBit 2.0.


Anti-Ransomware Module to detect LockBit 2.0 encryption behaviors on Windows.


Local Analysis detection for LockBit 2.0 binaries on Windows.


+65.6983.8730 Japan: +81.50.1790.0200 Palo Alto Networks has shared these findings, including file samples and indicators of compromise, with our fellow Cyber Threat Alliance members.


The same Russian blogger previously published interviews with a representative of the group behind the REvil ransomware-as-a-service (RaaS), hackers and security experts.


Some key takeaways from the claims made in the interview were: The LockBit 2.0 threat actor claimed the group’s RaaS was unlikely to be rebranded since the team allegedly was a business that was honest with their customers – suggesting a supposed contrast between LockBit 2.0 and Avaddon, DarkSide and REvil affiliates.


The LockBit 2.0 ransomware disregarded keyboard layout, but it allegedly would not run on a host where the system language was set to any of the languages spoken in the Commonwealth of Independent States region.


The group did not devise attacks on companies of their choice; they simply worked with initial access to any corporate network they obtained elsewhere, since this was more profitable and saved time.


The team selected targets for ransomware attacks based on the company’s finances — the bigger, the better.


The location also did not matter.


[Note that Unit 42 case data does include indications that threat actors using LockBit 2.0 have targeted healthcare organizations at times.]


The threat actor claimed that the COVID-19 pandemic facilitated ransomware attacks significantly, saying it was easy to compromise home computers of employees who work remotely and use them as a springboard to access other networked systems.


Companies in Europe and the U.S. were hit with ransomware much more often than companies based in other countries allegedly because of high profit and insurance and not because of language barriers.


Ransomware operators usually recruit negotiators, who coerce victims to pay ransom, since professional penetration testers allegedly lack the time for chatter.


Sign up to receive the latest news, cyber threat intelligence and research from us


8220 Gang is a low-skill crimeware actor known for infecting cloud hosts through n-day vulnerabilities and remote access brute forcing.

SOC Team Essentials  How to Investigate and Track the 8220 Gang Cloud Threat


Since our last write up in October, the group has again switched to new infrastructure and samples, providing us with an opportunity to share an educational walkthrough of the process of investigating cybercrime activity that may be useful to new or lesser experienced SOC teams, analysts and researchers.


Refresher on 8220 Gang 8220 Gang (pronounced eighty-two twenty), also known as 8220 Mining Group, was first publicly reported by Talos in 2018.


Attacks make use of SSH brute forcing post-infection to automate local and global spreading attempts.


Victims using cloud infrastructure (AWS, Azure, GCP, Aliyun, QCloud) are often infected via publicly accessible hosts running Docker, Confluence, Apache WebLogic, and Redis.


Victims are not targeted geographically but simply identified by their internet accessibility.


Initial Discovery Our walkthrough starts with the initial discovery of an interesting script found on a compromised AWS machine with publicly available SSH service secured with weak credentials.


For readers not running a honeypot, this initial discovery could have also been observed in the monitoring of new files uploaded to file scanning services like VirusTotal or MalShare.


For those looking to monitor this group, international SSH honeypots plus VirusTotal YARA rules offer a reliable method of catching new activity as it occurs.


The script in question has the SHA1 a9da0947243333d95f84f6a0e37b9fc29b2fb054. 8220 Infection Script Snippet We can see it is quite simple in design and built around the process of downloading and setting persistence of some other file.


With a few string pivots inside VT, or even a few Google searches, we can quickly discover the core functionality of the script has been widely reported on as it has been reused by many amateur cryptocurrency mining groups and opportunistic profit-seeking attackers.


Pivoting on part of the script’s content in VirusTotal Intelligence One example of such reporting is our July 2022 post on 8220 Gang expanding their botnet to roughly 30,000 hosts.


Remember, this “infection script” is used by many attackers, and it alone is a very weak source of attribution. 8220 Infection Script Analysis The script goes through a set of instructions, often at multiple levels of encoded commands, aimed at the delivery of setting persistence on the victim machine by downloading itself from malicious servers.


The multiple levels of Base64 encoding attempt to hide the fact that it is also downloading a specific payload as well.


This is first observed under the createservices function.


Infection Script createservices Function One difference that’s quickly apparent to past reporting on the script is that the attacker began adding the lwp-download command as a failover for wget and curl to enable downloading commands.


We initially observed this activity on January 6th, and since then the actor has continued to standardize it in their infection scripts today.


Sysdig also noted this activity in a recent blog.


Infection Script use of lwp-download The key take away from analyzing these infection scripts is noting unique additions, like lwp–download, combined with the destination of download requests.


By clustering infection scripts based on function names and order, if the functions are called, and what infrastructure is associated, we can weed out the non-8220 Gang samples.


