Inside the Rabbit Hole: BunnyLoader 3.0 Unveiled

Posted on by Samantha Stallings

Executive Summary

This article will focus on the newly released BunnyLoader 3.0, as well as historically observed BunnyLoader infrastructure and an overview of its capabilities. BunnyLoader is dynamically developing malware with the capability to steal information, credentials and cryptocurrency, as well as deliver additional malware to its victims.

In an increasingly cutthroat market, cybercriminals must regularly update and retool their malware to compete with other cybercriminals, security tools and researchers alike. Since its initial discovery in September of 2023, BunnyLoader malware as a service (MaaS) has frequently updated its functionality to include the following:

  • Bug fixes
  • Additional antivirus evasion and protections
  • Multiple data recovery functionalities for the stealer portion
    • Additional browser paths
    • Keylogger functionality

Additional activity discovered in October 2023 by Unit 42 threat researchers revealed the threat actor continued to modify and retool BunnyLoader. The threat actor frequently changed their tactics in an effort to deliver and execute the malware in what appears to be an attempt to further obfuscate and evade detection.

Samples collected during this time included packed binaries using PureCrypter, UPX and Themida during various campaigns in November. In December, the BunnyLoader payload was delivered as a follow-up payload to a PureCrypter infection using a novel .NET injector. Threat actors changed filenames of the malware to mimic legitimate video games and other applications.

Frequent changes in tactics, techniques and procedures (TTPs) like infrastructure, packers, encryption and method of exfiltration help the attacker evade detection. It’s also meant to undermine cybersecurity researchers’ ability to detect and analyze the threat actor’s activities.

On Feb. 11, 2024, the threat actor behind BunnyLoader announced the release of BunnyLoader 3.0, boasting the malware has been “completely redesigned and enhanced by 90%.”

The threat actor claims enhancements to BunnyLoader payloads include:

  • Payloads/modules “completely rewritten for improved performance”
  • Reduced payload size
  • Advanced keylogging capabilities

By revealing the threat actor’s continued development of the malware and its evolving TTPs, we aim to empower readers to detect and hopefully prevent this threat.

Palo Alto Networks customers are better protected from BunnyLoader through Cortex XDR and XSIAM, as well as through Prisma Cloud. Customers are also better protected through our Next-Generation Firewall with Cloud-Delivered Security Services, including Advanced WildFire, DNS Security, and Advanced URL Filtering.

If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.

Related Unit 42 Topics MaaS

Behind the Ears of BunnyLoader

BunnyLoader has had a rapid development cycle. Version 1.0 was first seen at the beginning of September 2023, advertised on the dark web as a MaaS botnet and loader malware written in C/C++. It had a variety of capabilities such as the following:

  • Fileless loading
  • Credential theft
  • Cryptocurrency theft
  • Clipboard theft

The threat actor behind this malware is known as “Player” or “Player_Bunny.” The buyer determines what malware BunnyLoader delivers. The author of this malware prohibits its use against Russian systems.

Malware authors residing in or around Russian territory commonly prohibit the use of their malware against Russian targets. Threat actors likely use this restriction as a way to stay off of Russian law enforcement’s radar.

As early as Sept. 4, 2023, the threat actor “Player” initially offered BunnyLoader version 1.0 on various forums at $250 for lifetime access. An example of this advertisement is shown below in Figure 1.

Image 1 is a screenshot of a forum post on the dark web advertising BunnyLoader. The post was made Monday, September 4, 2023 by member PLAYER. The title of the post is New BunnyLoader, v1.0 Botnet! C/C++ fileless loader and stealer + much more! It introduces what it does, and discusses its different features. It also lists the features for the client. It is posted by a user named breach. The post was made on Monday, September 4, 2023.
Figure 1. Dark web post advertising BunnyLoader 1.0. Source: @DailyDarkWeb on X (Twitter).

By the end of September 2023, BunnyLoader underwent a rapid retooling. According to the BunnyLoader advertisement, new features include the following:

  • Command-and-control (C2) panel bug fixes
  • Antivirus evasion
  • Multiple data recovery methods used for information theft
  • Added browser paths
  • Keylogger functionality
  • Anti-analysis protections

The malware loader ecosystem is normally in a state of flux. During the previous month, August 2023, there was significant impact to the prolific malware family Qakbot with the joint law enforcement takedown operation.

This event likely signaled an opportunity for other MaaS loader operators to gain a market foothold. As such, the aggressive retooling and updating by the BunnyLoader author might have been to attract market interest and increase its adoption. By the end of September, the author had released BunnyLoader 2.0 and it was seen in the wild.

In October, the author offered a “private” version of the malware for $350. Unlike the original version, the author obfuscated this private version, and they made regular updates to evade antivirus protections. Threat actors were likely motivated to make these updates because security researchers discovered the malware in late September.

The threat actor advertised their most recent version, BunnyLoader 3.0, on their Telegram channel on Feb. 11, 2024.

Observed Infrastructure: From Burrows to Bytes

When security researchers initially discovered BunnyLoader 1.0 in September, it used 37.139.129[.]145 for its C2 server, as noted in Figure 2.

Image 2 is a screenshot of an X post. Hashtag Malware and BunnyLoader. Bunny login link. 142 bots. BTC wallet. Screenshot of BunnyLoader login page. Logo and Username and Password fields.
Figure 2. X (formerly known as Twitter) post by security researcher 0xperator. Source: @0xperator on X (Twitter).

In the earliest known samples of BunnyLoader, the client communicated with C2 servers using a standardized directory structure of http://[url]/Bunny/[PHP endpoint], as shown below in Figure 3. This pattern remains consistent throughout all samples leading up to the release of BunnyLoader 3.0.

Image 3 is a list of many URLs observed as part of the BunnyLoader C2 server structure.
Figure 3. URLs we have observed reflecting the directory structure on the C2 server at 37.139.129[.]145.
BunnyLoader 2.0 uses URLs ending with Add.php to initially register the BunnyLoader client with the C2 server. Prior to registration, the malware enumerates the device and uses the collected information as a fingerprint to identify distinct targets.

Once BunnyLoader establishes communication with the C2, it repeatedly sends requests using URLs ending with TaskHandler.php. Responses from these requests initialized further malicious tasks performed by BunnyLoader.

Threat authors coded these tasks into separate functions, which included the following:

  • Keylogging
  • Clipboard theft
  • Downloading additional malware
  • Remote command execution
  • Crypto wallet theft
  • Application credential theft

During October, we observed new C2 infrastructure hosted at 185.241.208[.]83. That month, we also found BunnyLoader samples delivered via a conspicuous ZIP archive named Shovel Knight.zip. Further analysis revealed the contents of Shovel Knight.zip include a Windows executable, which is the stager for BunnyLoader 2.0.

Shovel Knight is a well-known video game for which development was crowdfunded. It was then released by major video game platforms. The threat actors’ use of the names of legitimate software is undoubtedly an effort to trick users into opening and executing the malicious files.

During November, we identified subsequent campaigns using C2 servers hosted at:

  • 195.10.205[.]23
  • 172.105.124[.]34

Samples we collected in November 2023 used Themida to pack Windows executable files for BunnyLoader. In addition to Themida, we observed a cluster of PureCrypter samples in November 2023 designed to deliver BunnyLoader. These techniques indicate the operators of BunnyLoader started taking additional measures to protect their malware.

During December, we observed new C2 servers at:

  • 134.122.197[.]80
  • 91.92.254[.]31

That month’s infection chain was far more complex than seen in previous months. We observed additional changes in TTPs, where the infection chain started with a previously unseen dropper leading to PureCrypter and forking into two branches as shown in Figure 4.

Image 4 is a diagram of the December 2023 BunnyLoader infection. Delphi resource dropper containing NUIANS.exe. In-memory loader NUIANS.exe. Staged PureCrypter loader. Branch one: IP address. Purelogs loader. Purelogs stealer. Branch two: IP address. .NET injector. EXE injects BunnyLoader into EXE. BunnyLoader downloads and loads Meduza Stealer. Meduza Stealer.
Figure 4. Overview of December infection chain.

One branch from the PureCrypter infection continues to deploy additional Pure malware by dropping the PureLogs loader and then delivering the PureLogs stealer. The second branch results in PureCrypter leveraging a .NET injector to deliver BunnyLoader, which masquerades as the file notepet.exe. Notepet is a pet health tracker application for pet owners.

We also observed BunnyLoader using a misspelling of the app for the filename notep.exe. Threat actors used this file to deliver the Meduza stealer malware.

Following the December activity, the threat author advertised another massive retooling with the release of BunnyLoader 3.0 on Feb. 11, 2024, as shown in Figure 5. Senior threat intelligence researcher @RussianPanda9xx first publicly shared this announcement on X (Twitter) as shown below in Figure 6.

Image 5 is a screenshot for BunnyLoader as advertised on Telegram. February 11. Video of BunnyLoader. Video still is of the BunnyLoader login page. Download button. 105.5 MB. BunnyLoader (ADE) 3.0 Update. Webpanel/CnC. Completely redesigned and enhanced by 90%.
Figure 5. Advertisement for BunnyLoader 3.0 on Telegram.
Image 6 is a screenshot of a Twitter post by @RussianPanda. BunnyLoader announced a big 3.0 update. Maybe something to hunt for. Laugh behind hand emoji. She tagged two different people in the post. Screenshots of BunnyLoader updates that include list of upgrades to the malware.
Figure 6. X (formerly known as Twitter) post by threat intelligence researcher @RussianPanda.

The latest version of BunnyLoader, version 3.0, uses a different directory structure on its C2 servers than we saw in version 2.0. This directory structure is formatted as http://[C2]/[path]/[PHP API]. We discuss this information in more detail in the section Hopping Through the Bytes.

In BunnyLoader 3.0, the threat actor uses a dropper delivered via a CMD file with the BunnyLoader malware embedded in the dropper to deliver the actual malicious payload. Once attackers deliver BunnyLoader to the target machine, the malware reaches out to a C2 server at 91.92.247[.]212, which then responds and waits for further instruction from the threat actor.

Sample Analysis: Hopping Through the Bytes of BunnyLoader 3.0

On Feb. 14, 2024, security researcher Germán Fernández identified the first known sample of BunnyLoader 3.0 contained in a malicious .cmd script discovered by @ViriBack.

Unit 42 researchers tracking this threat analyzed the updated BunnyLoader file extracted from the .cmd script. We identified several major changes from prior versions, including updates to the C2 communication protocol and modularization of the binary.

As many aspects of BunnyLoader have not changed and are well documented in other write-ups, we focused our analysis in this article on new features. The following sections are not a comprehensive analysis but rather highlight key features found in the new version.

Command and Control Update

The base URI structure of the C2 communication remains unchanged from prior versions, using the format http://[C2]/[path]/[PHP API]. The sample of BunnyLoader mentioned previously is configured to communicate with the C2 server located at hxxp://ads[.]hostloads[.]xyz/BAGUvIxJu32I0/gate.php. While previous versions of BunnyLoader used the string Bunny in the URL path, BunnyLoader 3.0 allows the operator to specify the path name.

Prior to the release of version 3.0, BunnyLoader servers used multiple PHP API endpoints to receive communication from clients (shown in Figure 3). All samples of BunnyLoader 3.0 observed by Unit 42 use one endpoint, gate.php.

Rather than sending HTTP parameters in cleartext, as seen in previous versions, BunnyLoader 3.0 will obfuscate these values using RC4 encryption. A random 32-character key is generated each time BunnyLoader is executed, which is used to RC4 encrypt all HTTP query parameter values. The encrypted values are subsequently converted into charcode and URL encoded, as seen in Figure 7, wherein a client is making an initial connection to the C2 server.

Image 7 is a screenshot of many lines of code. The GET, User-Agent, Host and Cache-Control are highlighted in red. The rest of the information is highlighted in blue.
Figure 7. Example of HTTP headers from an initial connection to the BunnyLoader C2 server.

For the C2 server to differentiate between client requests, each client function uses a unique URI parameter format, along with a specific user agent. Table 1 below outlines all possible C2 communication routines, including their purpose and parameters used.

HTTP query parameter names and values are listed in the rightmost column, with notations in parentheses to indicate usage. Unit 42 created the ID column for reference purposes.

ID Purpose User Agent HTTP/S URI Parameters
1 Establishes initial connection to the C2 server. Windows Defender ipaddress
hostname
version (BunnyLoader version)
system (Operating System)
privileges (Local or Admin)
arch (CPU Architecture)
antivirus
disk_id (Bot ID)
key (BL Operator Key)
enc_key (RC4 Key)
2 Sends a heartbeat to the C2 every 50 seconds. Avast heart (BL Operator Key)
hostname
system (Operating System)
arch (CPU Architecture)
heart_enc_key (RC4 Key)
3 Sends a request every two seconds. The expected response is a command run via the Windows command line. ESET SECURITY hostname
system
arch
cecho (BL Operator Key)
enc_cecho (RC4 Key)
4 Response to the C2 after executing the command in the previous row. McAffe val (BL Operator Key)
hostname
system
arch
value (command output)
va_enc_key (RC4 Key)
5 Sends a request every two seconds. The expected response is a specially formatted command parsed by the client. AVG BID (Bot ID)
bid_enc_key (RC4 Key)
6 Response to the C2 after executing the command in the previous row. Google Chrome CID (Command ID)
bid (Bot ID)
enc_key (RC4 Key)
7 Sends a request every two seconds. The expected response is a specially formatted command parsed by the client. Used to download the denial-of-service (DoS) module. Avast DBID (Bot ID)
DBID_enc_key (RC4 Key)
8 Response to the C2 after executing the command in the previous row. Google Chrome DCID (Command ID)
DBID (Bot ID)
d_enc_key (RC4 Key)

Table 1. BunnyLoader C2 functions and associated communications.

The C2 address, C2 path, BunnyLoader version and operator ID are all hard-coded in the binary. This function also generates the RC4 key, as shown in Figure 8 below.

Image 8 is a screenshot of many lines of code in IDA pro.
Figure 8. BunnyLoader client configuration function as seen using IDA Pro.

Modularization of BunnyLoader Binary

The second major change in BunnyLoader 3.0 is the transition from one file to a smaller base client with features available as downloadable modules. While most of the client code is similar to previous versions, BunnyLoader’s custom stealer, clipper, keylogger and new DoS functions are now separated into distinct binaries. Operators of BunnyLoader can choose to deploy these modules or use BunnyLoader’s built-in commands to load their choice of malware.

When running on a target computer, BunnyLoader will check in with the C2 every two seconds (see row five in Table 1), awaiting a specifically formatted command. These instructions facilitate the download and execution of additional malware on the target’s computer and are formatted in the following manner:

The Task_Name and Task_Arg values are extracted from the command and passed to corresponding functions, which instruct the client how to download and execute the new payload. All HTTP download requests performed via these commands will utilize either the user agent ESET NOD32 (download is saved to disk) or curl/1.0 (fileless injection), and all downloaded files are saved to the victim’s %localappdata%\Temp folder.

The client will send a response back to the C2 containing the Command ID (CID) value extracted from the command, using the format shown in row six of Table 1.

Table 2 below summarizes all possible tasks that the C2 can send to the client.

Task Name Summary
Download & Inject (Executable) [FileLess] Downloads .exe specified by Task_Arg and injects it into notepad.exe, entirely in memory.
Download & Inject (DLL) [RTI] Downloads .dll specified by Task_Arg to the %localappdata%/Temp folder, and injects it into calc.exe. 
Download & Execute (Executable) Downloads .exe specified by Task_Arg to the %localappdata%/Temp folder and executes it using CreateProcessA.
Download & Execute (DLL) Downloads .dll specified by Task_Arg to the %localappdata%/Temp folder and executes it using rundll32.
Download & Execute (Batch) Downloads .bat or .cmd script specified by Task_Arg to the %localappdata%/Temp folder and executes it using CreateProcessA.
Download & Execute (PowerShell) Downloads .ps1 specified by Task_Arg to the %localappdata%/Temp folder and executes it using powershell -ExecutionPolicy Bypass -File.
Download & Execute (VBS) Downloads .vbs specified by Task_Arg to the %localappdata%/Temp folder and executes it using cscript.exe.
Run Stealer Downloads the BunnyLoader stealer module from a path hard-coded in the binary and injects it into notepad.exe, entirely in memory.
Run Keylogger Downloads the BunnyLoader keylogger module from a path hard-coded in the binary and injects it into notepad.exe, entirely in memory.
(Any of the following) Bitcoin, Bitcoin Cash, Monero, Ethereum, Litecoin, Dogecoin, ZCash, Tether, XRP Downloads the BunnyLoader clipper module from a path hard-coded in the binary and injects it into notepad.exe, entirely in memory.

Table 2. BunnyLoader commands.

The new DoS module download is handled in a separate thread, which will check in with the C2 every two seconds (see row seven in Table 1), awaiting a specifically formatted command. Upon receiving the appropriate command, the client will download and inject the DoS module into notepad.exe.

We noted the following URL structures used to download the BunnyLoader 3.0 modules, as shown in Table 3 below. The filenames and URL format remained constant across multiple samples.

Module URL Purpose
http://[C2]/[path]/Modules/eSentire.exe Stealer module
http://[C2]/[path]/Modules/zScaler.exe DoS module
http://[C2]/[path]/Modules/any_run.exe Clipper module
http://[C2]/[path]/Modules/NextronSystems.exe Keylogger module

Table 3. BunnyLoader 3.0 module URLs.

The following sections highlight the key functions of each BunnyLoader 3.0 module.


Keylogger Module

The BunnyLoader 3.0 keylogger records all keystrokes, saving them to log files in the %localappdata%\Temp folder. The keylogger also attempts to identify when the victim authenticates to sensitive applications or services. To do so, the keylogger uses the GetForegroundWindow and GetWindowTextA APIs to identify when the victim is interacting with targeted applications or services. It will log the respective keystrokes to separate, hard-coded files, as shown in Table 4 below.

Window Title or Application Name Log Location (Hard-Coded)
CredentialUIBroker.exe

mstsc.exe

 %localappdata%\Temp\ADE_RDP.txt
Log in to your PayPal %localappdata%\Temp\ADE_PAYPAL.txt
Nord Account %localappdata%\Temp\ADE_NORD.txt
Sign in - chase.com %localappdata%\Temp\ADE_CHASE.txt
Bank of America - Banking, Credit Cards, Loans %localappdata%\Temp\ADE_BOA.txt
Sign On to View Your Personal Accounts | Wells Fargo %localappdata%\Temp\ADE_WF.txt
Citi.com %localappdata%\Temp\ADE_CITI.txt
All other keystrokes %localappdata%\Temp\ADE_KEY.txt

Table 4. BunnyLoader keylogger log file locations.

Stealer Module

The BunnyLoader 3.0 stealer module operates autonomously, stealing credentials and exfiltrating data directly to the C2 server, using the same http://[C2]/[path]/[PHP API] format as the base client.

All information theft functions will store collected data in the %localappdata%\Temp\ADE_LOGS folder. The stealer is also responsible for uploading logs from the keylogger module, which it will search for and copy to the same folder.

Once all data has been collected, the stealer will use PowerShell to compress the ADE_LOGS folder into a .zip file. Before exfiltrating the .zip, the stealer will send a GET request to the C2 with a summary of the stolen data, with the user agent Windows Defender.

Query parameters of the HTTP GET requests are outlined in Table 5 below.

HTTP Query Parameter

Value
theft_id Bot ID
ipaddress Target IP address
system Operating system
chromium Number of browsers captured
messages Number of messaging services captured
wallets Number of crypto wallets captured
keystrokes Number of keystroke log files found
games Number of gaming platforms captured
vpns Number of VPN services captured
files Number of targeted files captured (see Appendix for targeted file extensions)
extensions Number of Chrome extensions captured
type Hard-coded value of ZIP
size Size of ZIP file
link String in the format: http://[C2]/[path]/Logs/ADE_LOGS_[hostname].zip
key_code Operator ID
enc_key RC4 Key

Table 5. BunnyLoader stealer module, parameters in the first request to C2.

If the C2 responds appropriately, the stealer module will upload the .zip file, using the user agent Uploader and a custom Content-Type HTTP header, as shown in Figure 9 below. Once the upload is complete, the stealer will delete the collected data and the .zip file.

Image 9 is a screenshot of the HTTP traffic exfiltrated by BunnyLoader. Many lines of code are highlighted in blue and red.
Figure 9. HTTP traffic of data exfiltration by BunnyLoader’s stealer module.

A full list of information targeted by the stealer module can be found in the Appendix.

Clipper Module

The BunnyLoader 3.0 clipper module periodically checks in with the C2, using the communication routine specified in rows five and six of Table 1. The C2 activates the clipper by sending the name of a cryptocurrency wallet to the target, along with a corresponding wallet address controlled by the threat actor.

The clipper uses regex patterns to identify whether the target’s clipboard contains a desired wallet address type. If it finds a match, it will replace the victim’s address with the malware operator’s address. Table 6 below shows the targeted wallets and the regex statements used to identify them.

Wallet Regex
Bitcoin_Legacy ^(bc1|[13])[a-zA-HJ-NP-Z0-9]{25,39}$
Bitcoin_Bech32 ^[13][a-km-zA-HJ-NP-Z1-9]{25,34}$
erc-20 ^T[1-9A-HJ-NP-Za-km-z]{33}$
trc-20 ^0x[0-9a-fA-F]{40}$
Bitcoin Cash ^((bitcoincash:)?(q|p)[a-z0-9]{41})
Monero ^4([0-9]|[A-B])(.){93}
Litecoin ^[LM3][a-km-zA-HJ-NP-Z1-9]{26,33}$
Dogecoin ^[DB][1-9A-HJ-NP-Za-km-z]{26,34}$
ZCash ^t1[a-zA-Z0-9]{33}$
xrp_address r[1-9A-HJ-KM-NP-Za-km-z]{25,34}

Table 6. Wallets targeted by the BunnyLoader 3.0 clipper module and their associated regex patterns.

Denial of Service Module

The BunnyLoader 3.0 DoS module waits for commands from the C2 using the communication routine specified in rows seven and eight of Table 1. The C2 can instruct the module to perform either a GET or POST HTTP flood attack against a specified URL.

