QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: The information collected is performed using WMI queries: Additionally the malware lists the running process via the Microsoft Windows API. The malware uses obfuscation in order to hide strings such as URL or User-Agent, the algorithm is based on bitwise (SUB 0x0F XOR 0x21), here is the decoded data
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: This recent campaign used malicious documents to install malware on the targeted system using a template injection attack. This technique allows a weaponized document to download an external Word template containing macros that will be executed. This is a known trick used to bypass static malicious document analysis, as well as detection, as the macros are embedded in the downloaded template
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: The SUPERNOVA webshell is an anonymous code C# webshell written in .NET C# that is specifically written for usage on SolarWinds Orion servers
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: 1) The script uses the function fromCharCode() that returns a string created from a sequence of UTF-16 code units. By using this function, it avoids explicitly writing commands it wants to execute and it hides the actual code it is initiating. In particular, the script uses this function to hide information related to process names. To the best of our knowledge, this method was not used in early versions of the spam campaign. 2) The script uses the function radador(), which returns a randomized integer. In contrast to the first method of obfuscation, this has been used effectively since early versions of the Astaroth Trojan campaign
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: The group has made significant improvements to their arsenal recently and has both developed new tools and modified existing ones. The key observations covered below are based on CrowdStrike® Intelligence analysis of BazarLoader, Conti and Ryuk operations
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: CrowdStrike also identified a connection between StellarParticle-related campaigns and the abuse of Microsoft Cloud Solution Partners’ O365 tenants. This threat actor abused access to accounts in the Cloud Solution Partner’s environment with legitimate delegated administrative privileges to then gain access to several customers’ O365 environments
MITRE ATT&CK techniques:
- T1199: Trusted Relationship
Threat description: Malware used by the threat group can be configured to bypass network-based detection; however, the threat actors rarely modify host-based configuration settings when deploying payloads. The threat actors demonstrated the ability to adapt when reentering a network after an eviction, overcoming technical barriers constructed by network defenders
MITRE ATT&CK techniques:
- T1056.001: Input Capture - Keylogging
Threat description: In one of these campaigns, Waterbug used a USB stealer that scans removable storage devices to identify and collect files of interest. It then packages stolen files into a password-protected RAR archive. The malware then uses WebDAV to upload the RAR archive to a Box account
MITRE ATT&CK techniques:
- T1567.002: Exfiltration Over Web Service - Exfiltration to Cloud Storage
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: TA505 sent several similar campaigns in mid-October with VBScript compressed in 7-Zip files that also downloaded either Locky or The Trick. By late October, the actor switched to Microsoft Word attachments that abused Dynamic Data Exchange (DDE) to download either Locky or Locky and The Trick in several more geo-targeted campaigns. This was the first time that we observed TA505 abusing DDE, a legitimate feature in Microsoft Office that became a regular part of multiple threat actors’ toolkits in Q4 2017. Recipients of these emails, which also used simple lures with attached fake invoices, needed to open the Microsoft Word attachments and click through a security dialog (Figure 3) to download the malware
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
Threat description: In addition to these malware families, GALLIUM has been observed employing SoftEther VPN software to facilitate access and maintain persistence to a target network. By installing SoftEther on internal systems, GALLIUM is able to connect through that system as though they are on the internal network of the target. SoftEther provides GALLIUM with another means of persistence and flexibility with the added benefit that its traffic may appear to be benign on the target network
MITRE ATT&CK techniques:
- T1133: External Remote Services
Threat description: The most notable change to this variant of Zebrocy, other than the programming language used, is the way the tool gathers the system information and running processes. Instead of using systeminfo and tasklist commands, the C# variant of Zebrocy uses WMI queries to gather this information
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: No exploits were used, so the victim would have to manually execute the malware dropper, which pretends to be an Adobe Flash installer. However, our analysis confirmed that Bad Rabbit uses the EternalRomance exploit as an infection vector to spread within corporate networks. The same exploit was used in the ExPetr
MITRE ATT&CK techniques:
- T1210: Exploitation of Remote Services
Threat description: Another new feature in the latest UPPERCUT sample is that the malware sends an error code in the Cookie header if it fails to receive the HTTP response from the command and control (C2) server. The error code is the value returned by the GetLastError function and sent in the next beacon. This was likely included to help the attackers understand the problem if the backdoor is unable to receive a response (Figure 9). This Cookie header is a unique indicator that can be used for network-based detection