For example, in our infection scripts createservices makes use of three base64 encoded echo commands.


Post-Infection Activity & Sample Pivots The post infection activity for this and other recent 8220 infection scripts evolve slightly, but generally proceed with infecting the victim with an updated PwnRig cryptocurrency miner and IRC bot.


In the infection scripts we observed in this campaign, the group continued to use old bash IRC bot “Tsunami”.


More useful for tracking 8220 Gang are the samples of PwnRig – the custom version of the open source XMRig cryptocurrency miner – that they drop.


In this campaign, the script downloads the UPX packed sample 38be55f1fc4ce1cb5438236abc5077019e5e1cdf, which unpacks to 332485bd460f55117a254f8164736b90d74aa9f6.


Here, we see this theme again through the use of the malicious domain fbi.su1001-2[.]top.


Infrastructure Analysis Tracking 8220 Gang is aided somewhat by their failures in infrastructure OPSEC.


Since the beginning of what the industry calls “8220 Gang” the primary method of attribution has been reused infrastructure and identification of newly associated infrastructure.


While this technique alone does not link the actor with certainty, it remains reliable when combined with the previously noted linkability around malware samples delivered.


Anyone looking into this group should pivot on all subdomains associated with the actor-controlled domain, in addition to all DNS history of malicious IPs to identify a wider set of the malicious activity.


For example, the recent dw.bpdeliver[.]ru host resolved to 79.137.203[.]156 during the initial deployment of the script.


More activity of 8220 Gang scripts can be found calling directly to this IP rather than the domain.


The same goes for 185.106.94[.]146, which is called by IP in the script, and which at the time resolved to jira.letmaker.top, a widely reported known 8220 Gang domain.


Overall, the group is clumsy and unsophisticated in their infrastructure management, providing a good opportunity for those willing to track the mess or cut their teeth in threat actor investigation.


Visual Context of 8220 Gang Infrastructure Roles Conclusion Tracking and researching 8220 Gang, which has exhibited a lack of operational security, requires a simple understanding of their use of malicious scripts, malware samples, and malicious infrastructure.


A successful approach to tracking this group can involve monitoring and analyzing malware samples, identifying patterns in their malicious scripts, and mapping out their infrastructure. Indicators of Compromise Indicator Description a9da0947243333d95f84f6a0e37b9fc29b2fb054 8220 Gang Install Script 472548a4b8295182f6ba8641d74725c2250b7243 8220 Gang Bashirc.x86_64 – PackedOld version, “Tsunami” 38be55f1fc4ce1cb5438236abc5077019e5e1cdf 8220 Gang X86_64 – Packed MinerUses fbi.su1001-2[.]top 332485bd460f55117a254f8164736b90d74aa9f6 e2c3e.


Unpacked, PwnRig Miner 194.38.23.170 8220 Gang Infrastructure – Shared jira.letmaker.top 8220 Gang Infrastructure – Reused 185.106.94.146 8220 Gang Infrastructure dw.bpdeliver.ru 8220 Gang Infrastructure – Recent fbi.su1001-2.top 8220 Gang Infrastructure – Recent 79.137.203.156 8220 Gang Infrastructure


The group is known for its destructive operations.

Fantasy  a new Agrius wiper deployed through a supplychain attack


In February 2022, Agrius began targeting Israeli HR and IT consulting firms, and users of an Israeli software suite used in the diamond industry.


We believe that Agrius operators conducted a supply-chain attack abusing the Israeli software developer to deploy their new wiper, Fantasy, and a new lateral movement and Fantasy execution tool, Sandals.


Instead, it goes right to work wiping data.


Victims were observed in South Africa – where reconnaissance began several weeks before Fantasy was deployed – Israel, and Hong Kong.


Key points of this blogpost: Agrius conducted a supply-chain attack abusing an Israeli software suite used in the diamond industry.


Victims include Israeli HR firms, IT consulting companies, and a diamond wholesaler; a South African organization working in the diamond industry; and a jeweler in Hong Kong.


Group overview Agrius is a newer Iran-aligned group targeting victims in Israel and the United Arab Emirates since 2020.


The group initially deployed a wiper, Apostle, disguised as ransomware, but later modified Apostle into fully fledged ransomware.


Campaign overview On February 20th, 2022 at an organization in the diamond industry in South Africa, Agrius deployed credential harvesting tools, probably in preparation for this campaign.


Then, on March 12th, 2022, Agrius launched the wiping attack by deploying Fantasy and Sandals, first to the victim in South Africa and then to victims in Israel and lastly to a victim in Hong Kong.


Victims in Israel include an IT support services company, a diamond wholesaler, and an HR consulting firm.