To perform the attack, the module will spawn a new thread and enter an infinite loop, repeatedly sending GET or POST requests to the target server with the following user agent:

Mozilla/5.0 (compatible; U; ABrowse 0.6; Syllable) AppleWebKit/420+ (KHTML, like Gecko)

Conclusion

In the ever changing landscape of MaaS, BunnyLoader continues to evolve, demonstrating the need for threat actors to frequently retool to evade detection. Revealing these evolving tactics and the dynamic nature of this threat empowers readers to bolster their defense posture and better protect their assets.

Protections and Mitigations

Palo Alto Networks customers are better protected from the threats discussed above through the following products:

  • Advanced WildFire:
    • Advanced WildFire recognizes and blocks the samples referenced in this post as malicious.
  • Cortex XDR:
    • Cortex XDR recognizes and blocks the samples referenced in this post as malicious.
  • Next-Generation Firewalls (NGFW):
  • Prisma Cloud:
    • Compute WildFire integration allows for Prisma Cloud’s runtime compute defender agents to detect, alert on and prevent known malicious malware within cloud resources including virtual machines, serverless and containers.
    • The Web Application and API Security (WAAS) module is a Prisma Cloud Defender agent-based application that allows Prisma Cloud to detect, alert on and prevent malicious API and cloud web application HTTP requests. Deploying the WAAS module on cloud-based Web Application and API endpoints can detect and prevent the initial compromising events used by BunnyLoader 3.0.

If you think you might have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

  • North America Toll-Free: 866.486.4842 (866.4.UNIT42)
  • EMEA: +31.20.299.3130
  • APAC: +65.6983.8730
  • Japan: +81.50.1790.0200

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Indicators of Compromise

Files for BunnyLoader:

SHA256 Notes First Seen
3a64f44275b6ff41912654ae1a4af1d9c629f94b8062be441902aeff2d38af3e UPX-packed EXE Sep. 9, 2023
0f425950ceaed6578b2ad22b7baea7d5fe4fd550a97af501bca87d9eb551b825 UPX-packed EXE Sep. 9, 2023
82a3c2fd57ceab60f2944b6fea352c2aab62b79fb34e3ddc804ae2dbc2464eef Themida-packed EXE Nov. 11, 2023
2ab21d859f1c3c21a69216c176499c79591da63e1907b0d155f45bb9c6aed4eb PureCrypter EXE Nov 18, 2023
c006f2f58784671504a1f2e7df8da495759227e64f58657f23efee4f9eb58216 PureCrypter EXE Nov. 18, 2023
52b7cdf5402f77f11ffebc2988fc8cdcd727f51a2f87ce3b88a41fd0fb06a124 PureCrypter EXE Nov. 18, 2023
5f09411395c8803f2a735b71822ad15aa454f47e96fd10acc98da4862524813a PureCrypter EXE Nov. 18, 2023
cc2acf344677e4742b22725ff310492919499e357a95b609e80eaddc2b155b4b PureCrypter EXE Nov. 18, 2023
ebc17dbf5970acb38c35e08560ae7b38c7394f503f227575cd56ba1a4c87c8a4 PureCrypter EXE Nov. 18, 2023
2d39bedba2a6fb48bf56633cc6943edc6fbc86aa15a06c03776f9971a9d2c550 PureCrypter EXE Nov. 18, 2023
2e9d6fb42990126155b8e781f4ba941d54bcc346bcf85b30e3348dde75fbeca1 PureCrypter EXE Nov. 18, 2023
74c56662da67972bf4554ff9b23afc5bdab477ba8d4929e1d7dbc608bdc96994 PureCrypter EXE Nov. 18, 2023
fffdf51cdb54f707db617b29e2178bb54b67f527c866289887a7ada4d26b7563 PureCrypter EXE Nov. 18, 2023
62f041b12b8b4e0debd6e7e4556b4c6ae7066fa17e67900dcbc991dbd6a8443f PureCrypter EXE Dec. 16, 2023
1a5ad9ae7b0dcdc2edb7e93556f2c59c84f113879df380d95835fb8ea3914ed8 (BunnyLoader 3.0 Dropper) .cmd script Feb. 14, 2024
c80a63350ec791a16d84b759da72e043891b739a04c7c1709af83da00f7fdc3a (BunnyLoader 3.0) EXE payload from the above .cmd script Feb. 14, 2024

 

BunnyLoader Network Indicators:

BotID C2 IP address Seen
BotID=880873019 37.139.129[.]145 September 2023
BotID=3565265299 37.139.129[.]145 September 2023
BotID=272148461 37.139.129[.]145 September 2023
BotID=2475708340 37.139.129[.]145 September 2023
BotID=2341255921 37.139.129[.]145 September 2023
BotID=3763204704 185.241.208[.]83 October 2023
BotID=337525325 185.241.208[.]83 October 2023
BotID=2098524523 185.241.208[.]83 October 2023
BotID=774055690 185.241.208[.]83 October 2023
BotID=3408378377 195.10.205[.]23 November 2023
BotID=2219025839 195.10.205[.]23 November 2023
172.105.124[.]34 November 2023
185.241.208[.]104 November 2023
BotID=4040267350 134.122.197[.]80 December 2023
BotID=1662989558 134.122.197[.]80 December 2023
BotID=3860674539 134.122.197[.]80 December 2023

YARA Rule

Additional Resources

Appendix

This appendix contains additional information on the stealer module associated with BunnyLoader 3.0.

Stealer Module: Target Enumeration Log Format

Stealer Module: Targeted Browsers

  • \7Star\7Star\User Data\
  • \CentBrowser\User Data\
  • \Chedot\User Data\
  • \Vivaldi\User Data\
  • \Kometa\User Data\
  • \Elements Browser\User Data\
  • \Epic Privacy Browser\User Data
  • \uCozMedia\Uran\User Data\
  • \Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\
  • \CatalinaGroup\Citrio\User Data\
  • \Coowon\Coowon\User Data\
  • \liebao\User Data\
  • \QIP Surf\User Data\
  • \Orbitum\User Data\
  • \Comodo\Dragon\User Data\
  • \Amigo\User\User Data\
  • \Torch\User Data\
  • \Yandex\YandexBrowser\User Data\
  • \Comodo\User Data\
  • \360Browser\Browser\User Data\
  • \Maxthon3\User Data\
  • \K-Melon\User Data\
  • \Google\Chrome\User Data\\Sputnik\Sputnik\User Data\
  • \Nichrome\User Data\
  • \CocCoc\Browser\User Data\
  • \Uran\User Data\
  • \Chromodo\User Data\
  • \Mail.Ru\Atom\User Data\
  • \Microsoft\Edge\User Data\
  • \BraveSoftware\Brave-Browser\User Data\

Stealer Module: Targeted Cryptocurrency Wallets

  • Armory
  • Bytecoint
  • Jaxx
  • Exodus
  • Ethereum
  • Atomic
  • Coinomi
  • ZCash
  • Guarda

Stealer Module: Targeted File Extensions and File System Locations

  • .txt
  • .csv
  • .log
  • .json
  • .xml
  • .html
  • .md
  • .yaml
  • .bat
  • .ps1
  • .doc
  • .docx
  • .odt
  • .pp
  • .pptx
  • .rtf
  • .css
  • .vbs
  • .php
  • .c
  • .cpp
  • .cs
  • .PNG
  • .png
  • .jpeg
  • .jpg
  • .db
  • .sql
  • .rdp
  • .yar
  • .yara
  • (Current User Directory)
  • Documents
  • Downloads
  • Music
  • Pictures
  • Videos

Stealer Module: Targeted VPNs, Gaming and Messaging Platforms

  • ProtonVPN
  • OpenVPN
  • Tox
  • Signal
  • Element
  • ICQ
  • Skype
  • Discord
  • Minecraft
  • Ubisoft Game Launcher
  • Uplay

Stealer Module: Targeted Wallets

Extension Description
fhbohimaelbohpjbbldcngcnapndodjp \Chrome Binance
fihkakfobkmkjojpchpfgcmhfjnmnfpi \Chrome Bitapp
aeachknmefphepccionboohckonoeemg \Chrome Coin98
blnieiiffboillknjnepogjhkgnoapac \Chrome Equal
nanjmdknhkinifnkgdcggcfnhdaammmj \Chrome Guild
flpiciilemghbmfalicajoolhkkenfel \Chrome Iconex
afbcbjpbpfadlkmhmclhkeeodmamcflc \Chrome Math
fcckkdbjnoikooededlapcalpionmalo \Chrome Mobox
bfnaelmomeimhlpmgjnjophhpkkoljpa \Chrome Phantom
ibnejdfjmmkpcnlpebklmnkoeoihofec \Chrome Tron
bocpokimicclpaiekenaeelehdjllofo \Chrome XinPay
nphplpgoakhhjchkkhmiggakijnkhfnd \Chrome Ton
nkbihfbeogaeaoehlefnkodbefgpgknn \Chrome Metamask
fhmfendgdocmcbmfikdcogofphimnkno \Chrome Sollet
pocmplpaccanhmnllbbkpgfliimjljgo \Chrome Slope
mfhbebgoclkghebffdldpobeajmbecfk \Chrome Starcoin
cmndjbecilbocjfkibfbifhngkdmjgog \Chrome Swash
cjmkndjhnagcfbpiemnkdpomccnjblmj \Chrome Finnie
dmkamcknogkgcdfhhbddcghachkejeap \Chrome Keplr
pnlfjmlcjdjgkddecgincndfgegkecke \Chrome Cocobit
fhilaheimglignddkjgofkcbgekhenbh \Chrome Oxygen
jbdaocneiiinmjbjlgalhcelgbejmnid \Chrome Nifty
kpfopkelmapcoipemfendmdcghnegimn \Chrome Liquality
klfhbdnlcfcaccoakhceodhldjojboga \Edge Auvitas
dfeccadlilpndjjohbjdblepmjeahlmm \Edge Math
ejbalbakoplchlghecdalmeeeajnimhm \Edge Metamask
oooiblbdpdlecigodndinbpfopomaegl \Edge MTV
aanjhgiamnacdfnlfnmgehjikagdbafd \Edge Rabet
bblmcdckkhkhfhhpfcchlpalebmonecp \Edge Ronin
akoiaibnepcedcplijmiamnaigbepmcb \Edge Yoroi
fbekallmnjoeggkefjkbebpineneilec \Edge Zilpay
ajkhoeiiokighlmdnlakpjfoobnjinie \Edge Terra Station
dmdimapfghaakeibppbfeokhgoikeoci \Edge Jaxx

Stealer Module: Credit Cards

  • BCGLobal
  • Carte Blanche
  • Diners Club
  • Discover
  • Insta Payment
  • Korean Local
  • Laser
  • Maestro
  • Mastercard
  • Switch
  • Union Pay
  • Visa Master

Stealer Module: Miscellaneous Targets

  • \AppData\Local\ngrok\ngrok.yml
  • \AppData\Local\ngrok

Updated March 15, 2024, at 3:15 p.m. PT to change Nanocore to PureCrypter in the Executive Summary. 

Updated April 4, 2024, at 9:o5 a.m. to adjust the YARA rule. 

Wireshark Tutorial: Exporting Objects From a Pcap

Posted on by Brad Duncan

Executive Summary

When reviewing a packet capture (pcap) of suspicious activity, security professionals may need to export objects from the pcap for a closer examination. This tutorial offers tips on how to export malware and other types of objects from a pcap.

This is the fourth article in a series of tutorials to help analysts better utilize Wireshark. This article was first published in July 2019 and has been updated for 2024.

Palo Alto Networks customers are better protected from the malware samples in this tutorial through Cortex XDR and XSIAM. Customers are also protected through our Next-Generation Firewall with Cloud-Delivered Security Services, including Advanced WildFire, DNS Security, Advanced Threat Prevention and Advanced URL Filtering.

If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.

Related Unit 42 Topics pcap, Wireshark, Wireshark Tutorial

Requirements and Supporting Material

In order to use Wireshark, readers must have a basic knowledge of network traffic to comprehend information revealed in a pcap file. Before reviewing this article, readers should also understand the material covered from our previous tutorials on customizing Wireshark’s column display, using display filter expressions and identifying hosts and users.

Requirements also include a relatively up-to-date version of Wireshark, at least version 3.6.2 or later. This article features Wireshark version 4.2.2 with a customized column used in our previous tutorials. We strongly recommend using the most recent version of Wireshark available for your operating system (OS).

Some of the pcaps in this tutorial contain malware or malicious code targeting Microsoft Windows. Because of this, we recommend using Wireshark in a non-Windows environment to review the pcaps for this tutorial. Operating systems like BSD, Linux or macOS provide an ideal environment for Wireshark when reviewing malicious traffic targeting Windows.

The pcaps used in this tutorial are contained in a password-protected ZIP archive located at our GitHub repository. Download the file named Wireshark-tutorial-extracting-objects-5-pcaps.zip. Use infected as the password and extract the five pcaps, as shown below in Figure 1.

Image 1 is a screenshot of how to download the packet captures for this tutorial. From the Palo Alto Networks Unit 42 Wireshark Tutorials GitHub, the user presses “download raw file.” A black arrow points to the downloads folder. A second black arrow points to the password required pop-up. A final black arrow points to the open zip file that contains the pcap files.
Figure 1. Acquiring the pcaps for this tutorial.

The five extracted pcaps are:

  • Wireshark-tutorial-extracting-objects-from-a-pcap-1-of-5.pcap
  • Wireshark-tutorial-extracting-objects-from-a-pcap-2-of-5.pcap
  • Wireshark-tutorial-extracting-objects-from-a-pcap-3-of-5.pcap
  • Wireshark-tutorial-extracting-objects-from-a-pcap-4-of-5.pcap
  • Wireshark-tutorial-extracting-objects-from-a-pcap-5-of-5.pcap

As a network packet analyzer, Wireshark combines data from multiple IP packets and the associated TCP frames to reveal the content of a pcap. We can extract some of these objects revealed by Wireshark. Our next section discusses how to export files from HTTP traffic.

Exporting Files From HTTP Traffic

Some Windows-based infections involve malware binaries or malicious code sent over unencrypted HTTP traffic. We can extract these objects from the pcap. An example of this is found in our first pcap named Wireshark-tutorial-extracting-objects-from-a-pcap-1-of-5.pcap. Open this pcap in Wireshark and filter on http.request as shown below in Figure 2.

Image 2 is a screenshot of Wireshark with the filter set to http.request.
Figure 2. Filtering on http.request for our first pcap in Wireshark.

After filtering on http.request, find the two GET requests to smart-fax[.]com. The first request ends with .doc, indicating the first request may have returned a Microsoft Word document. The second request ends with .exe, indicating the second request may have returned a Windows executable file. The HTTP GET requests are listed below.

  • smart-fax[.]com - GET /Documents/Invoice&MSO-Request.doc
  • smart-fax[.]com - GET /knr.exe

We can export these objects from the HTTP object list by using the menu path:

  • File → Export Objects → HTTP...

Figure 3 shows this menu path in Wireshark.

Image 3 is a screenshot of open File menu in Wireshark. The Export Objects submenu is selected and from that menu an arrow selects HTTP.
Figure 3. Menu path to export HTTP objects in Wireshark.

This menu path results in a window titled “Wireshark Export HTTP object list” as shown in Figures 4 and 5. Select the first line with Invoice&MSO-Request.doc as the filename and save it as shown in Figure 4. Select the second line with knr.exe as the filename and save it as shown in Figure 5.

Image 4 is a screenshot of the Wireshark - Export - HTTP object list. The second row is selected and a black arrow points to the save button.
Figure 4. Saving the suspected Word document from the HTTP object list.
Image 5 is a screenshot of the Wireshark - Export - HTTP object list. The third row is selected and a black arrow points to the save button.
Figure 5. Saving the suspected Windows executable file from the HTTP object list.

Of note, the Content Type column from the HTTP object list shows what the server identified the file as in its HTTP response headers. In some cases, a server hosting malware will intentionally label Windows executables as a different type of file in an effort to avoid detection. Fortunately, the first pcap in this tutorial is a very straight-forward example.

After extracting these files from the pcap, we should confirm the file types. In a MacBook or Linux environment, we can use a terminal window or command line interface (CLI) for the following commands:

  • file [filename]
  • shasum -a 256 [filename]

The file command identifies the type of file. The shasum command returns the file hash, in this case a SHA256 file hash. Figure 6 shows using these commands in a CLI on an Xubuntu-based Linux host.

Image 6 is a screenshot of the Linux terminal window. The terminal lists the file type and hash of the two objects exported from the pcap.
Figure 6. Determining the file type and hash of our two objects exported from the pcap.

The commands and their results from Figure 6 are listed below.

The information above confirms our suspected Word document is in fact a Microsoft Word document. It also confirms the suspected Windows executable file is indeed a Windows executable. We can check the SHA256 hashes against VirusTotal to see if these files are detected as malware. We can also do an internet search on the SHA256 hashes to possibly find additional information.

In addition to these Windows executables or other malware files, we can also extract webpages from unencrypted HTTP traffic.

Use Wireshark to open our second pcap for this tutorial, Wireshark-tutorial-extracting-objects-from-a-pcap-2-of-5.pcap. This pcap contains traffic of someone entering login credentials on a fake PayPal login page.

When reviewing network traffic from a phishing site, we might want to know what the phishing webpage actually looks like. We can extract the HTML pages, images and other web content using the Export HTTP object menu as shown in Figure 7. In this case, we can extract and view just the initial HTML page. After extracting that initial HTML page, viewing it in a web browser should reveal the page shown below in Figure 8.

Image 7 is a screenshot of the Wireshark file menu. Export objects is selected, and from the submenu HTTP is selected. A black arrow points to the Wireshark – Export – HTTP object list in the new popup window. The first row is selected and an arrow points to the save button.
Figure 7. Exporting the fake PayPal login page from our second pcap.
Image 8 is a screenshot of a fake PayPal login page. PayPal logo. Email and password fields. Login button. Having trouble logging in? Sign up button.
Figure 8. The exported fake PayPal login page viewed in a web browser.

Use this method with caution. If you extract malicious HTML code from a pcap and view it in a web browser, the HTML might call out to malicious domains, which is why we recommend doing this in an isolated test environment.

Exporting Files from SMB Traffic

Some malware uses Microsoft's Server Message Block (SMB) protocol to spread across an Active Directory (AD)-based network. A banking Trojan known as Trickbot added a worm module as early as July 2017 that uses an exploit based on EternalBlue to spread across a network over SMB. Trickbot is no longer an active malware family, but this section contains a June 2019 Trickbot infection that is ideal for this tutorial.

Use Wireshark to open our third pcap for this tutorial, Wireshark-tutorial-extracting-objects-from-a-pcap-3-of-5.pcap. This pcap contains a Trickbot infection from June 2019 where malware is sent over SMB traffic from an infected client to the domain controller.

This pcap takes place in the following AD environment:

  • Domain: cliffstone[.]net
  • Network segment: 10.6.26[.]0 through 10.6.26[.]255 (10.6.26[.]0/24)
  • Domain controller IP: 10.6.26[.]6
  • Domain controller hostname: CLIFFSTONE-DC
  • Segment gateway: 10.6.26[.]1
  • Broadcast address: 10.6.26[.]255
  • Windows client: QUINN-OFFICE-PC at 10.6.26[.]110

In this pcap, a Trickbot infection uses SMB to spread from an infected client at 10.6.26[.]110 to its domain controller at 10.6.26[.]6. To see the associated malware, use the following menu path shown below in Figure 9:

  • File → Export Objects → SMB...
Image 9 is a screenshot of the file menu in Wireshark. Export objects is selected. SMB is selected from the submenu.
Figure 9. Menu path to export SMB objects from the pcap.

This brings up an Export SMB object list, listing the SMB objects we can export from the pcap as shown below in Figure 10.

Image 10 is a screenshot of the Wireshark - Export - SMB object list. The columns include packet, hostname, content type, size, filename.
Figure 10. Wireshark's window for the export SMB object list.

Two entries near the middle of the list have \\10.6.26[.]6\C$ as the hostname. A closer examination of their respective filename fields indicates these are two Windows executable files. See Table 1 below for details.

Packet Number                 Hostname Content Type Size Filename
7058 \\10.6.26[.]6\C$ FILE (712704/712704) W [100.0%] 712 kB \WINDOWS\d0p2nc6ka3f_fixhohlycj4ovqfcy_smchzo_ub83urjpphrwahjwhv_o5c0fvf6.exe
7936 \\10.6.26[.]6\C$ FILE (115712/115712) W [100.0%] 115 kB \WINDOWS\oiku9bu68cxqenfmcsos2aek6t07_guuisgxhllixv8dx2eemqddnhyh46l8n_di.exe

Table 1. Data from the Export SMB objects list on our two Windows executable files.

In the Content Type column, we need [100.00%] to export a correct copy of these files. Any number less than 100 percent indicates there was some data loss in the network traffic, resulting in a corrupt or incomplete copy of the file. These Trickbot-related files from the pcap have SHA256 file hashes as shown in Table 2.

SHA256 hash             File size
59896ae5f3edcb999243c7bfdc0b17eb7fe28f3a66259d797386ea470c010040 712 kB
cf99990bee6c378cbf56239b3cc88276eec348d82740f84e9d5c343751f82560 115 kB

Table 2. SHA256 file hashes for the Windows executable files from SMB traffic in our third pcap.

Exporting Emails from SMTP Traffic

Certain types of malware are designed to turn an infected Windows host into a spambot. These spambot hosts send hundreds of spam messages or malicious emails every minute. If any of these messages are sent using unencrypted SMTP, we can export these messages from a pcap of the traffic.

One such example is from our next pcap, Wireshark-tutorial-extracting-objects-from-a-pcap-4-of-5.pcap. In this pcap, an infected Windows client sends sextortion spam. This pcap contains five seconds of spambot traffic from a single infected Windows host.

Open the pcap in Wireshark and filter on smtp.data.fragment as shown below in Figure 11. This should reveal 50 examples of subject lines in the Info column on our Wireshark column display.

Image 11 is a screenshot of Wireshark with the filter set to smtp.data.fragment.
Figure 11. Filtering for email senders and subject lines in unencrypted SMTP traffic from our fourth pcap.

We can export these messages using the following menu path as shown in Figure 12:

  • File → Export Objects → IMF...

IMF stands for Internet Message Format, which is saved as a name with an .eml file extension.