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: A Golden Ticket (GT) can be created to impersonate any user (real or imagined) in the domain as a member of any group in the domain (providing a virtually unlimited amount of rights) to any and every resource in the domain. Since the Golden Ticket is an authentication ticket (TGT described below), its scope is the entire domain (and the AD forest by leveraging SID History) since the TGT is used to get service tickets (TGS) used to access resources. The Golden Ticket (TGT) contains user group membership information (PAC) and is signed and encrypted using the domain’s Kerberos service account (KRBTGT) which can only be opened and read by the KRBTGT account
MITRE ATT&CK techniques:
- T1134.005: Access Token Manipulation - SID-History Injection
Threat description: The presence of this credential stealer may partially answer how Kobalos propagates. Anyone using the SSH client of a compromised machine will have their credentials captured. Those credentials can then be used by the attackers to install Kobalos on the newly discovered server later
MITRE ATT&CK techniques:
- T1056: Input Capture
Threat description: Extracting and dropping an OpenSSH binary from its PE resources - Extracting, dropping, and configuring the RDP Wrapper Library software from its PE resources - Creating a new user “supportaccount” with a password of “Ghar4f5” - Adding this user to the “Remote Desktop Users” and “Administrators” groups
MITRE ATT&CK techniques:
- T1136.001: Create Account - Local Account
Threat description: Poseidon utilizes a variety of tools. This tool appears to be designed to operate on high-value corporate systems like Domain Controllers or IIS servers that act as repositories of valuable information, particularly for lateral movement. This tool contains several other executable files made in different programming languages ranging from Visual Basic 6 to C#, each one performing a very clear task devised by the group when trying to obtain more information from an objective
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: As the final reconnaissance step, if the system is domain-joined, BoomBox executes an LDAP query to gather data such as distinguished name, SAM account name, email, and display name of all domain users via the filter (&amp;(objectClass=user)(objectCategory=person
MITRE ATT&CK techniques:
- T1087.003: Account Discovery - Email Account
- T1087.002: Account Discovery - Domain Account
Threat description: Operational since April 2019, the group obtained the GandCrab source code from GOLD GARDEN, the operators of GandCrab that voluntarily withdrew their ransomware from underground markets in May 2019. CTU researchers assess with high confidence that GOLD SOUTHFIELD is a former GandCrab affiliate and continues to work with other former GandCrab affiliates. In December 2019, GOLD SOUTHFIELD began operating a name-and-shame style website that uses stolen data from intrusions to generate additional leverage against victims; a tactic known as double extortion. Despite GOLD SOUTHFIELD's infrastructure being taken down by law enforcement in October 2021, the REvil leak site re-emerged in April 2022 with several new victims added. GOLD SOUTHFIELD also began recruiting exclusively via their leak site using the peer-to-peer secure messaging software Tox Chat. GOLD SOUTHFIELD's affiliates distribute ransomware through a variety of means including exploit kits, scan-and-exploit attacks, publicly-accessible RDP, remote management and monitoring (RMM) servers, and backdoored software installers. As of May 2022, the group continues to operate REvil as a name-and-shame scheme and uses a leak site to post victim information and recruit affiliates
MITRE ATT&CK techniques:
- T1195.002: Supply Chain Compromise - Compromise Software Supply Chain
Threat description: After all this, if the malware successfully discovers a viable target and is able to gain access through SSH credential brute forcing, the malware will be able to begin installation of the cryptocurrency miner. Linux Rabbit attempts to install both “CNRig” and “CoinHive” Monero miners onto the machine, but only one will actually successfully install depending on what type of architecture the machine is. If the machine is a x86-bit, it will install CNRig Monero miner and if the machine is an ARM/MISP, it will install CoinHive. If the infected machine is a web server, the malware will inject CoinHive script tags into every HTML file, so that even visitors of the site/server are also infected with the cryptocurrency miner. Linux Rabbit is able to connect to GitHub and receive updates from the threat actors. It also has a killswitch built-in. It is able to detect other miners already on a target machine and delete them from the machine during the installation of its own miner
MITRE ATT&CK techniques:
- T1110.003: Brute Force - Password Spraying
Threat description: Multiple SUNBURST samples have been recovered, delivering different payloads. In at least one instance the attackers deployed a previously unseen memory-only dropper we’ve dubbed TEARDROP to deploy Cobalt Strike BEACON
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: How about DPAPI with keys tied per user &amp; system. Volume serial ID keying. See the APT41 talk #FireEyeSummit7:19 PM · Oct 30, 2019·Twitter for Android12 Retweets1 Quote Tweet35 LikesNick Carr@ItsReallyNick
MITRE ATT&CK techniques:
- T1480.001: Execution Guardrails - Environmental Keying