South African victims are from a single organization in the diamond industry, with the Hong Kong victim being a jeweler.


Victim timeline and locations


We observed the software developer pushing out clean updates within a matter of hours of the attack.


We reached out to the software developer to notify them about a potential compromise, but our enquiries went unanswered.


Preparing for departure The first tools deployed by Agrius operators to victim systems, through means unknown, were: MiniDump, “a C# implementation of mimikatz/pypykatz minidump functionality to get credentials from LSASS dumps” SecretsDump, a Python script that “performs various techniques to dump hashes from [a] remote machine without executing any agent there” Host2IP, a custom C#/.NET tool that resolves a hostname to an IP address.


Sandals: Igniting the Fantasy (wiper)


Sandals is a 32-bit Windows executable written in C#/.NET.


It is used to connect to systems in the same network via SMB, to write a batch file to disk that executes the Fantasy wiper, and then run that batch file via PsExec with this command line string:


PsExec.exe /accepteula -d -u “<username>”


-p “<password>”


Run the remote process in the SYSTEM account.


Sandals does not write the Fantasy wiper to remote systems.


This assessment is based on several factors: all victims were customers of the affected software developer; the Fantasy wiper was named in a similar fashion to legitimate versions of the software; all victims executed the Fantasy wiper within a 2.5 hour timeframe, where victims in South Africa were targeted first, then victims in Israel, and finally victims in Hong Kong (we attribute the delay in targeting to time zone differences and a hardcoded check-in time within the legitimate software); and, lastly, the Fantasy wiper was written to, and executed from, %SYSTEM%\Windows\Temp, the default temp directory for Windows systems.


Additionally, we believe the victims were already using PsExec, and Agrius operators chose to use PsExec to blend into typical administrative activity on the victims’ machines, and for ease of batch file execution.


Sandals arguments and their descriptions ArgumentDescriptionRequired -f


A path and filename to a file that contains a list of hostnames that should be targeted.


The username that will be used to log into the remote hostname(s) in argument -f.


Yes -d <path>


Default location is %WINDOWS%\Temp.


No -s


The amount of time, in seconds, that Sandals will sleep between writing the batch file to disk and executing.


The default is two seconds.


No -a file <filepath> or-a random or-a rsaIf -a is followed by the word file and a path and filename, Sandals uses the encryption key in the supplied file.


If -a is followed by rsa or random, Sandals uses the RSACryptoServiceProvider class to generate a public-private key pair with a key size of 2,048.


No -dn <devicename>Specifies which drive to connect with on a remote system over SMB.


Default is C:.No -ps <filepath>Location of PsExec on disk.


If flag=False, Sandals skips the file cleanup step.


No The batch file written to disk by Sandals is named <GUID>.bat, where the filename is the output of the Guid.


Sandals batch file (top, in red) and the decoded command line parameter (bottom, in blue)


Fantasy wiper The Fantasy wiper is also a 32-bit Windows executable written in C#/.NET, so named for its filenames: fantasy45.exe and fantasy35.exe, respectively.


Figure 3 depicts the execution flow of the Fantasy wiper.


Fantasy wiper execution flow Initially, Fantasy creates a mutex to ensure that only one instance is running.


It collects a list of fixed drives but excludes the drive where the %WINDOWS% directory exists.


Then it enters a for loop iterating over the drive list to build a recursive directory listing, and uses the RNGCryptoServiceProvider.


GetBytes method to create a cryptographically strong sequence of random values in a 4096-byte array.


If a runtime argument of 411 is supplied to the wiper, the for loop overwrites the contents of every file with the aforementioned byte array using a nested while loop.


Otherwise, the for loop only overwrites files with a file extension listed in the Appendix.


Fantasy then assigns a specific timestamp (2037-01-01 00:00:00) to these file timestamp properties: CreationTime LastAccessTime LastWriteTime CreationTimeUtc SetLastAccessTimeUtc LastWriteTimeUtc and then deletes the file.


This is presumably done to make recovery and forensic analysis more difficult.


During the for loop, the Fantasy wiper counts errors within the current directory when attempting to overwrite files.


If the number of errors exceeds 50, it writes a batch file, %WINDOWS%\Temp\<GUID>.bat, that deletes the directory with the files causing the errors, and then self-deletes.


File wiping then resumes in the next directory in the target list.


Once the for loop completes, the Fantasy wiper creates a batch file in %WINDOWS%\Temp called registry.bat.


%windir%\system32\rundll32.exe advapi32.dll,ProcessIdleTasks Lastly, registry.bat deletes itself (del %0).


Next, the Fantasy wiper clears all Windows event logs and creates another batch file, system.bat, in %WINDOWS%\Temp, that recursively deletes all files on %SYSTEMDRIVE%, attempts to clear file system cache memory, and self-deletes.