Image 12 is a screenshot of the file menu in Wireshark. Export objects is selected. IMF is selected from the submenu.
Figure 12. Menu path to export emails from a pcap in Wireshark.

The sextortion spam messages are all listed with an .eml file extension in the IMF object list as shown in Figure 13.

Image 13 is a screenshot of the Wireshark - Export - IMF object list. The columns include packet, hostname, content type, size, filename.
Figure 13. List of exportable email files in the IMF object list.

The exported .eml files can be reviewed with a text editor or an email client like Thunderbird as shown in Figure 14.

Image 14 is a screenshot of an email in Mozilla Thunderbird. The date of the email is from June 1, 2019. The email subject is hurry up and pay! Ganjaman. The email says that the computer is infected with a remote administration tool, and that the bad actor will send all private data to all contacts unless they are paid 1600 in bitcoin. There are instructions for how to pay in bitcoin as well as a wallet number.
Figure 14. Using Thunderbird to view an email exported from the pcap.

Exporting Files from FTP Traffic

Some malware families use FTP during malware infections. Our next pcap contains malware executables retrieved from an FTP server. It also contains stolen information sent from the infected Windows host back to the same FTP server.

Our final pcap for this tutorial is Wireshark-tutorial-extracting-objects-from-a-pcap-5-of-5.pcap. Open the pcap in Wireshark and use the following filter:

  • ftp.request.command or (ftp-data and tcp.seq eq 1)

The results are shown below in Figure 15. We should see USER for the username and PASS for the password. This is followed by RETR statements, which are requests to retrieve files. The filtered results show RETR statements for the following files:

  • RETR q.exe
  • RETR w.exe
  • RETR e.exe
  • RETR r.exe
  • RETR t.exe
Image 15 is a screenshot of Wireshark with the filter set to track FTP activity.
Figure 15. Filtering for FTP activity in our fifth pcap using Wireshark.

In Figure 15, this Wireshark filter also shows the start of files sent over the FTP data channel. After the RETR statements for the .exe files, our column display should reveal STOR statements representing store requests to send HTML-based log files back to the same FTP server approximately every 18 seconds.

In Wireshark version 4.0.0 or newer, we can export files from the FTP data channel using the following menu path as shown in Figure 16:

  • File → Export Objects → FTP-DATA...
Image 16 is a screenshot of the file menu in Wireshark. Export objects is selected. FTP-DATA is selected from the submenu.
Figure 16. Menu path to export FTP objects from our fifth pcap in Wireshark

This brings up a Window listing the FTP data objects we can export as shown below in Figure 17. This lists all of the HTML files sent to the FTP server containing information stolen from the infected Windows host.

Image 17 is a screenshot of the Wireshark - Export - FTP-DATA object list. The columns include packet, hostname, content type, size, filename.
Figure 17. FTP-DATA object list.

We can view the exported files in a text editor or a browser as shown below in Figure 18. These files contain login credentials from the infected host’s email client and web browser.

Image 18 is a screenshot of two overlapping windows. The window in the back is an HTML file with a list of information. The forward window is an HTML file in Mousepad.
Figure 18. Exported .html files viewed in a text editor or web browser.

While this export FTP-DATA function works for the .html files, it did not present us with any of the .exe files retrieved from the FTP server. We must export these using another method.

This method involves finding the start of FTP data streams for each of the .exe files returned from the FTP server. To find these TCP frames, use the following Wireshark filter:

  • ftp-data.command contains ".exe" and tcp.seq eq 1

The results are shown below in Figure 19, revealing an FTP data stream for each of the .exe files.

Image 19 is a screenshot of Wireshark with the filter set to ftp-data.command contains “.exe” and tcp.seq eq 1.
Figure 19. Finding the start of FTP data streams for .exe files returned from the FTP server.

We can follow the TCP stream for each of the frames shown in the Wireshark column display in Figure 19, and we can export these files from the TCP stream window. First, follow the TCP stream for the first result that shows (SIZE q.exe) in the Info column as shown below in Figure 20.

Image 20 is a screenshot of the Follow > TCP Stream option selected after clicking a row in the traffic. The popup window shows the TCP stream itself.
Figure 20. Following the TCP stream for our first FTP data result.

The TCP stream window shows hints that this is a Windows executable or DLL file. The first two bytes are the ASCII characters MZ. The TCP stream also reveals the string This program cannot be run in DOS mode.

But to confirm this is a Windows executable or DLL file, we must export it from the TCP stream. To do this, select “Raw” in the "Show data as" menu. See Figure 21 for how to do this.

 

Image 21 is a screenshot of two TCP stream windows side by side. In the left window, a black arrow points to Show data as field with ASCII selected. A black arrow points to the right TCP stream window where “Raw” is selected from the same menu.
Figure 21. Showing information in Wireshark’s TCP stream windows as raw data.

The TCP stream now shows the information in hexadecimal text, and we can export this raw data as a file using the "Save as..." button as shown below in Figure 22. This is an FTP data stream for a file named q.exe, and we have to manually type that when saving the file.

Image 22 is a screenshot of the TCP stream window in Wireshark. The end user is saving the file from the Save as… button and selecting q.exe as the file option.
Figure 22. Saving the raw data from a TCP stream window as a file.

When saving the file as q.exe in a Linux or similar CLI environment, we can confirm this is a Windows executable file and get the SHA256 hash using the commands shown below.

This SHA256 hash shows a high detection rate as malware on VirusTotal. Follow the same process to export the other .exe files in the pcap.

This should give you the following files as shown below in Table 3.

SHA256 hash             Filename
ca34b0926cdc3242bbfad1c4a0b42cc2750d90db9a272d92cfb6cb7034d2a3bd q.exe
08eb941447078ef2c6ad8d91bb2f52256c09657ecd3d5344023edccf7291e9fc w.exe
32e1b3732cd779af1bf7730d0ec8a7a87a084319f6a0870dc7362a15ddbd3199 e.exe
4ebd58007ee933a0a8348aee2922904a7110b7fb6a316b1c7fb2c6677e613884 r.exe
10ce4b79180a2ddd924fdc95951d968191af2ee3b7dfc96dd6a5714dbeae613a t.exe

Table 3. Executable files from the FTP data traffic in the pcap.

These five .exe files are all Windows executables, and they all have a high detection rate as malware on VirusTotal.

Conclusion

Wireshark does an excellent job of combining data from multiple IP packets and the associated TCP frames to show objects sent over unencrypted network traffic. Using the methods outlined in this tutorial, we can also use Wireshark to extract these objects from a pcap. This can be extremely helpful if you need to examine items during an investigation of suspicious activity.

Our next tutorial in this series reviews how to decrypt HTTPS traffic in a pcap.

Palo Alto Networks customers are better protected from the malware samples in this tutorial through Cortex XDR and XSIAM. Customers are also protected through our Next-Generation Firewall with Cloud-Delivered Security Services, including Advanced WildFire, DNS Security, Advanced Threat Prevention and Advanced URL Filtering.

If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team or call:

  • North America Toll-Free: 866.486.4842 (866.4.UNIT42)
  • EMEA: +31.20.299.3130
  • APAC: +65.6983.8730
  • Japan: +81.50.1790.0200

Indicators of Compromise

URLs that hosted malware mentioned in the tutorial:

  • hxxp://smart-fax[.]com/Documents/Invoice&MSO-Request.doc
  • hxxp://smart-fax[.]com/knr.exe

SHA256 hashes for malware mentioned in this tutorial:

  • 08eb941447078ef2c6ad8d91bb2f52256c09657ecd3d5344023edccf7291e9fc
  • 10ce4b79180a2ddd924fdc95951d968191af2ee3b7dfc96dd6a5714dbeae613a
  • 32e1b3732cd779af1bf7730d0ec8a7a87a084319f6a0870dc7362a15ddbd3199
  • 4ebd58007ee933a0a8348aee2922904a7110b7fb6a316b1c7fb2c6677e613884
  • 59896ae5f3edcb999243c7bfdc0b17eb7fe28f3a66259d797386ea470c010040
  • 749e161661290e8a2d190b1a66469744127bc25bf46e5d0c6f2e835f4b92db18
  • cf99990bee6c378cbf56239b3cc88276eec348d82740f84e9d5c343751f82560
  • ca34b0926cdc3242bbfad1c4a0b42cc2750d90db9a272d92cfb6cb7034d2a3bd
  • f808229aa516ba134889f81cd699b8d246d46d796b55e13bee87435889a054fb

Additional Resources

The Art of Domain Deception: Bifrost's New Tactic to Deceive Users

Posted on by Samantha Stallings

Executive Summary

We recently found a new Linux variant of Bifrost (aka Bifrose), showcasing an innovative technique to evade detection. It uses a deceptive domain, download.vmfare[.]com, which mimics the legitimate VMware domain. This latest version of Bifrost aims to bypass security measures and compromise targeted systems.

First identified in 2004, Bifrost is a remote access Trojan (RAT) that allows an attacker to gather sensitive information, like hostname and IP address. In this article, along with exploring Bifrost, we’ll also showcase a notable spike in Bifrost’s Linux variants during the past few months. This spike raises concerns among security experts and organizations.

Palo Alto Networks customers are better protected from the threats discussed in this article through our Next-Generation Firewall with Cloud-Delivered Security Services, including Advanced WildFire. Advanced URL Filtering and DNS Security. Cortex XDR can help detect and prevent Bifrost and related malicious behavior. If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.

Related Unit 42 Topics Remote Access Trojans, Linux

Introduction

Attackers typically distribute Bifrost through email attachments or malicious websites. Once installed on a victim's computer, Bifrost allows the attacker to gather sensitive information, like the victim’s hostname and IP address.

The latest version of Bifrost reaches out to a command and control (C2) domain with a deceptive name, download.vmfare[.]com, which appears similar to a legitimate VMware domain. This is a practice known as typosquatting. By leveraging this deceptive domain, the threat actors behind Bifrost aim to bypass security measures, evade detection, and ultimately compromise targeted systems.

As of late February, the deceptive domain has so far been undetected on VirusTotal as shown below in Figure 1.

Image 1 is a screenshot of the VirusTotal score for a deceptive domain. The information includes the community score, which is zero, detection, details, relations, and community. The creation date at the time of the show was 10 months ago, and the last analysis date at the time of the screenshot was three months ago.
Figure 1. VirusTotal score for download.vmfare[.]com.

Malware Overview: Bifrost

We found the latest sample of Bifrost (SHA256 hash: 8e85cb6f2215999dc6823ea3982ff4376c2cbea53286e95ed00250a4a2fe4729) hosted on a server at 45.91.82[.]127.

The sample binary is compiled for x86 and seems stripped. A stripped binary is one from which debugging information and symbol tables have been removed. Attackers usually use this technique to hinder analysis.

Figure 2 shows the sample’s file type using the file command from a terminal window in a Linux environment.

Image 2 as a screenshot of the Linux terminal. The code and the terminal is a stripped binary. This is stated in the fourth line.
Figure 2. Stripped binary.

To better understand how this latest version of Bifrost functions, we viewed the recent sample in a disassembler. The malware first creates a socket via a setSocket function to establish communications, then it collects the user data and sends it to the attacker’s server. The disassembled code illustrating this is shown below in Figure 3.

Image 3 is a screenshot of the code flow and a disassembler. Highlighted in red on the top left is SetSocket. Highlighted in red on the bottom right is DataCollection and SendDatatoC2.
Figure 3. Code flow of the malware seen in a disassembler.

A snippet of code for the setSocket function is shown below in Figure 4, where the code pushes three values onto the stack and later calls sys_socket(0x8063A80):

  • push 2: This corresponds to the socket domain, which is AF_INET (IPv4 Internet Protocols).
  • push 1: This corresponds to the socket type, which is SOCK_STREAM (TCP).
  • push 6: This corresponds to the socket protocol, which is IPPROTO_TCP (TCP).
Image 4 is a screenshot of the disassembler view of code for stock creation in the sample. Some information is highlighted in yellow. The socket creation is highlighted in a red box.
Figure 4. Disassembler view of code for socket creation in the Bifrost sample.

After socket creation, the malware collects user data as shown below in Figure 5, to send it over to the attacker's server.

Image 5 is a screenshot of the Bifrost code that collects the victim data. Highlighted in a red box is the hostname and reconnaissance. In a second red box at the bottom of the screenshot is the code that collects the PID.
Figure 5. Disassembled code showing how Bifrost collects victim data.

This recent sample uses RC4 encryption to encrypt collected victim data as shown below in Figure 6. Compared to previous Bifrost samples, we find small changes, like bitwise AND operations in the encryption process, depending on the particular instance being studied.

Image 6 is a screenshot of disassembled Bifrost sample code. One line is highlighted in gray.
Figure 6. Disassembled code from the most recent Bifrost sample, indicating potentially modified RC4 encryption.

Subsequently, the malware tries to make contact with a Taiwan-based public DNS resolver with the IP address 168.95.1[.]1 shown below in Figure 7.

Image 7 is two stacked screenshots. The top screen screenshot is the deep, bugger output. Highlighted in a red box is the public DNS resolver. In the bottom screenshot, which is the disassembled code, a Redbox highlights, the DNS server code.
Figure 7. Debugger output and disassembled code revealing the malware contacting a public DNS resolver at 168.95.1[.]1.

As evidenced by the logs in Figure 8, the malware initiates a DNS query to resolve the domain download.vmfare[.]com by employing the public DNS resolver at 168.95[.]1.1. This step is crucial in ensuring that the malware can successfully connect to its intended destination.

Image 8 is a screenshot of many lines of code. A red box highlights the malware that initiates a DNS query.
Figure 8. Malware initiating a DNS query to resolve the domain download.vmfare[.]com.

The malware often adopts such deceptive domain names as C2 instead of IP addresses to evade detection and make it more difficult for researchers to trace the source of the malicious activity.

Expanding Attack Surface

Upon checking, we found that the malicious IP address at 45.91.82[.]127 hosts an ARM version of Bifrost as well. The presence of this version indicates that the attacker is trying to expand their attack surface.

The ARM version functions the same as the x86 version we’ve analyzed in this article. By providing an ARM version of the malware, attackers can expand their grasp, compromising devices that may not be compatible with x86-based malware. As ARM-based devices become more common, cybercriminals will likely change their tactics to include ARM-based malware, making their attacks stronger and able to reach more targets.

Capturing Bifrost

Palo Alto Networks Advanced WildFire detected a recent spike in Bifrost activity. For the last few months, WildFire detected more than 100 instances (hashes) of Bifrost samples, as illustrated below in Figure 9.

Image 9 is a bar graph of by Frost sample detections from October 2023 through January 2024. There is a marked increase in November 2023.
Figure 9. Advanced WildFire report of Bifrost sample detections from October through January 2024.

Conclusion

The Bifrost RAT remains a significant and evolving threat to individuals and organizations alike. With new variants that employ deceptive domain strategies like typosquatting, a recent spike in Bifrost activity highlights the dangerous nature of this malware.

Tracking and counteracting malware like Bifrost is crucial to safeguarding sensitive data and preserving the integrity of computer systems. This also helps minimize the likelihood of unauthorized access and subsequent harm.

Palo Alto Networks customers are better protected from the threats discussed in this article through our Next-Generation Firewall with Cloud-Delivered Security Services, including Advanced WildFire, Advanced URL Filtering and DNS Security. Cortex XDR can help detect and prevent Bifrost and related malicious behavior.

If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team or call:

  • North America Toll-Free: 866.486.4842 (866.4.UNIT42)
  • EMEA: +31.20.299.3130
  • APAC: +65.6983.8730
  • Japan: +81.50.1790.0200

Palo Alto Networks has shared our findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Acknowledgments

We would like to thank Bradley Duncan for his valuable input and suggestions that helped shape up this article.

Indicators of Compromise

Malware Samples

SHA256 Hash Architecture
8e85cb6f2215999dc6823ea3982ff4376c2cbea53286e95ed00250a4a2fe4729 x86
2aeb70f72e87a1957e3bc478e1982fe608429cad4580737abe58f6d78a626c05 ARM

Domain and IP Addresses

  • download.vmfare[.]com
  • 45.91.82[.]127

Additional Resources

Updated March 21, 2024, at 9:05 a.m. PT to add DNS Security. 

Navigating the Cloud: Exploring Lateral Movement Techniques

Posted on by Samantha Stallings

Executive Summary


In this post, we examine lateral movement techniques, showcasing some that we have observed in the wild within cloud environments. Lateral movement can be achieved by leveraging both cloud APIs and access to compute instances, with access at the cloud level potentially extending to the latter.

We explore cloud lateral movement techniques in all three major cloud providers: Amazon Web Services (AWS), Google Cloud Platform (GCP) and Microsoft Azure, highlighting their differences compared to similar techniques in on-premises environments.

Attackers often use different lateral movement techniques to gain access to sensitive data within an organization's network. Lateral movement techniques can certainly be part of attackers’ approach to on-premises environments, and many of the scenarios we discuss could have similarities to situations on-premises. Here, we focus on lateral movement techniques as we specifically observe them used in cloud environments, with the aim of helping defenders better prepare to improve their cloud security posture.

In cloud environments, attackers operate at two levels: the host or instance, and the cloud infrastructure. This approach allows them to seamlessly combine traditional lateral movement techniques with cloud-specific methods.

Cloud providers offer measures like network segmentation and granular IAM management to limit lateral movement, along with centralized logging to detect this movement. However, cloud APIs do still provide additional mechanisms that attackers could abuse, and misconfigurations can open up further opportunities for malicious behavior.

This article will show how both agent and agentless solutions come together to protect against lateral movement, with each contributing unique strengths. This can help defenders understand why combining both solutions ensures comprehensive coverage in the cloud.

Cortex XDR and Prisma Cloud provide protection from the lateral movement techniques discussed here. If you think you might have been impacted or have an urgent matter, get in touch with the Unit 42 Incident Response team.

Related Unit 42 Topics Cloud Cybersecurity Research

Introduction

Exploring lateral movement in the cloud versus on-premises reveals a marked difference. Each environment has its challenges for defenders. In cloud environments, overly permissive access policies and misconfigured resources can expand opportunities for threat actors to abuse cloud features.

These opportunities introduce a different set of lateral movement techniques. When combined with powerful API access within the cloud, this could potentially result in gaining access to compute instances running within the environment.

In cloud services, APIs play a pivotal role in communication, as well as in facilitating lateral movement. When attackers are equipped with the right cloud permissions, which are typically write access, they can directly interact with cloud services by executing API calls. In such cases, the barrier between access within the cloud and access to compute instances may not be particularly strong, which enables attackers to create or modify cloud resources, effectively streamlining lateral movement.

The scalability of cloud environments – allowing on-demand resource provisioning – simplifies this process, as attackers can effortlessly create new compute instances to expand their operations and take control over existing ones.

Cloud Lateral Movement Techniques

Technique 1: Snapshot Creation

AWS: Elastic Block Store (EBS)

In one case, an attacker gained access to a cloud environment and attempted to pivot between Amazon Elastic Compute Cloud (EC2) instances. The attacker first attempted to access an EC2 instance using traditional lateral movement techniques, such as exploiting default open ports and abusing existing SSH keys.

When these methods proved unsuccessful, the attacker then shifted to use cloud-specific lateral movement techniques. Because the attacker was equipped with relatively powerful IAM credentials, they were able to take another approach to gain access to data within the instance.

This approach would not give access to the runtime environment present on the target instance (including data in memory and data available in the instance's cloud metadata service, such as IAM credentials). However, it would allow access to the data stored on the disk of the target instance.

The attacker first created a new EC2 instance with its own set of SSH keys. Then the attacker created an EBS snapshot of their target EC2 instance using the CreateSnapshot API. Then they mounted it to the EC2 instance under their control as shown in Figure 1.

Image 1 is a screenshot of the commands used to create a snapshot in AWS.
Figure 1. Commands used for technique 1.

In cloud environments, as a partial substitute for accessing a host that couldn't be accessed interactively, the data stored in the host's virtual block device was accessible. This was achieved using relatively powerful privileges of the compromised IAM credentials and the cloud provider's APIs.

Subsequently, with the EBS snapshot mounted on the attacker’s EC2 instance, the attacker successfully gained access to data stored on the target EC2 instance’s disk. Figure 2 illustrates this chain of events.

Image 2 is a tree diagram of the RBS snapshot mounted to an attacker-controlled instance. From the credentials two branches indicate CreateSnapshot and RunInstances are used. The top server hits the bottom with CreateVolume and AttachVolume. This hits the disk data.
Figure 2. Mounting an EBS snapshot to an instance controlled by an attacker.

This technique is not limited to AWS and it is also relevant to other cloud service providers.

Technique 2: SSH Keys

AWS: EC2 Instance Connect

In a different scenario, an attacker with compromised identity and access management (IAM) credentials used the AuthorizeSecurityGroupIngress API to add an inbound SSH rule to security groups. As a result, instances that were previously protected from internet access by the security group became reachable, including from attacker-controlled IP addresses.

Modifying the security groups rules allowed classic network lateral movement, showcasing the simplicity of configuring network resources in the cloud compared to on-premises environments. Following this, the powerful IAM permissions the attacker gained allowed them to use the EC2 Instance Connect service (which manages SSH keys on a machine). They were able to temporarily push a public SSH key by using the SendSSHPublicKey API as shown in Figure 3.

Image 3 is a screenshot of the code used for technique number two in Amazon Web Services. The command starts with send SSH public key. It also involves the instance ID, the username and the public key.
Figure 3. Command for technique 2 in AWS.

This allowed the attacker to connect to an EC2 instance, granting them access to the instance’s data.
This serves as an example of how cloud providers have their own mechanisms for accessing compute instances alongside the operating system’s native authentication and authorization technologies. However, there are typically connections between the two.

Although there are barriers between the cloud and the compute instances running within it, these barriers are permeable by design, enabling movement between these different authentication and authorization systems. This is a good example of how powerful IAM credentials allow access to compute instances (as well as containers and RDS databases, for example). They can do so even though these non-cloud-native technologies might have their own authentication methods that operate independently, outside the cloud.

Within the EC2 instance, the attacker discovered additional cleartext credentials saved to disk, notably a private SSH key and AWS access tokens. With these access credentials, the attacker pivoted to additional EC2 instances.

Using SSH and cloud tokens for lateral movement demonstrates the combination of both traditional and cloud lateral movement techniques employed by the attacker. Eventually, utilizing these credentials led to the attacker pivoting to other development environments. Figure 4 provides a flow chart for this chain of events.