Threat description: In one instance, the threat actor gained remote access to a high-value system in a compromised network, ran quser.exe to identify existing RDP sessions on the device, immediately ran a command to compile a RAR archive that specified file types the threat actor did not want, and used a password to encrypt the archive
MITRE ATT&CK techniques:
- T1005: Data from Local System
- T1119: Automated Collection
Threat description: The actors have regularly leveraged Cobalt Strike BEACON and Metasploit Meterpreter to move laterally within victim environments. The actors commonly moved laterally within victim environments using compromised accounts—both those belonging to regular users and accounts with administrative privileges. In addition to the use of common post-exploitation frameworks, lateral movement has also been achieved using WMIC commands and the Windows RDP and SMB protocols. The actors used the Windows net use command to connect to Windows admin shares to move laterally
MITRE ATT&CK techniques:
- T1078.002: Valid Accounts - Domain Accounts
Threat description: Whitefly usually attempts to remain within a targeted organization for long periods of time—often months—in order to steal large volumes of information. It keeps the compromise alive by deploying a number of tools that facilitate communication between the attackers and infected computers
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: By gaining access to the configuration panel the attackers configured the Apache web server and started using the router as a proxy server between the organization’s corporate and restricted segments
MITRE ATT&CK techniques:
- T1090.001: Proxy - Internal Proxy
Threat description: GetST.py: Given a password, hash, aesKey or TGT in ccache, this script will request a Service Ticket and save it as ccache. If the account has constrained delegation (with protocol transition) privileges you will be able to use the -impersonate switch to request the ticket on behalf another user. GetPac.py: This script will get the PAC (Privilege Attribute Certificate) structure of the specified target user just having a normal authenticated user credentials. It does so by using a mix of [MS-SFU]’s S4USelf + User to User Kerberos Authentication. GetUserSPNs.py: This example will try to find and fetch Service Principal Names that are associated with normal user accounts. Output is compatible with JtR and HashCat. GetNPUsers.py: This example will attempt to list and get TGTs for those users that have the property ‘Do not require Kerberos preauthentication’ set (UF_DONT_REQUIRE_PREAUTH). Output is compatible with JtR. ticketConverter.py: This script will convert kirbi files, commonly used by mimikatz, into ccache files used by Impacket, and vice versa. raiseChild.py: This script implements a child-domain to forest privilege escalation by (ab)using the concept of Golden Tickets and ExtraSids
MITRE ATT&CK techniques:
- T1558.003: Steal or Forge Kerberos Tickets - Kerberoasting
Threat description: Creates events "__klg__" and "__klgkillsoft__" to act as mutexes and facilitate self-removal. Installs itself to %APPDATA%\Intel Corporation\IAStorIcon.exe. Creates an entry in the user's Startup folder for persistence. Uses the SetWindowsHookExW API function to capture keystrokes system-wide. Formats and writes the keylogger output to %APPDATA%\Update\Tmp\k%d.txt, where %d is the current system tick count
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: The dropper has its encrypted payload embedded as an overlay of a PE file as extra data that will never be used in normal execution steps. Its decryption routine, part of an executable physical patch, begins somewhere between the start() and WinMain() functions. A fun fact is that the malware authors embedded their malicious code into a binary that was a harmless executable
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: The January 8 attack used a variant of the ThreeDollars delivery document, which we identified as part of the OilRig toolset based on attacks that occurred in August 2017. Instead, this attack involved delivering the OopsIE Trojan directly to the victim, most likely using a link in a spear phishing email. A New Attack On January 8, 2018, the OilRig threat group sent an email with the subject Beirut Insurance Seminar Invitation to an insurance agency in the Middle East. The OilRig group sent two emails to two different email addresses at the same organization within a six minutes time span. The recipient email addresses suggest they may be the addresses used for specific regional branches of the targeted organization. However, based upon the captured session data, it is highly likely the source email address was spoofed. The email contained an attachment named Seminar-Invitation.doc, which is a malicious Microsoft Word document we track as ThreeDollars. In this case, the ThreeDollars delivery document was not used and instead an attempt was made to deliver the OopsIE Trojan directly to the targeted organization, likely via a link within an email. While this is not a new tactic, this is the first instance where we have observed the OilRig using it in their playbook. As we have observed throughout our tracking of the OilRig group, adopting proven tactics has been a common behavior over time
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: After trying to determine whether ports are open and the machine could act as a C2 tier 2 proxy, the proxy module also starts a multithreaded SOCKS5 proxy server. The SOCKS5 protocol is encapsulated into the QakBot proxy protocol composed of: QakBot proxy command (1 byte), version (1 byte), session id (4 bytes), total packet length (dword), data (total packet length-10). Incoming and outgoing packets are stored in the buffers and may be received/transmitted one by one or in multiple packets in a single TCP data segment (streamed