Fantasy then writes another batch file, %WINDOWS%\Temp\remover.bat, that deletes the Fantasy wiper from disk and then deletes itself.


Then Fantasy wiper sleeps for 30 seconds before rebooting the system with reason code SHTDN_REASON_MAJOR_OTHER (0x00000000) — Other issue.


It is likely that %SYSTEMDRIVE% recovery is possible.


Victims were observed to be back up and running within a matter of hours.


Attribution to Agrius Much of the code base from Apostle, initially a wiper masquerading as ransomware then updated to actual ransomware, was directly copied to Fantasy and many other functions in Fantasy were only slightly modified from Apostle, a known Agrius tool.


However, the overall functionality of Fantasy is that of a wiper without any attempt to masquerade as ransomware.


Figure 4 shows the file deletion functions in Fantasy and Apostle, respectively.


There are only a few small tweaks between the original function in Apostle and the Fantasy implementation.


File deletion functions from the Fantasy wiper (top, in red) and Apostle ransomware (bottom, in green) Figure 4.


Directory listing functions from the Fantasy wiper (top, in red) and Apostle ransomware (bottom, in green)


Finally, the GetSubDirectoryFileListRecursive function in Figure 6 is also almost an exact copy.


Recursive directory listing functions from the Fantasy wiper (top, in red) and Apostle ransomware (bottom, in green)


In addition to the code reuse, we can see remnants of the Apostle execution flow in Fantasy.


In the original analysis of Apostle, SentinelOne notes that “Proper execution of the ransomware version requires supplying it with a base64 encoded argument containing an XML of an ‘RSAParameters’ object.


This argument is passed on and saved as the Public Key used for the encryption process and is most likely generated on a machine owned by the threat actor.”


We can see in the batch file in Figure 7, which Sandals creates on remote systems to launch Fantasy, that the same base64-encoded argument containing an XML of an RSAParameters object is passed to Fantasy at runtime.


Sandals passing to Fantasy the same RSAParameters object as was used by Apostle ransomware Conclusion Since its discovery in 2021, Agrius has been solely focused on destructive operations.


Fantasy is similar in many respects to the previous Agrius wiper, Apostle, that initially masqueraded as ransomware before being rewritten to be actual ransomware.


Fantasy makes no effort to disguise itself as ransomware.


For any inquiries about our research published on WeLiveSecurity, please contact us at threatintel@eset.com.


For any inquiries about this service, visit the ESET Threat Intelligence page.


IoCs SHA-1FilenameDetectionDescription 1A62031BBB2C3F55D44F59917FD32E4ED2041224fantasy35.exeMSIL/KillDisk.


IFantasy wiper.


1AAE62ACEE3C04A6728F9EDC3756FABD6E342252host2ip.execleanResolves a hostname to an IP address.


LsassDumper.


HImplementation of Mimikatz minidump that dumps credentials from LSASS.


APython script that dumps credential hashes.


XHSandals lateral movement tool and Fantasy spreader.


MITRE ATT&CK techniques This table was built using version 12 of the MITRE ATT&CK framework.


TacticIDNameDescription Resource DevelopmentT1587Develop CapabilitiesAgrius builds utility tools to use during an active exploitation process.


T1587.001Develop Capabilities: MalwareAgrius builds custom malware including wipers (Fantasy) and lateral movement tools (Sandals).


Windows Command ShellFantasy and Sandals both use batch files that run via the Windows command shell. Privilege EscalationT1134Access Token ManipulationFantasy uses the LookupPrivilegeValue and AdjustTokenPrivilege APIs in advapi32.dll to grant its process token the SeShutdownPrivilege to reboot Windows.


Defense EvasionT1070.006Indicator Removal on Host: TimestompAgrius operators timestomped the compilation timestamps of Fantasy and Sandals.


Credential AccessT1003OS Credential DumpingAgrius operators used several tools to dump OS credentials for use in lateral movement.


Lateral MovementT1021.002Remote Services: SMB/Windows Admin SharesAgrius operators used cached credentials to connect over SMB to systems within an exploited internal network.


T1570Lateral Tool TransferAgrius operators used Sandals to push batch files over SMB to other systems within an internal network.


T1561.002Disk WipeFantasy wipes the MBR of the Windows drive and attempts to wipe the OS partition.


T1561.001Disk Wipe: Disk Content WipeFantasy wipes all disk contents from non-Windows drives that are fixed drives.


T1529System Shutdown/RebootFantasy reboots the system after completing its disk and data wiping payloads.


Appendix File extensions (682) targeted by Fantasy wiper when not targeting all file extensions.