Image 4 is a tree diagram of how the EC2 Instance Connect service is used for SSH key injection. Key > Icon of data > Icon of server > Icon of disk data. Disk data branches into three servers labeled SSH.
Figure 4. Utilizing the EC2 Instance Connect service for SSH key injection.


GCP: Metadata-Based SSH Keys

The equivalent lateral movement technique also exists in GCP due to misconfiguration. Compute Engine instances can be configured to store their SSH keys in the instance metadata, as long as the OS Login service is not used.

Stored in the instance metadata, these SSH keys facilitate access to individual instances. But instances can also have their SSH keys stored in the project metadata, which means these keys will grant access to all instances within the project.

This works as long as instances do not restrict project-wide SSH keys. Public SSH keys can be appended to instance metadata by using the Google Cloud CLI as illustrated below in Figure 5.

Image 5 is a screenshot of the commands used to append SSH keys.
Figure 5. Commands for appending SSH keys to instance metadata in GCP.

Similarly, public SSH keys can also be added to the project metadata with elevated privileges. This enables attackers with sufficiently powerful cloud credentials to access all instances in that specific project using the command shown below in Figure 6.

Image 6 is a screenshot of the commands used to add SSH keys to metadata in Google Cloud.
Figure 6. Command to add SSH keys to project metadata in GCP.

Virtual private cloud network security settings can protect against misconfigurations of SSH keys.


Azure: VMAccess Extension

Another noteworthy lateral movement technique is abusing the VMAccess extension in Azure. The VMAccess extension is used for resetting access to virtual machines (VMs), and one of its functionalities in Linux VMs includes updating the SSH public key for a user.

Attackers with sufficiently powerful cloud credentials can use this extension to gain access to VMs by resetting the SSH key for a specific user in a designated VM. This is done in the Azure CLI with the command shown in Figure 7.

Image 7 is a screenshot of the command used to reset the SSH key for a specific Azure user.
Figure 7. Command to reset the SSH key for a specific user in Azure.

This technique can also be extended to compromise a specific user across multiple VMs in the same resource group, using the command shown in Figure 8.

Image 8 is a screenshot of the command used to reset the SSH key for a specific user against multiple virtual machines in Azure.
Figure 8. Command to reset the SSH key for a specific user against multiple VMs in Azure.

Technique 3: Serial Console Access

AWS: Serial Console Access

Another technique we've observed involves serial console access. The serial console exists in all three major cloud providers, and it typically offers an interactive shell on an instance. It serves as a troubleshooting tool without any networking capabilities.

In contrast to the EC2 instance connect technique, this approach comes with greater limitations, as it requires preconfiguration of the instance's operating system with a user password or additional functionalities like SysRq.

In this context, an attacker chose the serial console as an alternative to SSH, as it can bypass security group rules configured for the instance. In one case, an attacker once again used the EC2 Instance Connect service, using the SendSerialConsoleSSHPublicKey API to temporarily push a public SSH key. See the command shown in Figure 9.

Image 9 is a screenshot of the command used to exploit the EC2 Instance Connect service.
Figure 9. Using the EC2 Instance Connect service.

But this time, this action allowed the attacker to establish a serial console connection to the EC2 instances, allowing them to access the file system and execute shell commands within the instance.

GCP: SSH Key Authentication

In GCP, the serial console relies on SSH key authentication, requiring a public SSH key added to the project or instance metadata. An attacker with sufficient cloud API privileges could potentially use the Google Cloud CLI to establish a serial console connection to a Compute Engine instance using the following command in Figure 10.

Image 10 is a screenshot of the command to establish a serial console connection in Google Cloud.
Figure 10. Establishing a serial console connection to an instance in GCP.

Azure: VMAccess Extension

This technique has some limitations in Azure. An attacker with sufficient cloud API privileges can use the VMAccess extension to either create a new local user with a password or reset the password of an existing local user. Subsequently, the attacker uses a command in the Azure CLI to initiate a serial console connection to the VM, as shown in Figure 11.

Image 11 is a screenshot of the command to establish a serial console connection in Azure.
Figure 11. Establishing a serial console connection to a VM in Azure.

Technique 4: Management Services

AWS: Systems Manager

In another use case, an attacker with IAM privileges to the Systems Manager service targeted instances managed by the service. There, the attacker established a connection to multiple managed instances using the StartSession API and initiated an interactive shell session on each instance using the command shown in Figure 12.

Image 12 is a screenshot of the command to establish a compute instance in Amazon Web Services.
Figure 12. Establishing a connection to a compute instance in AWS.

Of note, this method does not require an SSH inbound rule in the associated security group of the EC2 instance, effectively bypassing security group rules.

The attacker also used the SendCommand API to execute scripts across a large number of managed instances simultaneously, enabling large-scale information gathering specifically targeting credentials files. The command to do this is shown in Figure 13.

Image 13 is a screenshot of how compute instance commands are executed in Amazon Web Services.
Figure 13. Executing commands on compute instances in AWS.

Below, Figure 14 shows a flowchart illustrating the chain of events for this attack.

Image 14 is a tree diagram of how a threat actor runs shell commands at scale in the Amazon Web Services Systems Manager. Key icon > cloud server icon > SendCommand > Shell scripts branch into three servers.
Figure 14. Utilizing the AWS Systems Manager to run shell commands at scale.

Agent and Agentless: Better Together

Given the nature of the cloud, we can categorize attackers' techniques into two layers: the host and the cloud. The host layer encompasses all actions executed within cloud instances, while the cloud layer comprises all the API calls made within the cloud environment. In each of the techniques we observed, the attackers moved seamlessly between the cloud and the instances, utilizing both cloud APIs and operations at the host-level.

Regardless of the authentication and authorization technologies typically used for managed compute instances, defenders should assume that these are not strong barriers. Attackers with powerful cloud credentials could still gain access to compute instances within the cloud environment.

Detecting the activities in this article requires correlating data from both agent and agentless solutions that provide a comprehensive view into cloud environments.

Attackers who are able to access hosts often have sufficient privileges to disable local security controls and security agents running on the host. Thus, it is important to be alert to when relevant log streams from hosts stop as a possible indicator of compromise.

Let's examine lateral movement technique 2, where an attacker abused the EC2 Instance Connect service to access EC2 instances. The agentless solution provides insights into the attacker's access methods by offering visibility into all executed cloud-level API calls, including actions such as security group modification and SSH key injection. An alert for this in an AWS panel is shown below in Figure 15.

Image 15 is a screenshot of the Amazon Web Services backend showing the alerts for the specific SSH key modification. Some of the information has been redacted. The information includes the alert name, severity, category and the MITRE attack number.
Figure 15. Alert for cloud instance SSH key modification in AWS.

The Prisma Cloud Resource Query Language (RQL) query shown below in Figure 16 could also be used to identify suspicious SSH operations taken by a malicious actor.

Image 16 is a screenshot of the query that detects suspicious Prisma Cloud operations.
Figure 16. RQL query to detect suspicious SSH operations in Prisma Cloud.

Simultaneously, if a Cortex XDR agent is installed on an EC2 instance that offers host-level visibility, it reveals the attacker's efforts to search for credentials and sensitive files. This visibility proved crucial in understanding how the attacker performed lateral movement and pivoted to other environments.

Image 17 is a screenshot of Cortex XDR. It includes information such as the alert description, source process, username, source command, process path and the installation type. The alert category is credential access. It also includes the MITRE attack information and the alert severity, which here is medium. The alert type is suspicious access to cloud credential files of various cloud providers. The activity time is redacted.
Figure 17. Cloud credentials file access as detected by the Cortex XDR agent.

It is more effective to secure cloud environments with both agent and agentless solutions. Agents are great for having full visibility and control over specific instances, with the caveat that agents can often be disabled by attackers.

On the other hand, agentless solutions provide cloud-level visibility. Moreover, properly configured cloud logging environments cannot easily be modified or disabled by attackers, providing a critical backstop for defenders. Combining both solutions provides the best of both worlds in terms of securing cloud environments.

Conclusion

Attackers with sufficient privileges at the cloud API level can take advantage of the characteristics of cloud environments for lateral movement using cloud APIs. Cloud APIs often enable attackers to pivot through compute instances with relative ease compared to traditional lateral movement in typical on-premises environments. However, on-premises environments, especially virtualized environments with the equivalent power available to an attacker with access to the virtualization layer, have plenty of risks of this type as well.

For some of the scenarios described, there may be detections and remediations available from CSPs or other sources. Defenders should be aware of the options available to improve their cloud security posture. 

Since misconfigurations and similar issues can often weaken organizations’ cloud security, defenders should pay particular attention to using best practices recommended by your CSP, and also to ensuring that your configuration matches your security needs.

Employing both agent and agentless solutions is an effective way to detect the hybrid tactics of attackers who combine traditional and cloud-based techniques for lateral movement. The cloud lateral movement techniques illustrated in this article highlight the importance of having a comprehensive security approach to effectively address the challenges inherent in cloud environments.

Palo Alto Networks customers receive better protection from these attacks through the following products:

Cortex XDR


Cortex XDR provides SOC teams with a full incident story across the entire digital domain by integrating activity from cloud hosts, cloud traffic and audit logs together with endpoint and network data. Cortex leverages all this data to detect unusual cloud activity that correlates with known TTPs such as cloud computing credential theft, cryptojacking and data exfiltration.

Prisma Cloud

Prisma Cloud provides DevOps and SOC teams the ability to monitor for vulnerabilities, configuration and event operations across organization-wide cloud and hybrid cloud resources and infrastructure. Prisma Cloud Defender agents protect and monitor for vulnerabilities, misconfiguration and suspicious runtime events for:

  • Cloud web apps
  • VM runtime events
  • Serverless functions
  • Storage container resources

This allows organizations to maintain situational awareness and improve DevOps practices to maintain a secure cloud environment.

If you think you might have been impacted or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

  • North America Toll-Free: 866.486.4842 (866.4.UNIT42)
  • EMEA: +31.20.299.3130
  • APAC: +65.6983.8730
  • Japan: +81.50.1790.0200

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Google Cloud has provided guidance on how to properly configure cloud systems to protect against the lateral movement opportunities discussed in this article.

Data From Chinese Security Services Company i-Soon Linked to Previous Chinese APT Campaigns

Posted on by Unit 42

Executive Summary

On Feb. 16, 2024, someone uploaded data to GitHub that included possible internal company communications, sales-related materials and product manuals belonging to the Chinese IT security services company i-Soon, also known as Anxun Information Technology. The leaked materials appear to show how a commercial entity developed and supported cyber espionage tools in support of Chinese-affiliated threat actors. As part of initial investigation into the leaked data, Unit 42 discovered links between information in the data leak and previous Chinese-affiliated advanced persistent threat (APT) campaigns. Unit 42 assesses with high confidence that the leaks are genuine.

For example, documents in the leak appear to show i-Soon was marketing the Treadstone malware controller software, which was attributed to Elemental Taurus (aka APT41) in the 2019 U.S. grand jury indictment against three Chengdu 404 employees [PDF].

Through analysis of the leaked data, Unit 42 has identified actor-owned infrastructure and potential malware related to historic reporting on Chinese threat actors. Given the scope of the data leak, this report will cover initial analysis and significant findings, with further reporting likely to come at a future time. (While the original GitHub repo where the leak was posted has now been taken down by GitHub staff, citing a violation of terms of service, researchers will continue to study what was initially shared.)

Based on our current understanding of the data leak, customers can be better protected through Palo Alto Networks security products against the tools and techniques used by the Chinese threat actors mentioned in this article.

Related Unit 42 Topics GitHub, China

Technical Analysis

Text on the GitHub repository claims that i-Soon has targeted the governments of India, Thailand, Vietnam and South Korea, as well as the intergovernmental organization NATO. We continue to analyze the leaked data to verify these claims.

The GitHub repository contains a mixture of online chat conversations, screenshots and probable victim data, as well as sales- and support-related documents. The text conversations dated between November 2018 and January 2023, and they involve 37 unique usernames.

The conversations range from general conversation and workplace issues to talking about targets, software vulnerabilities and customers.

Figure 1 graphs the text communications observed between the members of i-Soon, showing relationships between employees and the volume of messages between them. (Specific user names and given names have been redacted.)

Image 1 is a relationship diagram of employees and message volume. Blue icons represent people with their user names underneath. Arrows connect these users with each other. Numbers along the arrows indicate the number of messages. Usernames have been redacted.
Figure 1. Visualization of i-Soon’s leaked online chats (specific user names redacted).

Links to Previous Threat Intelligence Reporting

Unit 42 has found links in the leaked i-Soon text message conversations to two previously reported campaigns attributed to Chinese advanced persistent threat (APT) groups.

Campaign 1: 2022 Supply Chain Attack

In September 2022, Trend Micro reported about a supply chain attack on the Canadian software company Comm100. The attackers trojanized the installer for Comm100’s chat-based customer engagement application hosted on their official website. When we looked through the i-Soon data leak, we found indications that i-Soon was involved in that attack.

Table 1 includes an excerpt taken from a conversation between two members of i-Soon where they claim IP address 8.218.67[.]52 is their server.

Date From To Message Translated
2022-06-13 7:39:19 wxid_c9xxxxxxxxxxxx wxid_zbxxxxxxxxxxxx 扬州那边问个人pc的通道 [A person or organization from Yangzhou] wants to ask for or request access to a PC channel that belongs to a specific individual. 
2022-06-13 7:39:21 wxid_c9xxxxxxxxxxxx wxid_zbxxxxxxxxxxxx [捂脸] [emoji suggesting embarrassment or sorry to bother you]
2022-06-13 7:39:23 wxid_c9xxxxxxxxxxxx wxid_zbxxxxxxxxxxxx 现在能给不 Can you give it now?
2022-06-13 7:40:26 wxid_zbxxxxxxxxxxxx wxid_c9xxxxxxxxxxxx 【彩宝贝】

【代理】

8.218.67[.]52:27011

【TCP隧道】

8.218.67[.]52:17011

【账号】

admin

【密码】

88888888

 【Gambling or lottery site】

【Proxy】

8.218.67[.]52:27011

【TCP Tunnel】 8.218.67[.]52:17011

【account】

admin

【password】

88888888
2022-06-13 7:40:34 wxid_c9xxxxxxxxxxxx wxid_zbxxxxxxxxxxxx 嗯嗯 Uh-huh
2022-06-13 7:40:37 wxid_c9xxxxxxxxxxxx wxid_zbxxxxxxxxxxxx 我日 [Expletive]
2022-06-13 7:40:54 wxid_c9xxxxxxxxxxxx wxid_zbxxxxxxxxxxxx 这个服务器在香港的 This server is in Hong Kong
2022-06-13 7:41:06 wxid_zbxxxxxxxxxxxx wxid_c9xxxxxxxxxxxx 你不管 You don't need to worry about it
2022-06-13 7:41:07 wxid_c9xxxxxxxxxxxx wxid_zbxxxxxxxxxxxx <a

href='068f70a1-1ff9-451 b-999e-2569860fd348.

md'>domain_access_r esult(1).csv</a>
2022-06-13 7:41:11 wxid_c9xxxxxxxxxxxx wxid_zbxxxxxxxxxxxx 嗯 Um
2022-06-13 7:41:14 wxid_zbxxxxxxxxxxxx wxid_c9xxxxxxxxxxxx 这个服务器是我们的 This server is ours

Table 1. Transcript of conversation between i-Soon members about IP address 8.218.67[.]52.

On June 17, 2022, days after the above conversation occurred, the IP address 8.218.67[.]52 served a Linux ELF file with the SHA256 of db4497090a94d0189aa3c3f4fcee30d5381453ec5aa38962e2ca971074b74e8b. The file was served from the URL hxxp[://]8.218.67[.]52/js/xxx.jpg. When executed, the file attempts to contact the domain unix.s3amazonbucket[.]com (which is not a legitimate Amazon domain).

The Trend Micro report also mentioned that another subdomain of s3amazonbucket[.]com (analyaze.s3amazonbucket[.]com) was used as a command and control (C2) server for the trojanized installers.

Given the domain s3amazonbucket[.]com was likely under the control of i-Soon, Unit 42 assesses with moderate confidence that a group of hackers within i-Soon was involved in the supply chain attack on Comm100.

Campaign 2: 2019 Poison Carp Attack

In September 2019, Citizen Lab reported on attackers targeting Tibetan groups via multiple iOS and Android exploits. Citizen Lab attributed the attack to the Chinese threat group they track as POISON CARP. The report references domains that were tied to an IP address that we found references to in this data leak.

The IP address 74.120.172[.]10 was associated with the domain mailteso[.]online between Sept. 22, 2020, and Feb. 20, 2024, and mailnotes[.]online between Aug. 7, 2021, and July 12, 2022.

Table 2 outlines the conversation between i-Soon employees about IP address 74.120.172[.]10.

Date From To Message Translated
2023-01-09 02:28:14 wxid_hlxxxxxxxxxxxx wxid_12xxxxxxxxxxxx 等一下 平台有点问题 Wait, there are some issues with the platform
2023-01-09 02:28:18 wxid_12xxxxxxxxxxxx wxid_hlxxxxxxxxxxxx 好的 OK
2023-01-09 02:36:19 wxid_hlxxxxxxxxxxxx wxid_12xxxxxxxxxxxx hxxps[://]74.120.172[.]10:100

92/home
2023-01-09 02:36:25 wxid_hlxxxxxxxxxxxx wxid_12xxxxxxxxxxxx access OrFRXV 

LZtestUser lzqzmp@123
2023-01-09 02:43:51 wxid_12xxxxxxxxxxxx wxid_hlxxxxxxxxxxxx 演示视屏发一个 Send over a demo video
2023-01-09 02:44:06 wxid_12xxxxxxxxxxxx wxid_hlxxxxxxxxxxxx 这个资料都不用给了 No need to give this information
2023-01-09 02:44:09 wxid_12xxxxxxxxxxxx wxid_hlxxxxxxxxxxxx [呲牙] [Grinning emoji]
2023-01-09 02:44:20 wxid_hlxxxxxxxxxxxx wxid_12xxxxxxxxxxxx 这是微软的试用版 This is the trial version of the Microsoft [tool]
2023-01-09 02:44:33 wxid_12xxxxxxxxxxxx wxid_hlxxxxxxxxxxxx 恩，我看到了 I saw it
2023-01-09 02:44:51 wxid_12xxxxxxxxxxxx wxid_hlxxxxxxxxxxxx 微软的演示视频有吗 Do you have a demo video [for Microsoft Windows tool]?
2023-01-09 02:44:58 wxid_hlxxxxxxxxxxxx wxid_12xxxxxxxxxxxx 我问下 Let me ask
2023-01-09 02:48:54 wxid_hlxxxxxxxxxxxx wxid_12xxxxxxxxxxxx <a

href='12cef436-c870-4e0e

-b36c-ae2a4e839f79.md'>

微软邮件密取平台.7z</a>

 <a

href='12cef436-C870

-4E0E-B36C-AE2A4 E839F79.MD'>

Microsoft Mail Secret Platform .7z

</a>
2023-01-09 02:52:01 wxid_12xxxxxxxxxxxx wxid_hlxxxxxxxxxxxx 是不是你们视频错了啊 Is your video wrong?
2023-01-09 02:52:03 wxid_12xxxxxxxxxxxx wxid_hlxxxxxxxxxxxx 我打不开 I can not open it
2023-01-09 02:55:53 wxid_hlxxxxxxxxxxxx wxid_12xxxxxxxxxxxx 嗯？ Huh?
2023-01-09 02:55:56 wxid_hlxxxxxxxxxxxx wxid_12xxxxxxxxxxxx 解压就行了呀 Just decompress it
2023-01-09 02:56:36 wxid_12xxxxxxxxxxxx wxid_hlxxxxxxxxxxxx 估计是我没看视屏的 I guess I didn't watch the video
2023-01-09 03:01:26 wxid_12xxxxxxxxxxxx wxid_hlxxxxxxxxxxxx 还有安卓的远控 Also the Android RAT
2023-01-09 03:02:07 wxid_hlxxxxxxxxxxxx wxid_12xxxxxxxxxxxx 安卓稍等一下 有点问题 Wait, there’s some issues with the Android one
2023-01-09 03:02:26 wxid_12xxxxxxxxxxxx wxid_hlxxxxxxxxxxxx 好 ok

Table 2. Transcript of conversation between i-Soon employees about IP address 74.120.172[.]10.

At the time of Citizen Lab publication, mailnotes[.]online was associated with IP address 207.246.101[.]169, which was concurrently associated with the domain gmail.isooncloud[.]com.

Links to Known Chinese Intrusion Sets

The data leaks include manuals and whitepapers for various software tools. Of particular importance, these tools include software previously attributed to Chinese APT groups.

We do not currently know whether i-Soon were developers, resellers or even simply end users of these tools. However, the leaked documents help confirm previous reporting that multiple China-attributed threat actor groups often use the same, likely commercialized, malware tool sets.

One document contains a footer that translates to “Anxun Information Technology Co., Ltd.” and appears to be a product manual for a range of software tools sold by i-Soon. These tools include remote control management systems for Windows, Mac, iOS, Android and Linux.

The Linux remote control management software shown in Figure 2 is notable because the screenshot provided in the document to help explain the tool’s functionality shows the malware control panel is named “Treadstone.” The 2019 U.S. grand jury indictment of three Chengdu 404 employees directly references Treadstone.

Image 2 is a screenshot of the malware Treadstone’s control panel. Two red boxes highlight the host information and a group name. The language in the screenshot is a mix of English and Chinese characters.
Figure 2. Screenshot of the Treadstone Linux malware control panel from a leaked product manual.

The indictment claims the Treadstone malware controller software “was designed to work with Winnti malware which, at the time, was used only by a small group of hackers.” Given reporting from October 2023 of Chengdu 404 taking i-Soon to court for a software development contract dispute, i-Soon might have developed the Treadstone panel.

Another document relating to known Chinese APT tools is a whitepaper for a Windows remote control management system. This document covers the system and network architecture and the product’s features. On one of the pages explaining management of the tool is a screenshot of what is likely the administrator panel, shown in Figure 3.

Image 3 is a screenshot of the administrator panel that includes the configured public IP address and port included in the whitepaper for the Windows remote control management system.
Figure 3. Administrator panel from Windows remote control management system related to known Chinese APT tool.