MITRE ATT&CK techniques:
- T1572: Protocol Tunneling
Threat description: The core component will check whether it is located in the %temp%\[appname] directory, otherwise it copies itself to %temp%\[appname]\[appname] and set the file attribute to hidden
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: First, the malware checks for the existence of a Mutex value, “EKANS”, on the victim. If present, the ransomware will stop with a message “already encrypted. Otherwise, the Mutex value is set and encryption moves forward using standard encryption library functions. Primary functionality on victim systems is achieved via Windows Management Interface (WMI) calls, which begins executing encryption operations and removes Volume Shadow Copy backups on the victim
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
Threat description: All of the attacks involved spear-phishing emails to deliver malicious documents that required the recipient to carry out some action. The payload in a majority of these attacks was a backdoor called Spark, which is a backdoor that allows the threat actors to open applications and run command line commands on the compromised system
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
- T1204.001: User Execution - Malicious Link
Threat description: To ensure that the compromised system is unable to restore from backup, REvil deletes shadow copies and disables recovery mode by executing the following command via ShellExecute. The length and uniqueness of this command allow for the development of high-fidelity detection controls
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: an “object_id” that is a unique uuid used to identify the victim, when the value is not set in the file, it is generated randomly by the malware - a list of processes into which code is injected (iproc) - the frequency and time for task execution / backup logs / connection to the C&amp;C ([TIME]) - the IP addresses of other computers on the network ([CW_LOCAL]) - the C&amp;C server addresses ([CW_INET]) - the named pipes used to communicate with the injected library and with the other computers ([TRANSPORT
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: The ‘microsoft-cache’ domain was used by the malware variant that communicated over HTTP. We found four unique samples communicating with this domain, which resolved to the same Hong Kong-based IP address used by the first two domains
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: When the Trojan runs as an executable within the "DsvHelper" folder, the Trojan will create a shortcut (.lnk file) and save the shortcut to the 'DsvHelper' folder. The embedded payload written to process memory exists in the "R" resource and called function in the new payload is named "RPe.Test.Work". The function will take another executable embedded in the initial Trojan as a resource named "M", which it attempts to inject into the following process to execute: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe While it's configured to inject into cvtres.exe, the Trojan is also capable of injecting its code into the following process as well: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
MITRE ATT&CK techniques:
- T1055.012: Process Injection - Process Hollowing
Threat description: It iterates over all possible Office &lt;version&gt; values for both Word and Excel &lt;product&gt; values. It then scans for documents with valid Word or Excel file extensions on all drives connected to the system. The malware moves each located document into the AppData folder, inserts malicious Word or Excel macros into it using a Microsoft.Office.Interop object, and then moves the document back into its original folder. In the samples we analyzed, the injected macros were simple downloaders
MITRE ATT&CK techniques:
- T1080: Taint Shared Content
Threat description: The developer rewrote a large part of the code however the workflow is the same as previously and some features are copy/paste. The biggest change is the network communication with the C2 server. The malware does not use a raw socket anymore but all the communications are performed with WinInet. The malware performs connection to the C2 server by using InternetOpenA() with an hardcoded User-Agent: "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322". Note the missing parenthesis at the end of the User-Agent. This variant has exactly the same features as the previous variant: file listing, OS version getting, process killing, drive listing, execution via ShellExecuteW(), execution via named pipe, cleaning, file removal, file downloading. Here is an example of code similarities on the execution via named pipe function. On the left a sample from Bisonal 2014 and on the right Bisonal 2011. The code is not exactly the same but the workflow and some constants are similar
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: The first thread is responsible for taking a screenshot of the desktop of the victim machine. This screenshot data is both compressed and encrypted using a single-byte xor key of 0x5F. This data is written to one of the following files
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: If this is successful, the malware creates a :0 alternate data stream in the executable and copies the executable’s own contents to the stream. This can be used to restore the executable later. Then the malware replaces the contents of the executable with a copy of itself and launches the service. The file modified time of the executable is also artificially changed to 00:00:00 UTC. The purpose of this time change is so the file can be identified and restored by the decryption tool