File extensions highlighted in yellow (68) are common filename extensions in Windows.


Notably absent are file extensions dll and sys. $$$blenddrwjspnyfqualsoftcodetdb $dbblend1dsbkb2oabquicken2015backuptex 001blend2dsskbxobjquicken2016backuptga 002blobdtdkc2obkquicken2017backupthm 003bm3dwgkdbodbquickenbackuptib 113bmkdxbkdbxodcqv~tibkp 3dmbookexportdxfkdcodfr3dtif 3dsbpadxgkeyodgraftig 3frbpbem1kfodmrartis 3g2bpmepkkpdxodprattlg 3gpbpnepslayoutodsrawtmp 3prbpserbsqllbfodtrbtmr 73bbpwerflcboebrbctor 7zbsaesmldabakoggrbftrn __abupexelitemodoilrbkttbk __bcexfllxoldrbstxt abcaafbclnkonepkgrdbuci ab4casfbfltxorfre4upk abacbkfbkluaorirgss3av2i abbucbsfbulvlorigrimvb abfcbufbwmostrmvbk abkcdffdbm2otgrmbakvbm abucdrffm3uothrmgbvbox-prev abu1cdr3ffdm4aotproflvcf accdbcdr4fffm4votsrrrvdf accdecdr5fhmapottrtfvfs0 accdrcdr6fhdmaxoyxrw2vmdk accdtcdrwfhfmbfp12rwlvob achcdxflambkp7brwzvpcbackup acpce2flatmbwp7cs3dbvpk acrcelflkamcmetapabsafenotebackupvpp_pc actcenon~flkbmdbpagessas7bdatvrb adbcerflvmdbackuppaksavvtf adicfpfmbmdcpaqsayw01 adscfrforgemddatapassbw3x aeacgmfosmdfpatsbbwallet aficibfpkmdinfopbasbswalletx agdlck9fpsxmefpbbsbuwar aiclassfpxmempbdsdOwav aitclsfshmenupbfsdawb2 alcmfftmbmfwpbjsdcwbb apjcmtfulmigpblsdfwbcat apkconfigfwbackupmkvpbx5scriptsidwbk arccpifxgmlxpbxscriptsiddwbx arch00cppfzammwpcdsidnwin arwcr2fzbmoneywellpctsiewjf as4crawgb1mospdbsimwma asdcrdsgb2movpddsiswmo asfcrtgbpmp3pdfskbwmv ashbakcrwgdbmp4pefsldmwotreplay asmcsghompbpemsldxwpb asmxcsdghsmpegpfislmwpd aspcshgraympgpfxslnwps aspxcslgreympqgephpsmewspak assetcsmgrymrwphp5sn1wxwanam asvcssgs-bckmrwrefphtmlsn2x asvxcsvgzmsgpk7snax11 asxd3dbsphmsipkpasssnsx3f ateda0hbkmsimplsnxxbk atidachkdbmv_plcspfxf avidashkxmydplcspgxis awgdashhplgmynotesbackuppngspixla ba6daziphppnb7potspsxlam ba7dbhtmnbapotmsqbxlk ba8db-journalhtm1nbakpotxsqlxlm ba9db0htmlnbdppamsqlitexlr bacdb3hvplnbdppssqlite3xls backdbaibanknbfppsmsqlitedbxlsb backupdbfibdnbippsxsr2xlsm backup1dbkibknbkpptsrfxlsx backupdbdbsibznbspptmsrrxlt bakdbxicbunbupptxsrtxltm bak2dc2icfncfpqb-backupsrwxltx bak3dcricxsncoprfst4xlw bakxdcsidxndprvst6xml bak~dddiifndapsst7ycbcra bankddociiqnddpsast8yrcbck barddrwincpasnefpsafe3stdyuv batddsinddnfbpsdstgzbfx bayderindexnfcpskstizip bbbdesinprogressnk2pspimagestwztmp bbzdescipdnoppststx~cw bc6designisonoyptbsty bc7dgcitdbnpfptxsum bckdimitlnpspvcsv$ bckpdivxitmnrbakpvhdsv2i bcmdiyiv2inrspysvg bdbdjvuiwdnrwqbaswf bffdmpiwins2qbbsxc bgtdnaj01ns3qbksxd bifdngjarns4qbmsxg bifxdocjavansdqbmbsxi bigdocmjbknsfqbmdsxm bikdocxjdcnsgqbrsxw bk1dotjpanshqbwsyncdb bkcdotmjpentlqbxt12 bkfdotxjpegnwbqbyt13 bkpdovjpgnwbakqdftar bkupdpbjpsnx2qictax bkzdrfjsnxlqsftbk 7 Dec 2022 - 11:30AM


Original release date: November 16, 2022 | Last revised: November 25, 2022SummaryFrom mid-June through mid-July 2022, CISA conducted an incident response engagement at a Federal Civilian Executive Branch (FCEB) organization where CISA observed suspected advanced persistent threat (APT) activity.