The screenshot shows the configured public IP address and port as TCP[://]118.31.3[.]116:44444. SentinelLabs reported this IP address was used as a ShadowPad C2 server in August 2021 and attributed to the Winnti group. This second link to the Winnti group adds further evidence that i-Soon was involved in the development of known Winnti tool sets.

Conclusion

This data leak provides unique insight into the Chinese private-sector hacking industry, which had previously only been seen through U.S. government indictments and reports. It also gives us a better understanding of the capabilities of Chinese threat actors, including how these groups are likely sharing or reselling the same tool sets. This dissemination of tools makes attribution more difficult for defenders and threat intelligence analysts.

Unit 42 will continue to analyze the leaked data, and we will update this post periodically, as we have more information to share.

Based on our understanding of the data leak, customers should be better protected through Palo Alto Networks security products against the tools and techniques used by the Chinese threat actors mentioned in this article. Malicious IPs related to the campaigns discussed have been blocked by Advanced URL Filtering.

If you think you might have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

  • North America Toll-Free: 866.486.4842 (866.4.UNIT42)
  • EMEA: +31.20.299.3130
  • APAC: +65.6983.8730
  • Japan: +81.50.1790.0200

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Additional Resources

Updated Feb. 27, 2024, at 8:03 a.m. PT to switch the images for figures 2 and 3. 

Intruders in the Library: Exploring DLL Hijacking

Posted on by Samantha Stallings

Executive Summary

Dynamic-link library (DLL) hijacking is one of the oldest techniques that both threat actors and offensive security professionals continue to use today. DLL hijacking is popular because it grants threat actors a stealthy way to run malware that can be very effective at evading detection. At its core, DLL hijacking tricks an operating system into running a malicious binary instead of a legitimate DLL.

This article explains how threat actors use DLL hijacking in malware attacks, and it should help readers by providing:

  • Theoretical background necessary to understand DLL hijacking
  • Explanations that demystify some of the concepts around this technique
  • Common variations seen in the wild
  • Real-world examples from both advanced persistent threat (APT) and cybercrime threat actors

This article also provides ideas for how to better detect DLL hijacking, and we share best practices on how to reduce the risk of attack.

Palo Alto Networks customers are better protected from the threats discussed in this article through our Next-Generation Firewall, as well as Advanced WildFire, DNS Security, and Advanced URL Filtering. Cortex XDR and XSIAM detect known and novel DLL hijacking attacks. The Prisma Cloud Defender agent can assist in identifying malware that uses DLL hijacking techniques. If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.

What Is DLL Hijacking?

DLL files are programs that are meant to be run by other programs in Microsoft Windows. DLL hijacking allows attackers to trick a legitimate Windows program into loading and running a malicious DLL. Adversaries leverage DLL hijacking for multiple purposes, including defense evasion, privilege escalation and persistence.

DLL hijacking has evolved, with many variations over the past several years. To understand DLL hijacking, we must first understand the DLL search order mechanism, which is a crucial function in Microsoft Windows.

Windows DLL Search Order

DLL hijacking relies on the DLL search order that Windows uses when loading DLL files. This search order is a sequence of locations a program checks when loading a DLL. The sequence can be divided into two parts: special search locations and standard search locations. You can find the search order comprising both parts in Figure 1.

Image 1 is a diagram of the Windows dynamic link library search order. The special search locations are DLL redirection, API sets, SxS manifest redirection, loaded-module list, known DLLs, package dependency graph of process. Standard search locations are application directory, System32, System, Windows, current directory and directories listed in PATH variable.
Figure 1. Flow chart of the Windows DLL search order.

Special Search Locations

Special search locations are taken into account before the standard search locations, and they contain different factors that can control the locations to be searched and used to load a DLL. These locations are based on the application and the system configurations.

  1. DLL redirection allows specifying which DLL should be loaded by the DLL loader
  2. API sets allows dynamically routing function calls to the appropriate DLL based on the version of Windows and the availability of different features
  3. SxS manifest redirection redirects DLL loading by using application manifests
  4. Loaded-module list verifies whether the DLL is already loaded into memory
  5. Known DLLs checks whether the DLL name and path match the Windows list of known DLLs. This list resides in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs
  6. The package dependency graph of the process, in case it was executed as part of a packaged app

Standard Search Locations

The standard search locations are the ones most associated with the DLL hijacking technique, and they will usually be used by adversaries. Windows will use the following order to search for the desired DLL.

  1. The application’s directory (the directory containing the executable)
  2. C:\Windows\System32
  3. C:\Windows\System
  4. C:\Windows
  5. The current directory (the directory from which we execute the executable)
  6. Directories listed in the PATH environment variable

Hijacking this whole DLL search order will grant an adversary the option to load their malicious DLL within the context of a legitimate application and achieve stealthy execution. They can do this by triggering a malicious DLL to load before the valid one, replacing the DLL or by altering the order (specifically the PATH environment variable).

The prevalence of DLL hijacking has been on the rise in recent years, and DLL hijacking continues to gain popularity. This is because discovering and exploiting the vulnerability in legitimate executables isn't considered to be particularly difficult. However, detecting an attacker loading malicious, camouflaged DLLs within legitimate executables remains a complex undertaking.

Common DLL Hijacking Implementations

As the concept of DLL hijacking continues to evolve over time, threat actors have evolved as well, using different approaches to perform this kind of attack. The three most common techniques we have observed are DLL side-loading, DLL search order hijacking and phantom DLL loading. The most common technique is DLL side-loading.

DLL Side-Loading

In this most commonly used DLL-hijacking technique, an attacker obtains a legitimate executable that loads a specifically named DLL without specifying the DLL file's full directory path. DLL side-loading uses a malicious DLL renamed to the same filename of a legitimate DLL, one normally used by a legitimate executable. Attackers drop the legitimate executable and a malicious, renamed DLL within a directory they have access to.

In DLL side-loading, the attackers rely on the fact that the executable’s directory is one of the first locations Windows searches for.

We have studied examples of attackers employing this technique in recent Unit 42 posts, including an instance by the APT Cloaked Ursa (aka APT29), and as part of our Threat Hunting series.

DLL Search Order Hijacking

This implementation exemplifies the core abuse of the entire Windows DLL search order. It is used by adversaries, red teamers and security validation solutions.

This technique simply leverages the Windows DLL search order to drop a malicious DLL in any of its searched locations that would cause a vulnerable, legitimate program to execute a malicious DLL. An attacker can place a malicious DLL in a location prioritized by the DLL search order before the location of a valid DLL. This can happen at any point in the DLL search order, including the PATH environment variable, which attackers can modify by adding a path directory with a malicious DLL.

An example of this type of attack is to drop a malicious DLL in a Python installation directory to hijack the DLL search order. This is an implementation that different security practitioners have already demonstrated.

When Python is installed on a Windows machine, it often adds its installation directory to the PATH environment variable, usually in one of the first searched locations, as shown in Figure 2.

Image 2 is a screenshot of Python folders listed in the Edit environment variable window. There are options for New, Edit and Browse.
Figure 2. Python folders in the PATH environment variable.

Installing Python on a Windows host creates a directory with relaxed permissions, allowing any authenticated user (including unprivileged ones) to write to this location. This gives attackers the best conditions to execute their DLL search order hijack attack and infect the targeted machine.

Phantom DLL Loading

In this technique, adversaries look for a vulnerable executable that attempts to load a DLL that simply doesn't exist (or is missing) due to an implementation bug. Then, attackers will plant a malicious DLL with the non-existent DLL’s filename in its expected location.

A familiar example of this technique is the abuse of the Windows Search (WSearch) Service. This service is responsible for search operations and it launches with SYSTEM privileges upon system startup.

When this service starts, it executes SearchIndexer.exe and SearchProtocolHost.exe, which both attempt to load msfte.dll from System32. In default Windows installations, the file does not exist in this location.

An adversary can plant their malicious DLL if they can write to the System32 folder or an alternate DLL search order location, or insert another attacker-controlled location into the PATH environment variable. This allows them to gain a stealthy pathway for execution with SYSTEM privileges, and a means to maintain persistence on the machine.

Uncovering Threat Actors and Campaigns

Using our telemetry, we set out to hunt for DLL hijacking attacks, which revealed a large volume of attempted DLL hijacking attacks – including their variations. The following section provides real-world examples of how various threat actors, both cybercrime and nation-state APT groups, use DLL hijacking.

Examples of DLL Hijacking by Nation-State APT Threat Actors

ToneShell’s Triple DLL Side-Loading

In September 2023, Unit 42 researchers discovered attackers using DLL side-loading to install the ToneShell backdoor. Attacks using a ToneShell variant were linked to Stately Taurus, in a campaign that built upon three DLL components working in tandem as shown in Figure 3. In the image, each component has been paired with its associated Image Load event in Cortex. The action type shows that the malicious DLLs were loaded to each legitimate process.

Image 3 is a screenshot of a process tree in Cortex XDR. Each alert is paired with its action type. From right to left is the Persistence Component, Networking Component and Functionality Component.
Figure 3. ToneShell process tree in Cortex XDR.

Each DLL component holds a different purpose:

  • Persistence components (nw.dll, nw_elf.dll): These DLLs are in charge of persistence for the backdoor, as well as dropping the other components to disk.
  • Networking component (rw32core.dll): This DLL is in charge of command and control (C2) communication.
  • Functionality component (secur32.dll): This DLL is in charge of executing the different commands of the backdoor.

The persistence components (nw.dll, nw_elf.dll) are side-loaded by PwmTower.exe, a component of a password manager, which is a legitimate security tool.

The networking component (rw32core.dll) is side-loaded by Brcc32.exe, the resource compiler of Embarcadero, an app development tool.

The functionality component (secur32.dll) is side-loaded by Consent.exe, which is a Windows binary described as “Consent UI for administrative applications.”

PlugX RAT Leverages DLL Side-Loading to Remain Undetected

Another recent example of a DLL side-loading alert that caught our attention was an attack using the infamous PlugX backdoor.

PlugX is a modular backdoor that is predominantly used by various Chinese APT groups like PKPLUG. PlugX developers circulate in underground hacking communities, and the malware binaries can be found online, so non-Chinese threat actors can also use PlugX.

In the following example, PlugX infected a machine via a compromised USB device. Figure 4 shows the contents of the USB device. This device contained a directory named History and a Windows Shortcut (LNK) file. The History folder’s name and icon were disguised as the Windows History folder, and the LNK file uses an icon to appear as a removable disk.

Image 4 is a screenshot of a fake history folder with a malicious LNK file. Name, star icon, History, Removable Disk(28GB).
Figure 4. Fake History folder and malicious link file.

The fake History folder contains three files:

  • 3.exe
    • A renamed Acrobat.exe file (a legitimate component of Adobe Acrobat)
  • Acrobat.dll
    • The PlugX loader, renamed to appear to be a legitimate Adobe Acrobat file
  • AcrobatDC.dat
    • A malicious payload that the PlugX loader decrypts in memory

Once the victim clicks the removable disk LNK, it launches the 3.exe process. Then 3.exe loads the PlugX component named Acrobat.dll via DLL side-loading.

Next, the malware creates a directory at C:\ProgramData\AcroBat\AcrobatAey and copies the three files to this location as Acrobat.exe, Acrobat.dll and AcrobatDC.dat, respectively.

To achieve persistence, this PlugX sample creates a scheduled task named InternetUpdateTask, which it sets to run every 30 minutes.

Figure 5 shows the initial process tree of the infection in Cortex XDR.

Image 5 is a screenshot of the process tree for PlugX in Cortex XDR. There are two flexers and three different .exe files.
Figure 5. Process tree of initial execution of PlugX.

Examples of DLL Hijacking by Cybercrime Threat Actors

Uncovering AsyncRAT Phishing Campaign Targeting South American Organizations

By hunting for DLL side-loading alerts in Cortex XDR Analysis, we discovered a phishing campaign targeting victims mainly in Colombia and Argentina, aiming to deliver AsyncRAT.

AsyncRAT is open-source malware that is very popular among cybercriminals. It gives attackers a range of capabilities such as executing commands, screen capturing and key logging.

The infection starts with phishing emails written in Spanish that contain descriptions of required legal actions, as shown in Figure 6.

Image 6 is a screenshot of a phishing email delivering AsyncRAT. The language of the email is Spanish.
Figure 6. Text of a phishing mail to deliver AsyncRAT.

The emails also contain links to a Google Drive URL hosting a malicious ZIP archive.

These archive files contain an executable with the same name as the ZIP filename and a malicious DLL file named http_dll.dll.

The executable is actually a renamed legitimate component of the ESET HTTP Server service process, originally named EHttpSrv.exe. When the victim executes the renamed EHttpSrv.exe, it loads the malicious http_dll.dll file from the same directory via DLL side-loading. After the executable loads http_dll.dll, the DLL unpacks in memory and loads the AsyncRAT malware.

Figure 7 shows the infection chain as seen in Cortex XDR. The malicious ZIP archive is downloaded, extracted with 7-Zip (7zG.exe) and the renamed EHttpSrv.exe is executed.

Image 7 is a screenshot of a tree diagram of alerts in Cortex XDR. Following the process tree, the steps are: 1. The user downloads the zip file. 2. The user extracts the zip file. 3. The user clicks on the renamed EHttpSrv.exe.
Figure 7. AsyncRAT infection in Cortex XDR.

Figure 8 shows the “Possible DLL Side-Loading” alert Cortex XDR raised for this chain of events.

Image 8 is a screenshot of an alert in Cortex XDR of possible DLL side loading. The alert level is medium. The source is XDR Analytics. Investigate button. The signed actor process #13, notification demanda en su Contra.EXE loaded the module http_dll.dll. This module hash was seen on zero hosts in the organization in the last 30 days.
Figure 8. Possible DLL Side Loading alert in Cortex XDR.

Phantom DLL Loading for CatB Ransomware

CatB ransomware was first seen in December 2022. In at least one campaign since then, threat actors have abused the Distributed Transaction Coordinator (MSDTC) service to achieve phantom DLL loading for CatB ransomware.

The core of this CatB ransomware campaign consists of two components: a dropper DLL and a ransomware DLL. The dropper DLL performs different anti-sandbox and anti-virtual machine (VM) checks to ensure the environment is safe to drop its ransomware payload.

After the dropper DLL is satisfied the environment is clear, it writes a second DLL named oci.dll under the C:\Windows\System32 directory. Then, the dropper kills the MSDTC process by msdtc.exe as shown below in Figure 9.

Image 9 is a screenshot of Cortex XDR. Three alert icons show three different .exe files.
Figure 9. Execution of the dropper DLL in Cortex XDR.

This is done to implement phantom DLL loading. When msdtc.exe launches, it attempts to load a DLL named oci.dll, which does not usually exist in the System32 folder. When msdtc.exe relaunches, it loads the malicious oci.dll, which is the ransomware payload, as shown in Figure 10. In the image, the process msdtc.exe is paired with the Image Load event in Cortex for the malicious oci.dll.

Image 10 is a screenshot of a process diagram in Cortex XDR. When the .exe launches it loads a malicious DLL module.
Figure 10. Msdtc.exe loads the malicious oci.dll module shown in Cortex XDR.

Cortex XDR alerts on phantom DLL loading attempts, as shown in Figure 11.

Image 11 is a screenshot of an alert in Cortex XDR of possible DLL loading. The alert level is medium. The source is XDR Analytics. Investigate button. OCI.DLL was loaded into msdtc.exe, which might be an attacker loading malicious code into a trusted process. This behavior was seen on zero hosts and zero unique days in the last 30 days.
Figure 11. Phantom DLL Loading alert in Cortex XDR.

Abuse of Microsoft DLLs Leads to Dridex

Threat actors have implemented DLL side-loading for another well-known malware, the Dridex banking Trojan. The initial infection vector for Dridex has most often been malicious emails or web traffic.

When executed, the Dridex loader has used AtomBombing to inject code into the process space used by explorer.exe. Next, the injected explorer.exe process writes Dridex DLLs as .tmp files and shell scripts with random names to the user’s TEMP directory. An example of these files being written to disk is shown in Figure 12.

Image 12 is a screenshot of an alert table in Cortex XDR. The two columns are action type and file path. All of the actions are File Write.
Figure 12. Malicious files written to disk by explorer.exe shown in Cortex XDR.

Up to three of the shell scripts can appear, and they create the persistent Dridex infection in three different locations under random directory paths on the victim's host. The persistent infection uses DLL side-loading.

The shell scripts create these randomly-named directories under random directory paths, copy legitimate Microsoft executables and rename the Dridex DLL .tmp files for the DLL side-loading. An example of two shell scripts are shown below in Figure 13.

Image 13 is a screenshot of a shell script that copies Dridex. There are eight lines of code in total.
Figure 13. The shell scripts that copy Dridex.

Afterward, the injected explorer.exe process creates persistence for the copied binaries using up to three methods:

  1. A registry update under HKCU\SOFWARE\Microsoft\Windows\CurrentVersion\Run (example in Figure 14)
  2. A Windows shortcut under the user's AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup folder
  3. A scheduled task
Image 14 is an alert in Cortex XDR. Some of the information is redacted. Two file paths are included.
Figure 14. Cortex XDR alert on Dridex creating a scheduled task for persistence.

Figure 15 shows Cortex XDR alerting on the legitimate file DeviceEnroller.exe side-loading a malicious Dridex DLL.

15 is a screenshot of a process diagram in Cortex XDR. The alert name is highlighted by a red rectangle. Some of the information has been redacted.
Figure 15. Alert for the legitimate DeviceEnroller.exe side-loads the malicious Dridex DLL.

Principles for Efficient DLL Hijacking Detection

Pinpointing instances where an executable unexpectedly loads a malicious DLL with an identical name, but that is otherwise different in its content, is a rather challenging task. This challenge significantly increases when attempting to detect these behavioral anomalies at scale.

In this section we provide several principles for effective detection of DLL hijacking, including its variations. The principles will focus on the malicious DLL, the vulnerable application and the loading event, where a vulnerable application loads the malicious DLL.

Malicious DLL

Since the malicious DLL has the same name as a legitimate DLL, we look for abnormalities. For example:

  • No digital signature or a stolen signature
  • An unusual file size
  • Unusually high or low entropy
  • A rare file hash (compared to baseline) in the organization
  • DLL compilation time significantly newer than the loading application
  • A DLL placed in a path it doesn’t usually reside in

Vulnerable Application

The vulnerable application is usually a legitimate one to allow better disguise for the malicious DLL execution. Given that, we proceed to seek out distinct traits:

  • Usually a valid digital signature
  • Trusted vendors (antivirus, browsers, VPNs, Microsoft applications) are a common target
  • Commonly abused application (by hash or version)
  • In DLL side-loading
    • It will usually be an uncommon application in the organization
    • It will usually use an uncommon directory (e.g., C:\Users\<Username>\AppData, C:\ProgramData)

Loading Event

We can find different abnormalities also within the loading event. For example:

  • The first time the application loads a suspected DLL name and/or its hash
  • The application usually loads several DLLs, but now it loads only one

Mitigating the DLL Hijacking Attack Surface

To secure applications from possible DLL hijacking attacks, developers need to be cognizant of this attack technique and integrate diverse protective measures.

Microsoft has published a DLL security article covering several best practices to support developers in this effort, including the following:

  • Wherever possible, specify a fully qualified path when loading DLLs or triggering new process executions.
  • Gain more control of your application behavior by utilizing DLL redirection and manifests.
  • Do not assume the operating system version when users execute an application. Develop your application to be handled as intended in all OSes.

Conclusion

This article covers DLL hijacking, providing the technical background needed to understand how threat actors weaponize it, along with an explanation of popular variations in its implementation.

In addition, we provide examples that demonstrate how various threat actors – both APT nation-state and cybercrime groups – rely on this technique to achieve stealth, persistence and privilege escalation in their operations.

Lastly, we discuss possible approaches for detecting and mitigating DLL hijacking in enterprise environments.

Protections and Mitigations

For Palo Alto Networks customers, our products and services provide the following coverage associated with the threats described above:

  • Next-Generation Firewall and Advanced WildFire accurately identifies known samples as malicious.
  • Advanced URL Filtering and DNS Security identify domains associated with this group as malicious.
  • Prisma Cloud
    • When paired with the WildFire integration, the Prisma Cloud Defender agent will identify malicious binaries and make verdict determinations when analyzing executing processes.
    • When paired with XSIAM, the Prisma Cloud Defender is enabled to block malicious processes from operating within the cloud environment.
    • Prevents the execution of known malicious malware, and also prevents the execution of unknown malware using Behavioral Threat Protection and machine learning based on the Local Analysis module.
  • Cortex XDR and XSIAM
    • Detects known and novel DLL hijacking attacks, using the new generic Analytics DLL Hijacking tag.
    • Prevents the execution of known malicious malware, and also prevents the execution of unknown malware using Behavioral Threat Protection and machine learning based on the Local Analysis module.
    • Protects against credential gathering tools and techniques using the new Credential Gathering Protection available from Cortex XDR 3.4.
    • Protects from threat actors dropping and executing commands from web shells using Anti-Webshell Protection, newly released in Cortex XDR 3.4.
    • Protects against exploitation of different vulnerabilities including ProxyShell and ProxyLogon using the Anti-Exploitation modules as well as Behavioral Threat Protection.
    • Cortex XDR Pro detects post exploit activity, including credential-based attacks, with behavioral analytics.

If you think you might have been impacted or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

  • North America Toll-Free: 866.486.4842 (866.4.UNIT42)
  • EMEA: +31.20.299.3130
  • APAC: +65.6983.8730
  • Japan: +81.50.1790.0200

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Indicators of Compromise

The following are SHA256 hashes of files from the examples used in this article.