MITRE ATT&CK techniques:
- T1070.006: Indicator Removal - Timestomp
Threat description: Since the discovery of the {A96B020F-0000-466F-A96D-A91BBF8EAC96}.dll backdoor and its public analysis by multiple researchers, we observed some changes in the malware’s configuration data. First, the authors started removing the names from the helper DLLs (DNSprov.dll and the two versions of HttpProv.dll). Then the operators stopped packaging the third DLL (second version of HttpProv.dll), choosing to embed just one
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: 1) Using the compromised SolarWinds DLL to activate a backdoor that enables attackers to remotely control and operate on a device 2) Using the backdoor access to steal credentials, escalate privileges, and move laterally to gain the ability to create valid SAML tokens using any of two methods: Stealing the SAML signing certificate (Path 1) Adding to or modifying existing federation trust (Path 2) 3) Stealing the SAML signing certificate (Path 1) 4) Adding to or modifying existing federation trust (Path 2) 5) Using attacker-created SAML tokens to access cloud resources and perform actions leading to the exfiltration of emails and persistence in the cloud
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: The ‘vsnet’ plugin was intended to spread and launch a payload (BlackEnergy2 dropper itself at the moment) in the local network by using PsExec, as well as gaining primary information on the user’s computer and network. It was a ddos tool compiled to run on ARM systems
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
Threat description: Kwampirs uses a fairly aggressive means to propagate itself once inside a victim's network by copying itself over network shares
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
Threat description: In order to exfiltrate data from a network segment not connected to the Internet, the threat actor deployed a modified version of hTran. This ‘connection bouncer’ tool lets the threat actor redirect ports and connections between different networks and obfuscate C2 server traffic. There have been numerous reports of hTran being used by different Chinese threat actors, including: APT3, APT27 and DragonOK
MITRE ATT&CK techniques:
- T1090.002: Proxy - External Proxy
Threat description: Each web shell instance is configured to contain SP, Key, and Log variables. When the malicious ISAPI filter captures a username matching this variable, it knows to handle the incoming HTTP request as a command to the web shell. The DES key to encrypt the credentials in the configuration observed by CTU researchers is 12345678, and the log file is c:\log.txt. The decrypted contents of the log file adhere to the format in Figure 22
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: Compromise website of strategic importance (e.g. websites visitors have a higher likelihood to be targets of interest) - Add one or more webshell backdoors to victim websites to maintain persistence - Webshell used to add JavaScript developed by OceanLotus into the website - The malicious JavaScript makes calls over HTTP or HTTPS to attacker controlled domains to typically load one of two different OceanLotus frameworks - OceanLotus JavaScript frameworks designed to track, profile, and target the compromised website's visitors - Website visitors of interest are flagged for targeting and receive special JavaScript aimed at compromising the user's system or e-mail accounts
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Make a unique filename. This useful utility is widely used by malware to make random, unique file and directory names for payloads. Despite the name, mktemp does not have to be used only in the /tmp directory
MITRE ATT&CK techniques:
- T1564: Hide Artifacts
Threat description: We discovered that TeamTNT gained initial access with the Hildegard malware by executing commands on kubelets that allow anonymous access. This was achieved by accessing the kubelet’s run command API and executing commands on running containers
MITRE ATT&CK techniques:
- T1609: Container Administration Command
- T1133: External Remote Services
Threat description: The Leeson, Neoichor, and NumbIdea malware families typically use the Internet Explorer (IE) COM interface to connect and receive commands from hardcoded C2 servers. Due to their reliance on IE, these malware families intentionally configure the browser settings by modifying the following registry entries
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
- T1112: Modify Registry
Threat description: We also identified a Tomiris variant (internally named “SBZ”, MD5 51AA89452A9E57F646AB64BE6217788E) which acts as a filestealer, and uploads any recent file matching a hardcoded set of extensions (.doc, .docx, .pdf, .rar, etc
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Once TrickBot verifies it can connect to the Internet, it communicates with C2 servers, some of which using TOR-related domains. It collects and sends information about where the target machine is located to the C2 servers
MITRE ATT&CK techniques:
- T1008: Fallback Channels
Threat description: In addition, PLAINTEE will create a unique GUID via a call to CoCreateGuid() to be used as an identifier for the victim. The malware then proceeds to collect general system enumeration data about the infected machine and enters a loop where it will decode an embedded config blob and send an initial beacon to the C2 server. The first byte of the string is used as the XOR key to in turn decode the remainder of the data