AA22320A Iranian GovernmentSponsored APT Actors Compromise Federal Network Deploy Crypto Miner Credential Harvester


CISA and the Federal Bureau of Investigation (FBI) assess that the FCEB network was compromised by Iranian government-sponsored APT actors.


CISA and FBI encourage all organizations with affected VMware systems that did not immediately apply available patches or workarounds to assume compromise and initiate threat hunting activities.


If suspected initial access or compromise is detected based on IOCs or TTPs described in this CSA, CISA and FBI encourage organizations to assume lateral movement by threat actors, investigate connected systems (including the DC), and audit privileged accounts.


Download the PDF version of this report: pdf, 528 kb.


For a downloadable copy of IOCs, see: AA22-320A.stix, 1.55 mb.


Technical DetailsNote: This advisory uses the MITRE ATT&CK for Enterprise framework, version 11.


See the MITRE ATT&CK Tactics and Techniques section for a table of the threat actors’ activity mapped to MITRE ATT&CK:registered: tactics and techniques with corresponding mitigation and/or detection recommendations.


Overview In April 2022, CISA conducted retrospective analysis using EINSTEIN—an FCEB-wide intrusion detection system (IDS) operated and monitored by CISA—and identified suspected APT activity on an FCEB organization’s network.


CISA observed bi-directional traffic between the network and a known malicious IP address associated with exploitation of the Log4Shell vulnerability (CVE-2021-44228) in VMware Horizon servers.


In coordination with the FCEB organization, CISA initiated threat hunting incident response activities; however, prior to deploying an incident response team, CISA observed additional suspected APT activity.


Based on trusted third-party reporting, is a Lightweight Directory Access Protocol (LDAP) server associated with threat actors exploiting Log4Shell.


Following HTTPS activity, CISA observed a suspected LDAP callback on port 443 to this IP address.


CISA also observed a DNS query for that resolved back to when the victim server was returning this Log4Shell LDAP callback to the actors’ server.


CISA assessed that this traffic indicated a confirmed compromise based on the successful callback to the indicator and informed the organization of these findings; the organization investigated the activity and found signs of compromise.


As trusted-third party reporting associated Log4Shell activity from with lateral movement and targeting of DCs, CISA suspected the threat actors had moved laterally and compromised the organization’s DC. From mid-June through mid-July 2022, CISA conducted an onsite incident response engagement and determined that the organization was compromised as early as February 2022, by likely Iranian government-sponsored APT actors who installed XMRig crypto mining software.


The threat actors also moved laterally to the domain controller, compromised credentials, and implanted Ngrok reverse proxies.


As part of their initial exploitation, CISA observed a connection to known malicious IP address lasting 17.6 seconds.


The actors’ exploit payload ran the following PowerShell command [T1059.001] that added an exclusion rule to


Windows Defender


The exploit payload then downloaded from to [T1105].


When executed, mde.ps1 downloaded from and removed from the disk [T1070.004]. contained XMRig cryptocurrency mining software and associated configuration files.


This file can create a local user account


[T1136.001] and tests for internet connectivity by pinging [T1016.001].


The exploit payload created a Scheduled Task


Note:


By exploiting Log4Shell, the actors gained access to a VMware service account with administrator and system level access.


See MAR 10387061-1.v1 for additional information, including IOCs, on these four files.


After obtaining initial access and installing XMRig on the VMWare Horizon server, the actors used RDP [T1021.001] and the built-in Windows user account


[T1078.001] to move laterally [TA0008] to a VMware VDI-KMS host.


Once the threat actor established themselves on the VDI-KMS host, CISA observed the actors download around 30 megabytes of files from server associated with .


The actors downloaded the following tools: PsExec – a Microsoft signed tool for system administrators.


Mimikatz – a credential theft tool.


Ngrok – a reverse proxy tool for proxying an internal service out onto an Ngrok domain, which the user can then access at a randomly generated subdomain at .


CISA has observed this tool in use by some commercial products for benign purposes; however, this process bypasses typical firewall controls and may be a potentially unwanted application in production environments.


Ngrok is known to be used for malicious purposes.[1] The threat actors then executed Mimikatz on VDI-KMS to harvest credentials and created a rogue domain administrator account


The actors were able to proxy [T1090] RDP sessions, which were only observable on the local network as outgoing HTTPS port 443 connections to and (the prior domain in reverse).


[T1098] on several hosts as a backup should the rogue domain administrator account get detected and terminated.