AsyncRAT ZIP

  • 26fc0efa8458326086266aae32ec31b512adddd1405f4dd4e1deed3f55f7b30d
  • 0709e3958f343346406c5a26029748f5d15101d3b7d8b8c1119f7642754ae64e
  • 5e50329c4bcb67a1220f157744e30203727f5a55e08081d1ae65c0db635ce59d
  • af8baffceafeda320eab814847dee4df74020cc4b96a4907816335ad9b03c889
  • c3ec461e8f3d386a8c49228a21767ff785840bc9ae53377f07ff52d0ccba1ccf
  • e00918a579ced5783cefc27b1e1f9f0bc5b0f93a32d4a7170c7466b34cc360df
  • e41f58d82394853fc49f2cccae07c06504cc1d1f3d49ba6bfd8f8762948b7c16
  • eadd74bbb7df21e45abc07c065876ba831978185c9e0845f19e86c151439020a

AsyncRAT

  • 54fc9f4699d8fb59ce1635df5aaa2994b5d924d7b4d7626e1b5d9a406bef899d
  • 10fec9bf8d695ab14b1329cc6ca6d303d87617ffa76e3e4cc46f8f542e062d70
  • 69985edc2510803cfd862bdf87c59cc963be1bde5e08a0f10c0fd109c2134eab
  • 2ea71c9cbb949e96da71716d8a431952632b954c7fc5ba87e6f84684957f07ef
  • a8b7aaede89c587525906fa24f392b1ce0b4a73c6193eb6db95b586ae378649c
  • 27b8bfe997400a956cd7ec9a3f68e198fe690562d909185b7d41b1e9ce31c53f
  • e4fdc02f196cedb98d2098b6993f6e28976abe9b5c8e9f9752dea493b9d1dcb9

PlugX ZIP

  • 86a5ce23cf54d75d9c8d9402e233d00f8f84a31324ae8e52da6172e987d9a87b
  • dca39474220575004159ecff70054bcf6239803fcf8d30f4e2e3907b5b97129c

PlugX loader

  • 12c584a685d9dffbee767d7ad867d5f3793518fb7d96ab11e3636edcc490e1bd

PlugX dat file

  • 95205b92d597489b33854e70d86f16d46201803a1a9cb5379c0d6b7c0784dbc7

PlugX LNK file

  • 515fd058af3dfd2d33d49b7c89c11c6ef04c6251190536ca735a27e5388aa7e7

Dridex

  • f101cc7885e44eee63713a71bba85baa7c135a9b1fe49480e05fc872f84993e7
  • 3f98a3e8ea69daf06e6da6e8d495bba42e575dbd0ba26f5e6035efb017545be1
  • 2f043922d42fbef8d1a08395bf0928d6181863c44b53bccc8c3806796db1c50e
  • 25085c4f707583052d7070ddb5473bb0684e588694279c7f85e4c17e36837074
  • 8a1c5858440a3eaa91f7442b7453127432f240637d22793dca6bfe5406776fbe
  • fbc4421f8454139f4e2ebd808ebb224c0d773b0d62f69ef2270da386a4aab3e7
  • 0d4a7b43b5dbe8b8492c51a3f7595c8e188d558390ee1ab0586d1315b98619c9
  • 98ebb3e797e19e0e6aeffc6d03e7ad5ce76f941a175c3cacc3a7f0056d224f95
  • 0989a9be27bdc8827008f1837e62d88a077f8541a7b080e367b08facd9382962
  • 4a6ebd82b30063c73283b5364e34fc735ad05b5dd62bfa77f38617e9b2937444

ToneShell Persistence Component

  • 2f5cf595ac4d6a59be78a781c5ba126c2ff6d6e5956dc0a7602e6ba8e6665694
  • 0f2f0458d2f1ac4233883e96fe1f4cc6db1551cdcfdd49c43311429af03a1cd5
  • 011fe9974f07cb12ba30e69e7a84e5cb489ce14a81bced59a11031fc0c3681b7
  • 3fc4d023d96f339945683f6dc7d9e19a9a62b901bef6dc26c5918ce9508be273
  • 3a429b8457ad611b7c3528e4b41e8923dd2aee32ccd2cc5cf5ff83e69c1253c2
  • f58d3d376c8e26b4ae3c2bbaa4ae76ca183f32823276e6432a945bcbc63266d9
  • 46c6ee9195f3bd30f51eb6611623aad1ba17f5e0cde0b5523ab51e0c5b641dbf
  • 86140e6770fbd0cc6988f025d52bb4f59c0d78213c75451b42c9f812fe1a9354

ToneShell Networking Component

  • a08e0d1839b86d0d56a52d07123719211a3c3d43a6aa05aa34531a72ed1207dc
  • 19d07dbc58b8e076cafd98c25cae5d7ac6f007db1c8ec0fae4ce6c7254b8f073
  • 8e801d3a36decc5e4ce6fd3e8e45b098966aef8cbe7535ed0a789575775a68b6
  • df4ba449f30f3ed31a344931dc77233b27e06623355ece23855ee4fe8a75c267
  • 345ef3fb73aa75538fdcf780d2136642755a9f20dbd22d93bee26e93fb6ab8fd
  • 3a5e69786ac1c458e27d38a966425abb6fb493a41110393a4878c811557a3b5b

ToneShell Functionality Component

  • 66b7983831cbb952ceeb1ffff608880f1805f1df0b062cef4c17b258b7f478ce
  • f2a6a326fb8937bbc32868965f7475f4af0f42f3792e80156cc57108fc09c034
  • dafa952aacf18beeb1ebf47620589639223a2e99fb2fa5ce2de1e7ef7a56caa0
  • 52cd066f498a66823107aed7eaa4635eee6b7914acded926864f1aae59571991

CatB Loader

  • 3661ff2a050ad47fdc451aed18b88444646bb3eb6387b07f4e47d0306aac6642

CatB Payload

  • c8e0aa3b859ac505c2811eaa7e2004d6e3b351d004739e2a00a7a96f3d12430c
  • 83129ed45151a706dff8f4e7a3b0736557f7284769016c2fb00018d0d3932cfa
  • 35a273df61f4506cdb286ecc40415efaa5797379b16d44c240e3ca44714f945b
  • 9990388776daa57d2b06488f9e2209e35ef738fd0be1253be4c22a3ab7c3e1e2

 

Threat Brief: ConnectWise ScreenConnect Vulnerabilities (CVE-2024-1708 and CVE-2024-1709)

Posted on by Unit 42

Executive Summary

Feb. 13, 2024, ConnectWise was notified of two vulnerabilities impacting their remote desktop software application ScreenConnect. These vulnerabilities were first reported through their vulnerability disclosure channel in the ConnectWise Trust Center.

Feb. 19, 2024, ConnectWise publicly disclosed the vulnerabilities in a security bulletin.

As of Feb. 21, 2024, Unit 42 observed 18,188 unique IP addresses hosting ScreenConnect globally.

The newly disclosed vulnerabilities have now been assigned the following CVEs:

CVE Number Description CVSS Severity
CVE-2024-1708  ScreenConnect 23.9.7 and prior are affected by a path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems. 8.4 High
CVE-2024-1709 ConnectWise ScreenConnect 23.9.7 and prior are affected by an authentication bypass using an alternate path or channel vulnerability, which may allow an attacker direct access to confidential information or critical systems. 10.0 Critical

The authentication bypass vulnerability (CVE-2024-1709) is considered to be trivially exploitable, and proof-of-concept exploits are already available. Metasploit has released an unauthenticated remote code execution (RCE) exploit module for this vulnerability.

We assess with high confidence that this vulnerability will be actively targeted by various types of threat actors, including cybercriminals and nation-state actors, given the severity and scope of the vulnerability and the nature of the impacted product.

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2024-1709 to the Known Exploited Vulnerabilities Catalog. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, Federal Civilian Executive Branch agencies are required to address vulnerabilities identified in the catalog by the assigned due date. For this vulnerability the due date for remediation is Feb 29, 2024.

Vulnerabilities Discussed CVE-2024-1708, CVE-2024-1709

Current Scope of the Attack

Unit 42 is providing Incident Response support to customers related to these vulnerabilities.

ConnectWise has confirmed that it has “received updates of compromised accounts that our incident response team have been able to investigate and confirm.”

As of Feb. 21, 2024, Unit 42 observed 18,188 unique IP addresses hosting ScreenConnect globally.

Earlier scans showed that nearly three-quarters of these hosts were in the U.S. The top ten countries accounted for over 95% of global exposure. Our observations are summarized in Figure 1 and Table 1.

Image 1 is a heatmap of ConnectWise ScreenConnect global exposure as of February 19th, 2024. The highest instances are in the United States.
Figure 1. Global exposure of ConnectWise ScreenConnect as of Feb. 19, 2024.
Top Ten Countries with ConnectWise ScreenConnect Exposure
Country Name Unique IP Addresses
United States 6,445
United Kingdom 466
Canada 407
Australia 401
Germany 259
Ireland 143
Netherlands 71
India 57
Singapore 40
Sweden 38

Table 1. Top ten countries with ConnectWise ScreenConnect exposure.

Mitigation Actions

The ConnectWise bulletin indicates that ScreenConnect servers hosted in screenconnect[.]com cloud or hostedrmm[.]com have been updated to remediate the issue and no end user action is required. For those with self-hosted or on-premise deployments, the guidance is to patch as soon as possible.

ConnectWise has removed license restrictions so that older versions can be upgraded even if no longer under maintenance.

Conclusion

Unit 42 will continue to monitor the situation and will update this post as more information becomes available.

Palo Alto Networks Product Protections for ConnectWise Vulnerabilities

Palo Alto Networks customers can leverage a variety of product protections and updates to identify and defend against this threat.

If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

  • North America Toll-Free: 866.486.4842 (866.4.UNIT42)
  • EMEA: +31.20.299.3130
  • APAC: +65.6983.8730
  • Japan: +81.50.1790.0200

Next-Generation Firewalls and Prisma Access With Advanced Threat Prevention

Next-Generation Firewall with the Advanced Threat Prevention security subscription an help block the attacks with best practices via the following Threat Prevention signatures 95048.

Cloud-Delivered Security Services for the Next-Generation Firewall

Advanced URL Filtering categorizes exploit and scanning attempts as Scanning Activity. Advanced URL Filtering and DNS Security categorize as malicious known domains/IPs associated with this activity.

Cortex XDR and XSIAM

Cortex XDR and XSIAM help protect against post-exploitation activities using the multi-layer protection approach.

Cortex Xpanse

Cortex Xpanse has added Attack Surface Rules for both generic ConnectWise ScreenConnect as well as known insecure versions of identified ConnectWise ScreenConnect instances. These rules are also available to XSIAM customers who have purchased the ASM module.

Additionally, Cortex Xpanse has published a new Threat Response Center event for this pair of vulnerabilities.

Indicators of Compromise

ConnectWise has identified the following IoCs, which were recently used by threat actors:

  • 155.133.5[.]15
  • 155.133.5[.]14
  • 118.69.65[.]60

Sophos has identified the following IoCs. See their research on ConnectWise linked below.

Indicator Type Data Note
SHA256 0d185ea3b0a49c2fa65bfd2757c9d0705657f0639fd36f196ac394fcd38c361d Malware. Uses Sophos in properties.
SHA256 11d2dde6c51e977ed6e3f3d3e256c78062ae41fe780aefecfba1627e66daf771 Malware with Sophos name in properties. Source: hxxp://207.246.74.189:804/download/Diablo.log
SHA256 1362e6d43b068005f5d7c755e997e6202775430ac15a794014aa9a7a03a974e7 hxxp://185.232.92.32:8888/Logs.txt - Malicious Data, which will be loaded by (SentinelAgentCore.dll)
SHA256 19fc383683b34ba31ed055dc2e546a64eecbe06d79b6cc346773478c84f25f92 Installer for ScreenConnect distributed by threat actors. Source: hxxps://transfer.sh/get/6YoVhBPfKE/temp2.exe
SHA256 254714b7028005596fd56bdbe30bfc77f02bbe274048d0982118d93966e79331 hxxp://185.232.92.32:8888/all.ps1 - Malicious Script downloads payload (SentinelUI.exe, SentinelAgentCore.dll, Logs.txt) - Sideloading
SHA256 2da975fee507060baa1042fb45e8467579abf3f348f1fd37b86bb742db63438a "enc.exe" ransomware executable
SHA256 3818bb7adf60f8c2aeb5fe8c59b81fc7eb7f1471a80932610dc9a294ba7ba543 Malware script that decodes to an executable. Source: hxxp://91.238.181.238/a
SHA256 444338339260d884070de53554543785acc3c9772e92c5af1dff96e60e67c195 Payload from f1c7045badec0b9771da4a0f067eac99587d235d1ede35190080cd051d923da6 - %temp%\xw.exe
SHA256 55e4ce3fe726043070ecd7de5a74b2459ea8bed19ef2a36ce7884b2ab0863047 AnyDesk installer distributed by threat actors. Source: hxxp://116.0.56.101:9191/images/Distribution.exe
SHA256 858ddfe6530fb00adb467f26e2c8f119fef284e1e9b6c92f0634f403ee3e7913 Source: hxxp://shapefiles.fews.net.s3.amazonaws.com:80/8gaLYHLcZ4DPV
SHA256 86b5d7dd88b46a3e7c2fb58c01fbeb11dc7ad350370abfe648dbfad45edb8132 Installer for SimpleHelp distributed by threat actors. Source: hxxps://transfer.sh/get/HcrhQuN0YC/temp3.exe
SHA256 8c2d246bf93bf84f6d4376cd46d8fcc3cb9c96d9bef7d42c23ff222d8f66eeaf crypt64ult.exe ransomware executable inside of msappdata.msi
SHA256 8e51de4774d27ad31a83d5df060ba008148665ab9caf6bc889a5e3fba4d7e600 Source: hxxp://23.26.137.225:8084/msappdata.msi
SHA256 9b3327f9ea7c02c6909a472a3c1abb562b19ae72d733a8e2e990e975b5f8a5d0 Payload from 3818bb7adf60f8c2aeb5fe8c59b81fc7eb7f1471a80932610dc9a294ba7ba543 - Cobalt Strike
SHA256 a39d9b1b41157510d16e41e7c877b35452f201d02a05afa328f1bcd53d8ee016 hxxp://185.232.92.32:8888/SentinelAgentCore.dll - Malicious DLL Component (Loader)
SHA256 a50d9954c0a50e5804065a8165b18571048160200249766bfa2f75d03c8cb6d0 Ransomware binary built using the leaked Lockbit 3 builder tool
SHA256 c94038781c56ab85d2f110db4f45b86ccf269e77a3ff4b9133b96745ff97d25f "UpdaterScreenConnect.exe" malware
SHA256 de42bd53cb0944da8bc33107796ecf296d00968725eed1763a8143cef90e2297 hxxp://185.232.92.32:8888/sentinelui.exe - Clean File used for sideloading malicious DLL
SHA256 f1c7045badec0b9771da4a0f067eac99587d235d1ede35190080cd051d923da6 Script that decodes itself to become a malware executable
SHA256 f3f5d3595559cad6019406d41f96fa88c69d693326cdf608c5fc4941fdf6a8ec r.bat file that downloads 858ddfe6530fb00adb467f26e2c8f119fef284e1e9b6c92f0634f403ee3e7913
SHA256 b423d100e7aa2e576c8f21586f1d8924b34c3e9ed4cfdba40d121e21c3618445 Decoded PowerShell script
URL hxxp://116.0.56.101:9191/images/Distribution.exe AnyDesk installer distributed by threat actors
URL hxxp://119.3.12.54:8000/identity_helper.exe URL observed in ScreenConnect attacks. Payload not retrieved.
URL hxxp://159.65.130.146:4444/a URL observed in ScreenConnect attacks. Payload not retrieved.
URL hxxp://159.65.130.146:4444/svchost.exe URL observed in ScreenConnect attacks. Payload not retrieved.
URL hxxp://185.232.92.32:8888/all.ps1 URL observed in ScreenConnect attacks. Payload not retrieved.
URL hxxp://185.232.92.32:8888/Logs.txt URL observed in ScreenConnect attacks. Payload not retrieved.
URL hxxp://185.232.92.32:8888/SentinelAgentCore.dll URL observed in ScreenConnect attacks. Payload not retrieved.
URL hxxp://185.232.92.32:8888/sentinelui.exe URL observed in ScreenConnect attacks. Payload not retrieved.
URL hxxp://207.246.74.189:804/download/Diablo.log Malicious stealer. File has properties that identify it as Sophos ML Model model.dll
URL hxxp://91.238.181.238/a 3818bb7adf60f8c2aeb5fe8c59b81fc7eb7f1471a80932610dc9a294ba7ba543
URL hxxps://transfer.sh/get/6YoVhBPfKE/temp2.exe Installer for ScreenConnect distributed by threat actors.
URL hxxps://transfer.sh/get/HcrhQuN0YC/temp3.exe Installer for SimpleHelp remote access utility distributed by threat actors.

Additional Resources

Updated Feb. 23, 2024, at 6:13 a.m. PT to add additional information to the Executive Summary, Scope of Attack and Mitigations sections, including an update from CISA and other news. Added a Next-Generation Firewall Threat Prevention signature. 

Updated Feb. 29, 2024, at 12:40 p.m. PT to add new IoCs from Sophos, an Additional Resources section, and expanded protections for Next-Generation Firewall. 

Updated March 4, 2024, at 7:00 a.m. PT to add IPs to protections for Next-Generation Firewall. 

2024 Unit 42 Incident Response Report: Navigating the Shift in Cybersecurity Threat Tactics

Posted on by Unit 42

Introduction

Our annual survey of incident data from more than 250 organizations and more than 600 incidents provides a Unit 42 perspective on the current state of security exposures.

Threat actors are increasing their speed, scale and sophistication – and that requires rapid, comprehensive and proactive defense.

The 2024 Unit 42 Incident Response Report presents the data we collected while helping hundreds of organizations defend against threat actors and active attacks. That data provides insight into how organizations can effectively defend their attack surface.

Threat actor tactics evolved noticeably in 2023. Large-scale exploitation of internet-facing vulnerabilities was the initial access vector in 39% of our cases, compared to 28% of cases in 2022. Threat actors continue to steal and use compromised credentials. While we saw phishing less often used to drop malware, it’s still used in many intrusion techniques, including exploiting IT support and password reset processes as well as session token theft.

The past year also featured more “grab-and-go” behavior. A majority of incidents involved threat actors exfiltrating as much data as they could find rather than seeking specific information. This represents an increase and a continued trend toward prioritizing speed and scale above more targeted theft.

Instead of carefully selecting data, attackers are now rapidly collecting as much as possible, exfiltrating it and sorting it out later. Sometimes, data theft is automated, along with vulnerability exploitation. This approach also aligns with attackers’ tendency to exfiltrate data earlier in the attack process than in previous years.

Key Findings From the 2024 Unit 42 Incident Response Report

More-Sophisticated Threat Actors Are Gaining Initial Access Differently

There’s a clear strategy shift among advanced threat actors. It’s illustrated by the changing ways they achieve initial access.

  • Over the past year, there has been a discernible rise in the exploitation of software and API vulnerabilities, which have become increasingly favored by attackers. Exploiting these vulnerabilities accounted for 38.60% of the initial access points in 2023, up from 28.20% the year before. This significant increase indicates where attackers are focusing their efforts.
  • At the same time, previously compromised credentials are also growing as an initial access vector. Compromised credential use has grown from 12.90% to 20.50% during the same time frame. And if we look back two years, it’s more than five times as prevalent as in 2021. Marketplaces for stolen credentials remain vibrant, despite coordinated takedown efforts between law enforcement and private industry.
  • Phishing is decreasing… sort of. From a one-third share of initial access incidents in 2022, phishing has dropped to just 17% in 2023. This reduction signals a possible de-prioritization of phishing as cybercriminals adapt to more technologically advanced – and perhaps more efficient – infiltration methods.
Image 1 is a stacked column chart by year, 2021 through 2023, of initial access vectors. These are software and API vulnerabilities, previously compromised credentials, social engineering such as phishing, brute force and other.
Figure 1. Initial access vectors per year, from 2021 through 2023.

Our observations lead us to believe these are strategic changes, particularly for more advanced threat actors. They are moving away from traditional and interactive phishing campaigns to less noticeable and possibly automated methods of exploiting system weaknesses and pre-existing credential leaks.

This trend suggests that defenders should now prioritize detecting and remediating software vulnerabilities and securing credential management processes to mitigate these rising threats.

Threat Actors Grab Data Indiscriminately

Threat actors are stealing data less discriminately. An overwhelming majority of incidents involved indiscriminate data theft, where specific data targeting seemed less attractive to the attackers.

In 93% of incidents, threat actors took data indiscriminately rather than searching for specific data. This is up from 2022, when 81% of cases involved non-targeted data theft. In 2021, it was even lower: 67%

This surge points to a growing trend among cybercriminals who appear to be casting a wider net, gathering any data they can access rather than expending effort to locate and extract particular datasets.

Image 2 is a stacked column chart comparing data that was targeted or not targeted by year, from 2021 through 2023. Not targeted is the largest amount for each year.
Figure 2. Whether data was targeted by year, from 2021 through 2023.

This shift could be due to a variety of factors. Attackers know the sheer volume of an organization’s data could reveal lucrative targets when taken in bulk. They are also likely to use automated tools that harvest data indiscriminately.

This has multiple implications for cybersecurity efforts:

  • It suggests that traditional defenses focused on protecting highly sensitive data must be complemented by strategies that assume all data could be at risk.
  • A “grab everything” attacker mentality underscores the importance of early and robust detection capabilities that can recognize large-scale exfiltration attempts, often the first clear sign of a breach.
  • This shift in cyberthreat behavior necessitates a quicker response to detections and alerts and a continuous reassessment of security measures, as the sheer amount of data compromised complicates impact analysis and the notification process.

Considering these shifting threat dynamics, reviewing and strengthening existing security strategies is essential for defenders to effectively counter the advanced tactics of contemporary attackers.

Recommendations for Defenders

In light of the data from our 2024 Unit 42 Incident Response Report, a few recommendations we regularly make rise to the top.

Get Visibility Across Your External and Internal Attack Surface

Organizations should enhance visibility into their external and internal environments to keep pace with the expanding attack surface. That visibility should include understanding the cloud landscape, where frequent changes introduce new risks, and especially securing remote desktop protocol (RDP), which can amplify the threat of ransomware if exposed. Creating this visibility requires a robust combination of asset discovery, vulnerability scanning and adopting comprehensive multifactor authentication (MFA).

Emphasize continuous assessment and improvement of defenses, particularly in cloud services, where the dynamic nature of the technology can lead to frequent exposure to threats.

Close Critical Protection Gaps with Principles of Zero Trust

The Zero Trust model, advocating for a “never trust, always verify” approach, is the approach we most often recommend to our clients.