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: In multiple instances, the threat actors created new accounts on the staging targets to perform cleanup operations. The accounts created were used to clear the following Windows event logs: System, Security, Terminal Services, Remote Services, and Audit. The threat actors also removed applications they installed while they were in the network along with any logs produced. For example, the Fortinet client installed at one commercial facility was deleted along with the logs that were produced from its use. Finally, data generated by other accounts used on the systems accessed were deleted
MITRE ATT&CK techniques:
- T1070.001: Indicator Removal - Clear Windows Event Logs
- T1070.004: Indicator Removal - File Deletion
Threat description: Following the reconnaissance phase, the threat actor attempted to dump credentials stored on the compromised machines. The most common credential stealing tool used by the threat actor was a modified mimikatz that dumps NTLM hashes. This version of mimikatz did not require any command line arguments, most likely in an attempt to avoid detection based on command-line auditing. The dumped hashes were used to authenticate to other machines via pass the hash
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: After gaining access to the victim’s environment (presumably by using stolen credentials, either obtained via phishing, or bought on the dark web), the attacker sets up remote tunnelling using a SSH tool. The tool is configured to redirect traffic from a malicious domain to a proxy that is listening on a local port. The tunnel is authenticated using the attacker’s private key
MITRE ATT&CK techniques:
- T1572: Protocol Tunneling
Threat description: FoggyWeb is a passive and highly targeted backdoor capable of remotely exfiltrating sensitive information from a compromised AD FS server. It can also receive additional malicious components from a command-and-control (C2) server and execute them on the compromised server
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
- T1041: Exfiltration Over C2 Channel
Threat description: In 2020, Pawn Storm often tries to obfuscate these brute force attempts by routing their attack traffic over Tor and VPN servers. In a Microsoft article about brute-forcing Office365 credentials over Tor, Microsoft attributed the activities to Strontium, which is another name for Pawn Storm. These brute force attacks started in 2019, and then we could firmly attribute them to Pawn Storm because we could cross-relate the extensive probing of Microsoft Autodiscover servers around the world with high-confidence indicators of the group’s more traditional attack methods (spear phishing and credential phishing
MITRE ATT&CK techniques:
- T1090.003: Proxy - Multi-hop Proxy
Threat description: The ROKRAT samples used during the two "Evil New Year" and the "North Korean Human Rights" campaigns contained a reconnaissance phase. The malware uses the following registry key to get the machine type: HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData. The "System manufacturer" value is used to identify the type of machine. The source code only considers the following machine types
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: The DNS response will return a CNAME record that points to a Command and Control (C2) domain. The C2 traffic to the malicious domains is designed to mimic normal SolarWinds API communications
MITRE ATT&CK techniques:
- T1071.004: Application Layer Protocol - DNS
Threat description: The actors leveraged publicly available utilities Adfind, BLOODHOUND, SHARPHOUND, and KERBRUTE on victim networks to collect Active Directory information and credentials. WMIC commands have been used to perform host reconnaissance, including listing installed software, listing running processes, and identifying operating system and system architecture. The actors have used a batch script to ping all servers identified during Active Directory enumeration and output the results to res.txt. The actors used the Nltest command to list domain controllers
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: For example, the following sample loads the malware as shellcode within a .NET Framework project using msbuild.exe, effectively bypassing application allowlisting techniques
MITRE ATT&CK techniques:
- T1127.001: Trusted Developer Utilities Proxy Execution - MSBuild
Threat description: If elevated privileges are not obtained, the malware falls back to using the same Windows registry run key as the older mode variant for persistence HKCU\Software\Microsoft\Windows\CurrentVersion\Run. However, if the malware is successful in elevating privileges, it begins to enumerate existing Windows services on the host that are configured to run as LocalSystem. The malware selects services that are currently not active and ignores services that launch the executables svchost.exe and lsass.exe. For each service, the malware attempts to take control of the service’s executable — first using icacls.exe with the /reset flag to reset the executable’s permissions, then using takeown.exe with the /F flag to take ownership of the executable
MITRE ATT&CK techniques:
- T1007: System Service Discovery
Threat description: This INI file is parsed to determine what Comnie should do. Comnie allows the attacker to provide and subsequently execute a batch script (BAT), executable file (EXE), or dynamic-link library (DLL). Using this example, Comnie will then request data to supply to the BAT script, via the following decrypted request: h=HOSTNAME-PC&amp;f=gethostinfo.bat&amp;c=&amp; Based on network traffic witnessed, the remote C2 server was found to respond with the following information
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: The samples analyzed are packed with UPX. The UPX header has been modified to break the unpacker provided by the UPX project. Instead of having the “UPX. string, it has been replaced with “LSD. Repairing the header is needed to unpack the samples using the unpacker provided by the UPX team