Additionally, the threat actor was observed attempting to dump the Local Security Authority Subsystem Service (LSASS) process [T1003.001] with task manager but this was stopped by additional anti-virus the FCEB organization had installed. MITRE ATT&CK TACTICS AND TECHNIQUES See table 1 for all referenced threat actor tactics and techniques in this advisory, as well as corresponding detection and/or mitigation recommendations.


Table 1: Cyber Threat Actors ATT&CK Techniques for Enterprise Initial Access Technique Title ID Use Recommendations Exploit Public-Facing Application T1190 The actors exploited Log4Shell for initial access to the organization’s VMware Horizon server.


Mitigation/Detection: Use a firewall or web-application firewall and enable logging to prevent and detect potential Log4Shell exploitation attempts [M1050].


[M1016],[M1051]. Execution Technique Title ID Use Recommendation Command and Scripting Interpreter: PowerShell T1059.001 The actors ran PowerShell commands that added an exclusion rule to Windows Defender.


The actors executed PowerShell on the AD to obtain a list of machines on the domain.


Mitigation: Disable or remove PowerShell for non-administrative users [M1042],[M1026] or enable code-signing to execute only signed scripts [M1045].


Mitigation: Employ anti-malware to automatically detect and quarantine malicious scripts [M1049].


Persistence Technique Title ID Use Recommendations Account Manipulation T1098 The actors changed the password for the local administrator account on several hosts.


Monitor events for changes to account objects and/or permissions on systems and the domain, such as event IDs 4738, 4728, and 4670.


Monitor for modification of accounts in correlation with other suspicious activity [DS0002].


Create Account: Local Account T1136.001


Mitigation: Configure access controls and firewalls to limit access to domain controllers and systems used to create and manage accounts.


Monitor executed commands and arguments for actions that are associated with local account creation, such as net user /add , useradd, and dscl -create


[DS0002]. Create Account:


Domain Account T1136.002


The actors used Mimikatz to create a rogue domain administrator account.


[DS0002]. Scheduled Task/Job: Scheduled Task T1053.005


The actors’ exploit payload created Scheduled Task RuntimeBrokerService.exe, which executed RuntimeBroker.exe daily as SYSTEM.


Monitor for newly constructed processes and/or command-lines that execute from the svchost.exe in Windows 10 and the Windows Task Scheduler taskeng.exe for older versions of Windows [DS0009] Detection:


[DS0003]. Valid Accounts: Default Accounts T1078.001


Develop rules to monitor logon behavior across default accounts that have been activated or logged into [DS0028]. Defense Evasion Technique Title ID Use Recommendations Impair Defenses: Disable or Modify Tools T1562.001


[M1018]. Detection:


Monitor for changes made to Windows Registry keys and/or values related to services and startup programs that correspond to security tools such as HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender


[DS0024]. Detection:


Monitor for telemetry that provides context for modification or deletion of information related to security software processes or services such as Windows Defender definition files in Windows and System log files in Linux [DS0013]. Detection:


Monitor processes for unexpected termination related to security tools/services [DS0009].


Indicator Removal on Host: File Deletion T1070.004


The actors removed malicious file mde.ps1 from the dis. Detection:


Monitor for unexpected deletion of files from the system [DS0022].


Credential Access Technique Title ID Use Recommendations OS Credential Dumping: LSASS Memory T1003.001


The actors were observed trying to dump LSASS process.


Mitigation: With Windows 10, Microsoft implemented new protections called Credential Guard to protect the LSA secrets that can be used to obtain credentials through forms of credential dumping [M1043] Mitigation: On Windows 10, enable Attack Surface Reduction (ASR) rules to secure LSASS and prevent credential stealing [M1040].


Monitor for unexpected processes interacting with LSASS.exe.


[DS0009]. Detection:


[DS0017]. Credentials from Password Stores T1555 The actors used Mimikatz to harvest credentials.


Mitigation: Organizations may consider weighing the risk of storing credentials in password stores and web browsers.


Monitor for processes being accessed that may search for common password storage locations to obtain user credentials [DS0009].


Monitor executed commands and arguments that may search for common password storage locations to obtain user credentials [DS0017].


The actors executed a PowerShell command on the AD to obtain a list of all machines attached to the domain.


Monitor for newly executed processes that can be used to discover remote systems, such as ping.exe and tracert.exe, especially when executed in quick succession [DS0009]. System Network Configuration Discovery: Internet Connection Discovery T1016.001 The actors’ malware tests for internet connectivity by pinging 8.8.8.8. Mitigation: Monitor executed commands, arguments [DS0017] and executed processes (e.g., tracert or ping)


[DS0009] that may check for internet connectivity on compromised systems.