Organizations should strengthen user authentication with comprehensive MFA and explore passwordless technologies to reduce the effectiveness of credential stealing. Ensuring that users have access only to the resources necessary for their roles limits the potential for unauthorized access and lateral movement within the network.

This strategic approach requires continuous validation of security protocols and user privileges, paired with rigorous education on authentication best practices and session management.

How Palo Alto Networks and Unit 42 Can Help

Get the 2024 Unit 42 Incident Response Report for more incident response insights, trends, predictions and recommendations for best practices.

Palo Alto Networks customers can take advantage of Cortex Xpanse; an active attack surface management solution that can help discover, learn about, and respond to risks in exposed systems and services. Customers also receive protection against the specific vulnerabilities discussed in this post through Cortex XDR, Cortex XSIAM, Cloud-Delivered Security Services (CDSS) and other products. Additionally, Prisma Access is a cloud-delivered networking and security service with features like malware blocking and more.

If you think you may have been impacted by a cyber incident or have specific concerns about any of the vulnerabilities discussed here, please contact Unit 42 to connect with a team member. The Unit 42 Incident Response team is available 24/7/365. If you have cyber insurance, you can request Unit 42 by name. You can also take preventative steps by requesting any of our cyber risk management services.

Our world-renowned incident response team and security consulting experts will guide you with an intelligence-driven approach before, during, and after an incident. By partnering with us, you'll gain strategic guidance for bolstering your defenses and safeguarding your organization.

Additional Resources

Updated Feb. 22, 2024, at 4:00 p.m. PT to add Threat Vector podcast.

Updated Sept. 24, 2024, at 6:35 a.m. PT to add Prisma Cloud protection information.

Threat Brief: Attacks on Critical Infrastructure Attributed to Insidious Taurus (Volt Typhoon)

Posted on by Unit 42

Executive Summary

Insidious Taurus (aka Volt Typhoon) is identified by U.S. government agencies and international government partners as People’s Republic of China (PRC) state-sponsored cyber actors. This group focuses on pre-positioning themselves within U.S. critical infrastructure IT networks, likely in preparation for disruptive or destructive cyberattacks in the event of a major crisis or conflict with the United States. During a hearing on Jan. 31, 2024, FBI director Christopher Wray told the U.S. House Select Committee on the Strategic Competition Between the United States and the Chinese Communist Party that Volt Typhoon was “the defining threat of our generation.”

The U.S. government, in collaboration with international government allies,  has published two Joint Cybersecurity Advisories (CSA) about this activity. They published the first Joint CSA on May 24, 2023. They published the second Joint CSA on Feb. 7, 2024.  

The first CSA discusses the group’s use of small office/home office (SOHO) network devices as intermediate infrastructure to obscure their activity. It also describes the use of living-off-the-land techniques and the use of built-in network administration tools to perform objectives, as means of hiding their activity. Palo Alto Networks was credited for providing input on the activity as part of the first CSA.

The second CSA discussed a wider set of techniques used by this group. These techniques include performing extensive pre-compromise reconnaissance, the exploitation of known or zero-day vulnerabilities in public-facing network appliances to gain initial access, and a focus on gaining administrator credentials within a victim environment. 

The U.S. Department of Justice published a press release on Jan. 31 stating that a court-authorized operation has disrupted a botnet of hundreds of U.S.-based SOHO devices infected with the KV-botnet. The KV-botnet has been used by multiple different threat actors, including Insidious Taurus. 

The vast majority of the devices included in the botnet were routers that were vulnerable because they were no longer supported through their manufacturer’s security patches or other software updates. Threat actor groups chain together compromised devices within this botnet to form a covert data transfer network. 

Despite the disruption of the KV-botnet, Insidious Taurus remains an ongoing threat and cyberattacks targeting critical infrastructure warrant special attention. Unit 42 will continue to update this threat brief as more information becomes available.

Palo Alto Networks customers are better protected from Insidious Taurus through the following:

  • Next-Generation Firewall with the Advanced Threat Prevention security subscription can help block the attacks with Threat Prevention signatures.
  • Advanced Threat Prevention has an inbuilt machine learning-based detection that can detect exploits in real time.
  • Advanced URL Filtering and DNS Security identify known IPs and domains associated with this group as malicious.
  • Cortex XSOAR can automate workflows for data enrichment, indicators of compromise (IoC) hunting and remediation actions to reduce manual work and speed up the patching process.
  • Cortex XDR and XSIAM agent helps protect against the techniques executed by this threat actor using Behavioral Threat Protection and its multiple security modules. Cortex Analytics has multiple detection models covering the techniques, with additional relevant coverage by the Identity Analytics module.
  • Cortex Xpanse is able to detect a wide range of internet-exposed SOHO devices.
  • Prisma Cloud agents have detection for all known Insidious Taurus malware samples listed within WildFire.
  • Prisma Access has detection for all known Insidious Taurus malware samples within WildFire and all related threat signatures will be detectable at services turnup.

Organizations can engage the Unit 42 Incident Response team for specific assistance with this threat and others.

Threat Group Discussed  Also Known As
Insidious Taurus Volt Typhoon, Voltzite, BRONZE SILHOUETTE, Vanguard Panda, UNC3236, Dev-0391

Adversary Attack Methodology

In late 2021, Unit 42 observed a threat actor (now identified as Insidious Taurus) using a then-undisclosed Zoho ManageEngine ADSelfService Plus vulnerability (CVE-2021-40539) for initial access. While performing incident response activities, Unit 42 identified a connection to a network-attached storage (NAS) server with FTP running. We found a sample of SockDetour in the trash of that NAS.  

SockDetour is a custom backdoor used to maintain persistence, designed to serve as a backup backdoor in case a threat actor’s primary one is removed. The tactics and techniques used during this event aligned with what Microsoft then called DEV-0391, which is now known as Volt Typhoon. 

Insidious Taurus also uses one rarely used malware family, EarthWorm, as well as custom versions of open-source tools Impacket and Fast Reverse Proxy. Employment of these tools further underscores our assessment of the attackers’ technical skill and their focus on remaining undetected. 

Exploiting vulnerabilities in internet-facing devices is a known initial access vector for Insidious Taurus. They are believed to have the capability to identify and develop their own zero-day exploits while also taking advantage or publically disclosed vulnerabilities and exploits. 

Once initial access has been achieved, a common attribute of attacks is the need to generate as little malicious activity as possible to evade detection and blocking by protection software. Getting caught at all, let alone quickly, precludes operational success. 

Insidious Taurus actors take multiple steps to avoid detection, showing an overall technical ability only seen with advanced attackers. One of the ways they do this is by using compromised SOHO devices. Originating attacks from households or small businesses aids attackers because many do not have significant security protections in place. 

In addition to requiring manual software updates, SOHO devices are also rarely configured according to best practices by users and they have network management interfaces exposed directly online. Because of these things, many attackers of all motivations – including botnets – also recognize and use SOHO devices for malicious activity. This was true for the case Unit 42 worked in late 2021 where a connection led to the identification of the compromised NAS server.

Another common technique Insidious Taurus has used to remain undetected, formerly the sole realm of advanced attackers but now more widely used, is a technique known as living off the land. This is when attackers abuse legitimate tools – often those used by system administrators for legitimate purposes – for malicious use. 

If captured in logs, this activity often looks similar to legitimate network administration use. This includes network enumeration, determining account permissions and even password recovery tools. Because of their widespread legitimate use, these tools are often on allow lists for download and can be difficult to detect when used for malicious activity. 

Another way actors can hide their activity when interacting with victim networks, is to carry out their work using direct hands-on keyboard activity vs using scripts to automate activity. By doing so, the attackers can hamper detection efforts again because their activity appears to be expected, human activity rather than a barrage of scripted commands to detect and interdict. For now, this technique remains one only used effectively by advanced attackers due to the required knowledge and skill.

Interim Guidance

Unit 42 recommends following the guidance provided by CISA in their latest CSA. This includes the following:

  • Hardening the attack surface
  • Securing credentials and accounts
  • Securing and limiting the use of remote access services
  • Implementing network segmentation
  • Securing cloud assets
  • Being prepared through logging, threat modeling and training

Additionally, Unit 42 recommends increasing detection opportunities to identify living off the land attacks.

Unit 42 Managed Threat Hunting Queries

The queries below represent a few ways organizations can hunt for activity that could be related to Insidious Taurus. However, the techniques and IoCs being hunted for here may not be unique to Insidious Taurus and any results should be considered in the context of other identified activity.

Conclusion

Based on the available public information, Unit 42 assesses Insidious Taurus as a top tier, sophisticated APT. We concur with the attribution made in both Joint Cyber Security Advisories that this activity is associated with a PRC state-sponsored actor. 

As activity from Insidious Taurus is challenging to detect, we agree with the CSA’s recommendations to focus on a few key areas. This includes mitigation activities such as updating any internet facing device like SOHO equipment or virtual private networks (VPNs), as threat actors use these devices as part of a botnet or as an initial access vector. 

These recommendations also include strengthening the use of multifactor authentication. And finally, it includes prioritizing sufficient logging, which can be especially important for detecting  activity within an environment that could be indicative of living off the land techniques. Additional detailed guidance on actions to take can be found in the latest Joint CSA. 

Palo Alto Networks customers are better protected through our products, as listed below. We will update this threat brief as more relevant information becomes available.

Palo Alto Networks Product Protections for Insidious Taurus

Palo Alto Networks customers can leverage a variety of product protections and updates designed to identify and defend against this threat.

If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

  • North America Toll-Free: 866.486.4842 (866.4.UNIT42)
  • EMEA: +31.20.299.3130
  • APAC: +65.6983.8730
  • Japan: +81.50.1790.0200

Palo Alto Networks is offering a no-cost, no-obligation emergency bundle for organizations to help identify and mitigate any exposure to Insidious Taurus's use of exploits that target vulnerabilities in various networking gear, including an Attack Surface Assessment and a Prisma Access 90-day license.

This offer is promotional and subject to availability. Due to the rapidly changing nature of this vulnerability, Palo Alto Networks reserves the right to update this offer.

Next-Generation Firewalls and Prisma Access With Advanced Threat Prevention

The Next-Generation Firewall with the Advanced Threat Prevention security subscription can help block the attacks via the following Threat Prevention signatures: 91676, 92734, 91362, 90829, 91363, 86360, 90926, 90952, 90972, 90851, 83202, 85739.

Advanced Threat Prevention provides inline machine learning that can help detect vulnerability exploits in real time.

Prisma Access

All known Insidious Taurus malware samples within WildFire and all related threat signatures will be detectable by Prisma Access at services turnup.

Prisma Access is a centralized cloud-delivered security service that uses a Zero Trust Strategy. It enforces the principles of least privilege and continuous trust verification to not only limit access to users based on need, but also to continually monitor changes in application workloads. It also monitors user behavior using cutting-edge machine learning and artificial intelligence to deliver best in breed alerts and mitigation. This establishes protection beyond initial access and can help limit or prevent impact to operations in the case of attempted compromise.

The environment is automatically updated and protected with the latest inline machine learning-powered threat prevention technologies, such as WildFire, Advanced URL Filtering, Advanced Threat Prevention and more. Prisma Access provides a continuous and dynamic security inspection ecosystem that can stop even zero-day threats.

By using machine learning-based detection, Prisma Access is able to provide detection and response to zero-day threats in real time, preventing even some of the most complex attacks that exist in the security landscape today.

Prisma Access also offers advanced DLP protection to protect access and data integrity to all applications and data-based workloads across a customer organization.

Cortex XSOAR

Cortex XSOAR can automate workflows for data enrichment, IoC hunting and remediation actions to reduce manual work and speed up the patching process.

Cortex XDR and XSIAM

Cortex XDR and XSIAM agent helps protect against the techniques executed by this threat actor using Behavioral Threat Protection and its multiple security modules.

Cortex Analytics has multiple detection models covering the techniques, with additional relevant coverage by the Identity Analytics module.

Cortex Xpanse

Cortex Xpanse is able to detect a wide range of internet-exposed SOHO devices including those manufactured by Cisco, NETGEAR, D-Link, ASUS, H3C, Xiaomi, MikroTik, and more with over 20 different individual rules available.

Cloud-Delivered Security Services for Next-Generation Firewall

Advanced URL Filtering and DNS Security identify known IPs and domains associated with this group as malicious.

Prisma Cloud

All known Insidious Taurus malware samples listed within WildFire will be detectable by Prisma Cloud agents.

Prisma Cloud continuously monitors for malicious traffic. By integrating the threat intelligence data from WildFire, Prisma Cloud agents are able to detect and protect cloud virtual machines, container and serverless runtime environments from the execution of malicious runtime operations originating from our customers' cloud environments.

Additional Resources

Updated May 26, 2023, at 3:27 p.m. PT.

Updated Feb. 14, 2024, at 2:25 p.m. PT.  

Updated Feb. 20, 2024, at 11:27 a.m. PT to add promotional offer.

New Vulnerability in QNAP QTS Firmware: CVE-2023-50358

Posted on by Zhibin Zhang

Executive Summary

This article provides technical analysis on a zero-day vulnerability affecting QNAP Network Attached Storage (NAS) devices. Our Advanced Threat Prevention (ATP) and telemetry systems provided indicators of a previously unknown vulnerability in QNAP QTS and QuTS hero firmware. We provided our findings to the vendor, and QNAP has assigned the tracking ID CVE-2023-50358 to this new vulnerability. We also offer recommendations on how to defend against this newly-revealed threat.

QNAP is an acronym for Quality Network Appliance Provider. This acronym is the name for a company that specializes in various products, including operating systems for NAS devices. One such operating system is the QNAP Turbo NAS System (QTS). This QTS code is often embedded in the firmware of QNAP NAS devices.

Threat actors continuously probe for vulnerabilities in network-connected hosts like NAS devices. When threat actors discover a new vulnerability, they can be quick to exploit it. Unit 42 researchers at Palo Alto Networks constantly monitor our telemetry to reveal these types of attacks.

QNAP has released a new security advisory, with acknowledgment to Palo Alto Networks, that provides guidance and recommended actions on the newly discovered vulnerability. We recommend any affected organizations follow QNAP's guidance to address this new threat by following the mitigation instructions or applying the associated firmware updates.

Palo Alto Networks Advanced Threat Prevention possesses the capability to detect exploitation of unknown vulnerabilities. This functionality is what helped us to discover this zero-day attack.

Palo Alto Networks Next-Generation Firewall customers are better protected through Cloud-Delivered Security Service subscriptions, including Internet of Things (IoT) security and Advanced Threat Prevention, which can detect and block exploit traffic. Cortex Xpanse can also provide customer visibility into externally exposed QNAP devices. If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.

Related Unit 42 Topics IoT, CVE-2023-50358

Vulnerability Overview

The command injection vulnerability exists in the quick.cgi component of QNAP QTS firmware, which can be accessed without authentication.

While setting the HTTP request parameter todo=set_timeinfo, the request handler in quick.cgi saves the value of the parameter SPECIFIC_SERVER into a configuration file /tmp/quick/quick_tmp.conf with the entry name NTP Address, as depicted in Figure 1.

Image 1 is a screenshot of many lines of code. Outlined in red from top to bottom are the lines for Get user input, Saves user input to quick_tmp.conf and the vulnerable function.
Figure 1. Quick.cgi writes user input into the configuration file.

After writing the NTP server address, the component starts time synchronization using the ntpdate utility. The command-line execution is built by reading the NTP Address in quick_tmp.conf, and this string is then executed using system(), as depicted in Figure 2.

Image 2 is a screenshot of two windows of code. Highlighted in red is the code that reads the NTP address from tmp.conf. Highlighted in red is the line of code for the command execution function, displayed in a separate window. It executes through system().
Figure 2. Quick.cgi command execution.

Untrusted data from the SPECIFIC_SERVER parameter is therefore used to build a command line to be executed in the shell resulting in arbitrary command execution, as depicted in Figure 3.

Image 3 is a screenshot of the proof of command-line execution. Some of the information has been redacted.
Figure 3. Proof of command-line execution.

Impact of CVE-2023-50358

Figure 4 represents Xpanse data on vulnerable NAS devices detected from our telemetry during a 1 week period in mid-January 2024. In this timespan, we detected vulnerable devices from 289,665 separate IP addresses. Figure 4 shows a global heat map of the countries most affected by this vulnerability, and it lists the top 18 nations these IP addresses are registered to.

Image 4 is a heat map from Cortex Xpanse of the observed countries affected by the vulnerability. The affected countries are listed on the right, the top five being Germany, the United States, China, Italy and Japan.
Figure 4. Global heatmap and list showing the countries most affected by this vulnerability.

Conclusion

The disclosure timeline is as follows:

  • On Nov. 7, 2023, Unit 42 researchers were alerted of suspicious attack traffic targeted at QNAP devices by the Advanced Threat Prevention platform. Further analysis revealed a new vulnerability related to (but not directly exploited by) the observed traffic.
  • A detailed vulnerability analysis was provided to the vendor on Nov. 21, 2023.
  • The vendor confirmed the vulnerability on Dec. 19, 2023.
  • Vendor has released a security advisory that provides guidance and recommendations.

These remote code execution vulnerabilities affecting IoT devices exhibit a combination of low attack complexity and critical impact, making them an irresistible target for threat actors. As a result, protecting IoT devices against such threats is an urgent task.

To mitigate the vulnerability, QNAP recommends updating to the latest version of QTS or QuTScloud hero (e.g., QTS 5.1.5 or QuTS hero h5.1.5). If updating the operating system to the latest version is not an option, users can perform the following actions to mitigate the vulnerability.

  • Test the following URL in your browser:
    • https://<NAS IP address>:<NAS system port>/cgi-bin/quick/quick.cgi
  • If you get the following response (HTTP 404 error), your system is not vulnerable:
    • "Page not found or the web server is currently unavailable. Please contact the website administrator for help."
  • If you get an empty page (HTTP 200), continue to the next step.
  • Update your operating system to one of the following versions or later:
    • QTS 5.0.0.1986 build 20220324 or later
    • QTS 4.5.4.2012 build 20220419 or later
    • QuTS h5.0.0.1986 build 20220324 or later
    • QuTS h4.5.4.1991 build 20220330 or later
  • Test the above URL again in your browser.
  • If you get the following response (HTTP 404 error), your system is now free from the vulnerability:
    • "Page not found or the web server is currently unavailable. Please contact the website administrator for help."
  • If you get an empty page (HTTP 200), please contact QNAP technical support for assistance.

Palo Alto Networks Protections

Palo Alto Networks customers are better protected against the vulnerabilities and malware discussed in this article through the following products and services:

  • Next-Generation Firewall with a Threat Prevention or Advanced Threat Prevention security subscription can block attacks with Best Practices via Threat Prevention signature 94969.
  • Advanced Threat Prevention has a built-in machine learning-based security detection that can detect exploit traffic inline and in real time.
  • The Palo Alto Networks IoT security platform can leverage network traffic information to identify the vendor, model and firmware version of a device and identify specific devices that are affected by this vulnerability.
  • In addition, IoT Security has an inbuilt machine learning-based anomaly detection that can alert the customer if a device exhibits nontypical behavior, such as the following:
    • The sudden appearance of traffic from a new source
    • An unusually high number of connections
    • An inexplicable surge of certain attributes typically appearing in IoT application payloads
  • Cortex Xpanse can detect QNAP NAS devices exposed to the external internet to give defenders an inventory of all potentially vulnerable devices.

If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team or call:

  • North America Toll-Free: 866.486.4842 (866.4.UNIT42)
  • EMEA: +31.20.299.3130
  • APAC: +65.6983.8730
  • Japan: +81.50.1790.0200

Palo Alto Networks has shared our findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Diving Into Glupteba's UEFI Bootkit

Posted on by Samantha Stallings

Executive Summary

Glupteba is advanced, modular and multipurpose malware that, for over a decade, has mostly been seen in financially driven cybercrime operations. This article describes the infection chain of a new campaign that took place around November 2023.

Despite being active for over a decade, certain capabilities that Glupteba’s authors have added have remained undiscovered or unreported – until now. We will focus on one intriguing and previously undocumented feature: a Unified Extensible Firmware Interface (UEFI) bootkit. This bootkit can intervene and control the OS boot process, enabling Glupteba to hide itself and create a stealthy persistence that can be extremely difficult to detect and remove.

While this threat began as a simple backdoor, it transformed into a potent botnet, emerging as a major player in the realm of cyberthreats. Since its discovery in the early 2010s, Glupteba has evolved significantly and undergone a series of stealthy metamorphoses. This threat is particularly known for its elaborate infection chains that showcase its operators’ continuous developments and their attempts to evade traditional security measures.

Image 1 is a screenshot of the Glupteba infection chain in Cortex XDR and XSIAM programs. It is an extensive tree diagram with 23 branches.
Figure 1. Glupteba infection chain, as shown by Cortex XDR and XSIAM (set to detect-only mode for testing purposes).

Palo Alto Networks customers are better protected from malware discussed in this article through products like Cortex XDR, our Next-Generation Firewall with Cloud-Delivered Security Services that include Advanced WildFire, Advanced Threat Prevention and Advanced URL Filtering. Additionally, Prisma Cloud Cortex XDR Cloud Agents or Prisma Cloud Defender Agents monitor for instances of known Glupteba malware. DNS Security can block malicious domains.

Specifically for UEFI bootkits such as Glupteba’s, the UEFI Protection module released as part of Cortex Agent 8.3 provides detection and prevention capabilities.

 

Related Unit 42 Topics Botnet

A note on acronyms: this article uses multiple acronyms. We’ve listed out terms that are either used together in sequence or may be unfamiliar to analysts of different backgrounds.

Acronym Term
DSE Driver signature enforcement
ESP EFI system partition 
PPI Pay-per-install 
SPI Serial Peripheral Interface
UEFI Unified Extensible Firmware Interface
UPGDSED Universal PatchGuard and Driver Signature Enforcement Disable

Glupteba Overview

Glupteba is built to be modular, which allows it to download and execute additional components or payloads. This modular design makes Glupteba adaptable to different attack scenarios and environments, and it also allows its operators to adapt to different security solutions.