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: According to Group-IB's Threat Intelligence &amp; Attribution system, the alleged database was published on a fraudulent resource known for reselling data that has been published on various data-leak websites. Compromise of Air India's network In mid-February 2021, Group-IB's Threat Intelligence &amp; Attribution system detected infected devices that were part of Air India's computer network. Starting from at least February 23, 2021, a device inside the company's network communicated with a server with the IP address 185[.]118[.]166[.]66. The threat actor collected information inside the local network, including names of network resources and their addresses. Below are examples of commands that were used for lateral movement: . The name of the campaign, ColunmTK, is derived from these initially discovered domains. ColunmTK Timeline Connections with APT41 Group-IB researchers believe with moderate confidence that the ColunmTK campaign was carried out by APT41, a prolific Chinese-speaking nation-state threat actor. According to Group-IB's Threat Intelligence &amp; Attribution system, the threat actor has been active since at least 2007. This IP address was used as an A record for two domains: server04[.]dns04[.]com and service04[.]dns04[.]com. The IP address was also used to host the Cobalt Strike framework and shared an SSL certificate, b3038101fd0e8b11c519f739f12c7e9b60234d3b, with ColunmTK's IP address 185[.]118[.]166[.]66. The file is very similar to one used by APT41 in a different campaign described by FireEye researchers
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
Threat description: Qualys Threat Research has identified a new Lazarus campaign using employment phishing lures targeting the defence sector. The identified variants target job applicants for Lockheed Martin. This blog details the markers of this campaign, including macro content, campaign flow and phishing themes of our identified variants and older variants that have been attributed to Lazarus by other vendors
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: It then issues a SOAP request to delete the processed email. This completes the process in which the payload receives inbound communications from the actor
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: Now the virtual environment is prepared, the install.bat command goes through a list of process names and terminates these processes so any files they have open are unlocked and become accessible for encryption. This list of 50 entries consists of mainly line-of-business applications, database, remote management and backup applications and is stored in a text file. Another text file contains services names. These are tailored to the victim organization’s network environment, including process and service names belonging to endpoint protection software
MITRE ATT&CK techniques:
- T1489: Service Stop
Threat description: Prior to 2014, IRON LIBERTY used custom malware, primarily Sysmain, Havex, and xFrost (now known as Karagany), combined with commodity penetration testing and tools
MITRE ATT&CK techniques:
- T1189: Drive-by Compromise
Threat description: The Bluetooth functionality in Flamer is encoded in a module called "BeetleJuice". This module is triggered according to configuration values set by the attacker. This means that a computer compromised by W32.Flamer will appear when any other Bluetooth device scans the local area. In addition to enabling a Bluetooth beacon, Flamer encodes details about the infected computer (see Figure 1) and then stores these details in a special 'description' field. When any other device scans for Bluetooth-enabled devices, this description field will be displayed: These are the facts of how Flamer uses Bluetooth. The attacker, however, could identify the location of compromised devices using Bluetooth. The Beetlejuice module already has retrieved a list of all the devices IDs which are near to the infected computer and so the attacker knows what devices belong to the victim. Some attacks have even identified Bluetooth devices more than one mile away. With increase functionality an attacker, having identified various Bluetooth devices in range, could perform numerous attacks: - Steal contacts from an address book, steals SMS messages, steals images, and more. An attacker within one mile of the target could use their own Bluetooth-enabled device for this. If the second computer is using a secured network and was infected through a USB connection, potentially the only network available would be a Bluetooth connection back to the first compromised computer
MITRE ATT&CK techniques:
- T1011.001: Exfiltration Over Other Network Medium - Exfiltration Over Bluetooth
Threat description: To compress the data, GetFrame() invokes the Common.Compress() method, which is used to compress the data by leveraging the C# GZipStream compression class
MITRE ATT&CK techniques:
- T1560.002: Archive Collected Data - Archive via Library
Threat description: On top of this configuration change, this sample does not use the libcurl library for network exfiltration. Instead, it uses an external library. To locate it, the backdoor tries to decrypt each file in the current directory using AES-256-CBC with the key gFjMXBgyXWULmVVVzyxy padded with zeroes. Each file is “decrypted” and saved as /tmp/store and an attempt to load it as a library made using the dlopen function. When a decryption attempt results in a successful call to dlopen, the backdoor then retrieves the exported functions Boriry and ChadylonV, which seem to be responsible for the network communication with the server. As we do not have the dropper or other files from the original sample’s location, we could not analyse this library. Moreover, since the component is encrypted, a YARA rule based on these strings would not match the file found on disk