Lateral Movement Technique Title ID Use Recommendations Remote Services:


Remote Desktop Protocol T1021.001 The actors used RDP to move laterally to multiple hosts on the network.


Mitigation: Use MFA for remote logins [M1032].


Mitigation: Disable the RDP service if it is unnecessary [M1042].


Mitigation: Do not leave RDP accessible from the internet.


Enable firewall rules to block RDP traffic between network security zones within a network [M1030].


Mitigation: Consider removing the local Administrators group from the list of groups allowed to log in through RDP


Monitor for user accounts logged into systems associated with RDP (ex: Windows EID 4624 Logon Type 10).


Other factors, such as access patterns (ex: multiple systems over a relatively short period of time) and activity that occurs after a remote login, may indicate suspicious or malicious behavior with RDP [DS0028]. Command and Control Technique Title ID Use Recommendations Proxy T1090 The actors used Ngrok to proxy RDP connections and to perform command and control.


Mitigation: Traffic to known anonymity networks and C2 infrastructure can be blocked through the use of network allow and block lists


[M1037]. Detection:


Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g., extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure)


[DS0029]. Ingress Tool Transfer T1105


INCIDENT RESPONSE If suspected initial access or compromise is detected based on IOCs or TTPs in this CSA, CISA encourages organizations to assume lateral movement by threat actors and investigate connected systems and the DC.


CISA recommends organizations apply the following steps before applying any mitigations, including patching.


Immediately isolate affected systems.


Consider soliciting support from a third-party incident response organization that can provide subject matter expertise to ensure the actor is eradicated from the network and to avoid residual issues that could enable follow-on exploitation.


Report incidents to CISA via CISA’s 24/7 Operations Center (report@cisa.gov or 888-282-0870) or your local FBI field office, or


FBI’s 24/7 Cyber Watch (CyWatch) at (855) 292-3937 or by e-mail at CyWatch@fbi.gov. MitigationsCISA and FBI recommend implementing the mitigations below and in Table 1 to improve your organization's cybersecurity posture on the basis of threat actor behaviors.


Install updated builds to ensure affected VMware Horizon and UAG systems are updated to the latest version.


If updates or workarounds were not promptly applied following VMware’s release of updates for Log4Shell in December 2021, treat those VMware Horizon systems as compromised.


Follow the pro-active incident response procedures outlined above prior to applying updates.


See VMware Security Advisory VMSA-2021-0028.13 and VMware Knowledge Base (KB) 87073 to determine which VMware Horizon components are vulnerable.


Note: Until the update is fully implemented, consider removing vulnerable components from the internet to limit the scope of traffic.


If upgrading is not immediately feasible, see KB87073 and KB87092 for vendor-provided temporary workarounds.


Implement temporary solutions using an account with administrative privileges.


Note that these temporary solutions should not be treated as permanent fixes; vulnerable components should be upgraded to the latest build as soon as possible.


Prior to implementing any temporary solution, ensure appropriate backups have been completed.


Verify successful implementation of mitigations by executing the vendor supplied script without parameters to ensure that no vulnerabilities remain.


See KB87073 for details.


Keep all software up to date and prioritize patching known exploited vulnerabilities (KEVs).


Minimize the internet-facing attack surface by hosting essential services on a segregated DMZ, ensuring strict network perimeter access controls, and not hosting internet-facing services that are not essential to business operations.


Where possible, implement regularly updated web application firewalls (WAF) in front of public-facing services.


WAFs can protect against web-based exploitation using signatures and heuristics that are likely to block or alert on malicious traffic.


Use best practices for identity and access management (IAM) by implementing phishing resistant multifactor authentication (MFA), enforcing use of strong passwords, regularly auditing administrator accounts and permissions, and limiting user access through the principle of least privilege.


If using Windows 10 version 1607 or Windows Server 2016 or later, monitor or disable Windows , also known as the Default System Managed Account (DSMA).


Audit domain controllers to log successful Kerberos Ticket Granting Service (TGS) requests and ensure the events are monitored for anomalous activity.


Enforce the principle of least privilege.


Administrator accounts should have the minimum permission necessary to complete their tasks.


Create non-privileged accounts for privileged users and ensure they use the non-privileged accounts for all non-privileged access (e.g., web browsing, email access).


Use virtualizing solutions on modern hardware and software to ensure credentials are securely stored.


Ensure storage of clear text passwords in LSASS memory is disabled.


Note: For Windows 8, this is enabled by default.


For more information see Microsoft Security Advisory Update to Improve Credentials Protection and Management. Consider disabling or limiting NTLM and WDigest Authentication.


Implement Credential Guard for Windows 10 and Server 2016 (refer to Microsoft: Manage Windows Defender Credential Guard for more information).