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: In their advisory published on Jan. 26, 2022, CERT-UA asserted that the initial vector for the malware, dubbed WhisperGate, was either a supply-chain attack or exploitation. The first payload in this infection is responsible for the initial attempt at wiping the systems. The malware executable wipes the master boot record (MBR) and replaces it with the code responsible for displaying the ransom note. Similar to the notorious NotPetya wiper that masqueraded as ransomware during its 2017 campaign, WhisperGate is not intended to be an actual ransom attempt, since the MBR is completely overwritten and has no recovery options. This wiper also tries to destroy the C:\ partition by overwriting it with fixed data. The additional steps taken to wipe the actual hard drive partition differentiate its behavior from other wiper malware like NotPetya. However, most modern systems today have switched to GUID Partition Table (GPT) from MBR, which allows for larger file systems and has fewer limitations, potentially limiting some of the impacts of this executable
MITRE ATT&CK techniques:
- T1542.003: Pre-OS Boot - Bootkit
Threat description: All this data is merged in one file xmlrwbin.inc, which is then encrypted with RC4. To be able to decipher the data, the attacker should certainly know either the MD5 hash or the whole buffer content. This data is also sent, but RSA encrypted. The malware constructs a 1120 bit public key, uses it to encrypt the 117-bytes buffer. The malware then concatenates all the data to be sent as a 128-bytes block. The resulting data is saved in C:Program FilesCommon FilesSystemOle DB to a file named according to the following format
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: The file reflectively injects a ransomware DLL into the memory of the legitimate running process explorer.exe
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: We also noticed that the actors reused the VBS decode function published by Motobit. Figure 4 shows the comparison between the base64 function used in the macro code and the VBS base64 decoder function published by Motobit
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: Inception is continuing to use chains of infected routers to act as proxies and mask communications between the attackers and the cloud service providers they use. Certain router manufacturers have UPnP listening on WAN as a default configuration. These routers are hijacked by Inception and configured to forward traffic from one port to another host on the internet. Abuse of this service requires no custom malware to be injected on the routers and can be used at scale very easily. Inception strings chains of these routers together to create multiple proxies to hide behind
MITRE ATT&CK techniques:
- T1090.003: Proxy - Multi-hop Proxy
Threat description: The classic Shlayer technique is clearly evident here: passing encrypted and password-protected code to openssl and then writing that out as a payload to the /tmp folder
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: While both malware families are designed to deploy Cobalt Strike Beacon, there are differences in Cobalt Strike configuration. To date, Symantec has seen four samples of Raindrop. In three cases, Cobalt Strike was configured to use HTTPS as a communication protocol. In the fourth it was configured to use SMB Named Pipe as a communication protocol
MITRE ATT&CK techniques:
- T1090.001: Proxy - Internal Proxy
Threat description: Nonetheless, the infected DLL contains just one method (named DynamicRun), that can receive a C# script from a web request, compile it on the fly, and execute it
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: There are additional keys within the Registry that can be modified to further roll back the patch and expose unsafe options in Outlook. The following setting can be used to re-enable the original home page tab and roaming home page behavior in the Outlook UI
MITRE ATT&CK techniques:
- T1137.004: Office Application Startup - Outlook Home Page
Threat description: In addition to the encrypted strings table, BitPaymer replaces the remaining strings in the binary with hashes and uses an algorithm to match these hashes with strings that exist on the host. The hashing algorithm generates a CRC32 hash of the string, converted to lowercase. This hash is combined with a DWORD using a simple XOR. This string hashing algorithm is identical to the hashing algorithm used in other Dridex modules. The hash algorithm has been replicated in Python below
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Targets are approached with spearphishing emails that contain a link to a ZIP file hosted on Google Drive. That archive contains several LNK (aka shortcut) files that extract and execute a malicious JavaScript component, while displaying a decoy document
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
- T1566.002: Phishing - Spearphishing Link
Threat description: Throughout our research, we witnessed several different infection chains being used to deliver the Aria-body backdoor. This RTF file, which was infected (weaponized) with the RoyalRoad exploit builder, drops a loader named intel.wll into the target PC’s Word startup folder. The loader in turn tries to download and execute the next stage payload from spool.jtjewifyn[.]com
MITRE ATT&CK techniques:
- T1137.006: Office Application Startup - Add-ins