Over the years, malware authors have introduced new modules, allowing the threat to perform a variety of tasks including the following:

  • Delivering additional payloads
  • Stealing credentials from various software
  • Stealing sensitive information, including credit card data
  • Enrolling the infected system in a cryptomining botnet
  • Crypto hijacking and delivering miners
  • Performing digital advertising fraud
  • Stealing Google account information
  • Bypassing UAC and having both rootkit and bootkit components
  • Exploiting routers to gain credentials and remote administrative access

In recent campaigns, threat actors mainly distributed Glupteba through pay-per-install (PPI) services, which allowed the operators of this malware to mass-infect machines all over the world.

About Glupteba’s PPI Ecosystem

The PPI ecosystem is a significant and profitable component of the cybercrime landscape. This model, which initially emerged as a means to distribute advertisements, evolved over the years toward a more nefarious purpose: the dissemination of spyware and malware.

This model facilitates widespread distribution of malicious software, as financially incentivized PPI service providers play a crucial role in disseminating malware. This includes threats ranging from advanced downloaders like PrivateLoader and SmokeLoader to versatile threats like Glupteba, RedLine Stealer, coin miners and even ransomware.

PPI service providers use different platforms to recruit affiliates and sell services. One of the most popular PPI services that spreads PrivateLoader is called Ruzki. Ruzki is operated by the user les0k on Russian hacking forums. Figure 2 shows an account overview of les0k on the Russian hacking forum WWH, also known as WWHClub.

Image 2 is a screenshot of the profile of les0k. An icon of Scrooge McDuck smelling money in his gold vault. Different banners: WWH-CLUB, Verified Seller, Premium member, Enroll Group, Project participant, Bank of Scrooge, AutoGarant. King of Installs. MessagesL 228. Reaction score: 25. Total sell: $43,416. Total purchase: $24,964.
Figure 2. Overview of les0k, “king of installs,” as shown in the Russian hacking forum WWHClub.

To attract malware operators, PPI services sometimes post promotions and offer discounts. Pricing is based on the number of installations requested, and in most cases pricing is also based on region.

Figure 3 shows an example where a PPI service provider is requesting $70 USD for 1,000 installations worldwide, excluding Europe and the U.S. One thousand installations in Europe costs $500, and the same number of installations in the U.S. will cost the operator $1,200.

Image 3 is a screenshot of pricing for a PPI service from a Telegram chat. The chat has 39 subscribers and a pinned message. The language is in both English and Cyrillic characters.
Figure 3. Price model for PPI service, as shown in a Telegram message uploaded to WWHClub.

2023 Campaign

Since December 2022, Glupteba has sprung back into action, infecting devices worldwide after its operation was disrupted by Google in December 2021. The activity continued into 2023, when the Glupteba botnet reemerged in a new, ongoing and widespread campaign affecting multiple regions and industries. Organizations hit by this campaign were based in countries including Greece, Nepal, Bangladesh, Brazil, Korea, Algeria, Ukraine, Slovakia, Turkey, Italy and Sweden.

Similar to other recent campaigns, threat actors often spread Glupteba through web-based distribution and large-scale phishing attacks using bundled software installation files and cracks, as shown in Figure 4. This strategy has led to multiple malware infections.

Image 4 is a row of icons of malicious installers paired with blue and yellow shields. There are .exe file names under each.
Figure 4. Icons for malicious installer files spreading Glupteba in 2023.

The campaign has multiple stages, as shown in Figure 5. The first stage of an attack lures a user into downloading malicious ZIP files of fake installation files impersonating different software. Once the user downloads the ZIP file and attempts to install the software, the infection chain begins.

Image 5 is a tree diagram of a malware infection that starts with a ZIP file, distributes different loaders such as PrivateLoader, SmokeLoader and RedLine Stealer among others, and distributes Glupteba at branches 3 and 4. Finally there are icons for XMRig Miner and STOP ransomware.
Figure 5. Malware infection graph for a 2023 campaign that includes Glupteba.

Threat actors often distribute Glupteba as part of a complex infection chain spreading several malware families at the same time. This infection chain often starts with a PrivateLoader or SmokeLoader infection that loads other malware families, then loads Glupteba.

For example, Figure 5 above shows a 2023 infection chain that starts with PrivateLoader, which led to SmokeLoader, which then led to a variety of other malware including two Glupteba samples.

The infection chain shown in Figure 5 is one of many similar chains we discovered in 2023. Our analysis of these recent campaigns revealed Glupteba’s use of an undocumented UEFI bootkit.

Exploring Glupteba's Undocumented UEFI Bootkit

Before discussing Glupteba’s implementation of the UEFI bootkit, first is a short introduction to UEFI bootkits and their complexity.

UEFI Bootkit Introduction

UEFI is a specification that defines the architecture of the platform firmware used for booting the computer hardware and its interface for interaction with the operating system.

Figure 6 reveals the different stages of the boot process in a UEFI system.

Image 6 is a diagram of the UEFI boot process. From left to right: Security, Pre-EFI initialization, Driver Execution environment, Boot Dev Select, transient system load, run time, and after life. There are multiple steps in each of these sections.
Figure 6. The UEFI boot process. Source: Brian Richardson on GitHub.

In the stages before boot device selection in Figure 6, the system’s firmware is loaded from a Serial Peripheral Interface (SPI) flash memory. Then the EFI system partition (ESP), located in the boot device and containing the Windows Boot Manager, is loaded as the host boots into Windows.

A malware implant in the ESP is enough to execute code before Windows starts, where it can easily disrupt various security mechanisms. Another possibility is an implant in the SPI flash memory that executes code at earlier stages of the boot process, enabling even greater power and flexibility. However, malware using a firmware implant in flash memory requires higher privileges than using an ESP implant. This is more complex.

As of 2023, only a handful of UEFI bootkits have been publicly reported in the wild, such as LoJax (a firmware implant) and BlackLotus (an ESP implant).

Uncovering Glupteba’s Bootkit Installer

We start our analysis with a bootkit installer binary disguised as a legitimate Windows binary (csrss.exe). When analyzing this installer, a clear lack of strings and functions indicates the file is packed in some way. This means we have some work to do before we can analyze the actual logic of the installer.

After examining the installer with a dissembler, the main function appears to eventually jump into an address stored in dword_2FA3A2C as shown below in Figure 7.

Image 7 is a screenshot of the WinMain function in the first line of the code.
Figure 7. The WinMain function in csrss.exe.

Another function, dword_2FA3A2C, is assigned newly allocated heap memory and then set with PAGE_EXECUTE_READWRITE permissions (see Figure 8). Finally, this heap memory is filled with some data, which is at least partially executable.

Image 8 is a screenshot of many lines of code. The function dword_2FA3A2C is in multiple lines.
Figure 8. Initialization of RWX heap memory in csrss.exe.

Further unpacking takes place after jumping to this code, eventually allocating another RWX memory and jumping to it, as shown in Figure 9.

Image 9 is a screenshot of many lines of code.
Figure 9. Allocation of a second RWX memory in csrss.exe.

This memory area contains unpacked resources, including the PE file with the main installer logic. All other resources that are not related to the UEFI bootkit are out of scope here.

The installer has a function main_writeEfiGuard that writes files in the ESP as seen in Figure 10.

Image 10 is a screenshot of the installer writing files in the ESP. These are highlighted in six red boxes.
Figure 10. The installer writes files in the ESP in the main_writeEfiGuard function.

Summary of the operation of this function:

  1. The main_mountEFI function mounts the ESP into the B: drive
  2. B:\EFI\Microsoft\Boot\bootmgfw.efi is renamed to B:\EFI\Microsoft\Boot\fw.efi
  3. B:\EFI\Boot\bootx64.efi is renamed to B:\EFI\Boot\old.efi
  4. The asset embedded\bootmgfw.efi is written to B:\EFI\Microsoft\Boot\bootmgfw.efi and to B:\EFI\Boot\bootx64.efi
  5. The asset embedded \EfiGuardDxe.efi is written to B:\EFI\Boot\EfiGuardDxe.efi

These actions can be viewed as Cortex XDR events – see Figure 11.

Image 11 is a screenshot of Cortex XDR events. The columns are Action Type, File Name, File Previous Name. There are seven rows in total.
Figure 11. Cortex XDR events of file writes into the ESP.

The name of the function (main_writeEfiGuard) and the name of one of the dropped files (EfiGuardDxe.efi) immediately point us in the direction of EfiGuard.

EfiGuard

EfiGuard is an open-source and portable UEFI bootkit that patches the Windows kernel by executing a UEFI driver (EfiGuardDxe.efi) to disable PatchGuard and driver signature enforcement (DSE). Figure 12 depicts the architecture of EfiGuard.

Image 12 is the architecture for EfiGuard. There are 14 total parts in the structure.
Figure 12. EfiGuard architecture. Source: Mattiwatti on GitHub.

As documented in the GitHub project, EfiGuardDxe.efi can be executed either by installing it in a UEFI driver entry or booting a custom loader (Loader.efi) that loads the driver and then continues to load Windows. Glupteba uses the latter method.

In either case, the driver hooks the EFI Boot Service LoadImage function, which intercepts the loading of the Windows Boot Manager (bootmgfw.efi), starting a chain of patches that eventually patch the kernel (ntoskrnl.exe) as depicted in Figure 13.

Image 13 is a screenshot of EfiGuard’s patch chain. EfiGuardDxe.efi. LoadImge hook. Patch. Bootmgfw,efi, ImgArchStartBootApplication. Patch. Winload.efi. OslFwpKernelSetupPhase1. Patch. Ntoskml.exe. PatchGuard.
Figure 13. EfiGuard’s chain of patches.

The project supports two methods for disabling DSE. The first occurs at boot time, immediately after disabling PatchGuard. The second involves leaving a UEFI backdoor through a hook on the EFI Runtime Service SetVariable that allows user-mode code to read and write arbitrary kernel-space memory. The backdoor is complemented with a user-mode program (EfiDSEFix.exe) that utilizes the kernel read/write backdoor to patch DSE.

EfiGuard in Glupteba

Using Bindiff for a similarity analysis of the two files Glupteba writes in the ESP quickly indicates they are a recompilation of the EfiGuardDxe.efi and Loader.efi components in EfiGuard, as shown below in Figures 14 and 15. Some code, such as logs, was removed from EfiGuard.

Image 14 is a screenshot of the BinDiff program output of the EfiGuardDxe.efi. It has five pie charts: Functions, Calls, Basic Blocks, Jumps and Instruction. There is a column graph of similarities.
Figure 14. BinDiff of 01e86a4dfe6e0de7857b3cf2fafd041c[...] and EfiGuardDxe.efi v1.1.1.
Image 15 is a screenshot of the BinDiff program output comparing two files. The column are Similarity, Confidence, Address, Primary Name, Type, Address, Secondary Name and Type.
Figure 15. BinDiff of 9fdb7c1359f3f2f7279f1df4bde648c0[...] and Loader.efi v1.1.1 (matched functions).

Glupteba replaces the Windows Boot Manager (bootmgfw.efi) with Loader.efi. The Loader.efi file loads the EfiGuardDxe.efi driver and then continues to load Windows.

It appears the threat author has manually modified and recompiled the driver code to use the boot time method to disable PatchGuard and DSE, as shown in Figure 16 below. Note that the driver configuration for the bypass method, stored in gDriverConfig, is set to DSE_DISABLE_AT_BOOT – see Figure 17. However, the author actually removed the code paths that check this configuration in our sample.

Image 16 is a screenshot of multiple lines of code where the function PatchNtoskrnl is modified.
Figure 16. Modified PatchNtoskrnl function in 01e86a4dfe6e0de7857b3cf2fafd041c[...].
Image 17 is a screenshot of the driver configuration in a Glupteba sample.
Figure 17. Driver configuration in 01e86a4dfe6e0de7857b3cf2fafd041c[...].

Summary of DSE Bypasses in Glupteba

As documented in a previous analysis by Sophos, Glupteba formerly used Windows kernel drivers to hide itself. To successfully load these drivers, Glupteba used DSEFix or Universal PatchGuard and Driver Signature Enforcement Disable (UPGDSED).

DSEFix drops a known vulnerable driver and exploits it to disable DSE in kernel memory. UPGDSED runs in user-mode and patches the Windows kernel and Windows Boot Loader binaries for the same purpose.

Our current samples reveal that Glupteba has added EfiGuard to its arsenal of tools that are capable of disabling DSE.

In the installer, the function main_installDriver calls the previous function we analyzed (main_writeEfiGuard), which writes the files in the ESP. We give a high-level overview of the logic in this function in Figure 18 below, by grouping its nodes in IDA.

Image 18 is a diagram of the nodes in the main_installDriver function.
Figure 18. High-level grouping of the nodes in the main_installDriver function.

As revealed in Figure 18, any one of the three DSE bypasses we have mentioned (DSEFix, UPGDSED or EfiGuard) might be used, depending on the architecture, OS version and configuration. Unlike the BlackLotus ESP implant, we have not seen any evidence for Glupteba bypassing Secure Boot.

Conclusion

In the ever-evolving threat landscape, Glupteba malware continues to stand out as a notable example of the complexity and adaptability exhibited by modern cybercriminals.

The identification of an undocumented UEFI bypass technique within Glupteba underscores this malware's capacity for innovation and evasion. This novel method not only poses a significant challenge for detection but also highlights the pressing need for cybersecurity professionals to continually enhance their defenses and stay ahead of emerging threats.

Furthermore, with its role in distributing Glupteba, the PPI ecosystem highlights the collaboration and monetization strategies employed by cybercriminals in their attempts at mass infections. This model indicates that threat actors leverage underground economies to proliferate malware, and it emphasizes the importance of holistic cybersecurity strategies and multilayer security solutions that extend beyond traditional defenses.

Protections and Mitigations

Cortex XDR and XSIAM raised many alerts for the malicious activities observed in the 2023 campaign distributing Glupteba and other malware. Prevention and detection alerts revealed the different stages and different malware involved.

SmartScore, our unique ML-driven scoring engine that translates security investigation methods and their associated data into a hybrid scoring system, scored this incident an 86 out of 100, as shown below in Figure 19. This type of scoring helps analysts determine which incidents are more urgent and provides context about the reason for the assessment, assisting with prioritization.

Image 19 is a screenshot of the SmartScore incident information totaling in a score o 86 and listing the reasons and insights for why the score was given.
Figure 19. SmartScore information about the incident.

For Palo Alto Networks customers, our products and services provide the following coverage associated with this group:

  • The Advanced WildFire machine-learning models and analysis techniques have been reviewed and updated in light of the IoCs shared in this research.
  • Next-Generation Firewall with Cloud-Delivered Security Services including Advanced URL Filtering, Advanced Threat Prevention and DNS Security identify domains associated with this group as malicious.
  • Prisma Cloud: Any cloud infrastructure running Windows virtual machines should monitor their Windows-based VMs using Cortex XDR Cloud Agents or Prisma Cloud Defender Agents. Both agents will monitor the Windows VM instances for known Glupteba malware, using signatures pulled from Palo Alto Networks Wildfire.
  • Cortex XDR
    • Prevents the execution of known malicious malware, and also prevents the execution of unknown malware using Behavioral Threat Protection and machine learning based on the Local Analysis module.
    • Protects against credential gathering tools and techniques using the new Credential Gathering Protection available from Cortex XDR 3.4.
    • Protects from threat actors dropping and executing commands from web shells using Anti-Webshell Protection, newly released in Cortex XDR 3.4.
    • Protects against exploitation of different vulnerabilities including ProxyShell and ProxyLogon using the Anti-Exploitation modules as well as Behavioral Threat Protection.
    • Cortex XDR Pro detects post-exploit activity, including credential-based attacks, with behavioral analytics.
    • The UEFI Protection module detects and prevents advanced threats that target UEFI. In the case of Glupteba, Figure 20 shows the module blocking the malicious modifications made to the ESP.
Image 20 is a screenshot of Cortex XDR and XSIAM blocking Glupteba.
Figure 20. Glupteba’s UEFI bypass prevention, as shown in Cortex XDR and XSIAM.

If you think you might have been impacted or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

  • North America Toll-Free: 866.486.4842 (866.4.UNIT42)
  • EMEA: +31.20.299.3130
  • APAC: +65.6983.8730
  • Japan: +81.50.1790.0200

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Indicators of Compromise

Glupteba Binaries From the 2023 Campaign

  • cfc7111da7b09e7a93b93ce690f2a4d922cc1009fea8368300f06c6fa4f85472
  • 17e4590eceb4fec1e08c29b206d424172753d8472395f37d0647249ceff25817
  • 61ab0e1ddaae4704999c4781deea56e1df5b05489bf4c0b892c47b36a63de9f4
  • b6604ae49298c59e148b1e741ef8821ffd60c775bfb9c3234783452c54cd3069
  • 8e380777da39ad7a588f4d9b703adc18b4ba935c21b17f215a3da5792672f205
  • e4a2b53965b9d203d13dd4b5962b9f07270bb87e5738f44cf1126ce36019427d
  • c353fb081ae8e121c4dcea3ad1bc4061315728a6f0d0ac63885a4f074be5fef3
  • df75b62e373e0b91f26384b21aaa8e4dc86c13078cec7e32ad595d0c86d3fedb
  • 5851e0b4a79208b995ab5a7e1f5247c159aac31c7c166a4bef77be14af64c1e8
  • 6263a6ceb172eed7bae158d8066f70cabc42b352129547e1b5ad0c1096319d30
  • 9c44bf6c3538c93c95342f5c365de46b6494a5a5764870048df7478a9d0f8723
  • b84adf0716facf50418f5f228cf095e5157b6be3f04a98f26ce833057e804a4f
  • a000684c9fcd2d5a528161a3513f726b2307fa6b50788a568fec0930b452d59e
  • c867c3bda7b6f6bd228a4d7656c069bd6cf4f67ba4b075cf4113f5b109e7d9ee
  • 8a62d01c1f321c4adb8428771af3eae1c83fec8a0e0a047b0bc17a51d19c7c96

2023 Campaign ZIP Files

  • cb347e06d97fde4c7f8dd77be59b8f57d47f6e3f998d708d21a5963bc1620835
  • 46eb8b98738df13a3a8c923228ca82006c7d403c7a1aac2d6bc752023b432915
  • aa3257efb3182a98f73ad413b34f68067f42c3c51b68d15abea5db01173afad8
  • 75bb73decf9fd21643b834a0b3e21e8e0d33910e51efbe56a2162f1180d04802
  • 18c6e5a916eea979ea52495309e4e643232832bea614688df4cec0e3123b09d0
  • fdd2fbe16f96f6d2b027347fd35c2e105a483a55b43f094754c2b3374ffb051a
  • 9691b5846e230e0ea87b3f8a7a6dc31daae701ca0bb83e6c7df0f683bdea01e6
  • 9c6af24c519d02203bfbdf568f7beb144996af9676b290a96a728ba9314b1c66
  • bb809863b3145ceef7fc12ae5bca3940f18c4a24f5b4652e7b4cea6847762887
  • 3a1cffaaa68dc4b5f0f94a1ec14b008444074a3faefa4beba20c857a21539bc1
  • d0d58229650ff9bf3bbf8edb55c7058a2f243e900473e0ff8849c517c2f165bd
  • c4f45bdfecb3d8cb4dcfdc8f323cf5d15321d161ac92802aa1e77dfa94fd91ed
  • 84575070117b8896bafbd6f5dc364db09bea8e742f4af84884d15cab5e811060

EfiGuard Binaries Used by Glupteba

  • 9fdb7c1359f3f2f7279f1df4bde648c080231ed21a22906e908ef3f91f0d00ee
  • 01e86a4dfe6e0de7857b3cf2fafd041c8b3a3241e00844cb6bfbd3bfae2d36bc

2023 Campaign Infrastructure

  • weareelight[.]com
  • onualituyrs[.]org
  • snukerukeutit[.]org
  • stualialuyastrelia[.]net
  • sumagulituyo[.]org
  • criogetikfenbut[.]org
  • dpav[.]cc
  • humydrole[.]com
  • kggcp[.]com
  • kumbuyartyty[.]net
  • lightseinsteniki[.]org
  • liuliuoumumy[.]org

Location of Program Database (PDB) File From Glupteba in 2023

  • C:\juro\yologakib\rihahoy71\waxotobub.pdb

Additional Resources

Ransomware Retrospective 2024: Unit 42 Leak Site Analysis

Posted on by Doel Santos

Executive Summary

The ransomware landscape experienced significant transformations and challenges in 2023. The year saw a 49% increase in victims reported by ransomware leak sites, with a total of 3,998 posts from various ransomware groups.

What drove this surge of activity? 2023 saw high-profile vulnerabilities like SQL injection for MOVEit and GoAnywhere MFT services. Zero-day exploits for these vulnerabilities drove spikes in ransomware infections by groups like CL0P, LockBit and ALPHV (BlackCat) before defenders could update the vulnerable software.

Leak site data reveals at least 25 new ransomware groups emerged in 2023, indicating the continued attraction of ransomware as a profitable criminal activity. Despite the appearance of new groups such as Darkrace, CryptNet and U-Bomb, many of these new ransomware threat actors did not last and disappeared during the second half of the year.

2023 was an active year for international law enforcement agencies as they intensified their focus on ransomware. This focus led to the decline of groups like Hive and Ragnar Locker, and the near-collapse of ALPHV (BlackCat). Law enforcement actions in 2023 reflect the increasing challenges faced by ransomware groups.

Ransomware threat actors targeted a wide range of victims with no preference for specific industries.

Leak site data collected by Unit 42 indicates that manufacturing was the most affected industry in 2023, signaling significant vulnerabilities in this sector. Although organizations from at least 120 different countries have been impacted by ransomware extortion, the U.S. stood out as the primary target of ransomware. 47% of ransomware leak site posts in 2023 revealed victim organizations based in the U.S.

Palo Alto Networks customers are better protected from the threats discussed in this article through our Next-Generation Firewall with Cloud-Delivered Security Services, including Advanced WildFire, DNS Security, Advanced Threat Prevention and Advanced URL Filtering.

Cortex Xpanse can be used to detect vulnerable services. Cortex XDR and XSIAM customers have been protected from all known active ransomware attacks of 2023 out of the box, without additional protections having to be added to the system. The Anti-Ransomware Module helps prevent encryption behavior, local analysis helps prevent the execution of ransomware binaries, and Behavioral Threat Protection helps prevent ransomware activity. Prisma Cloud Defender Agents can monitor Windows VM instances for known malware.

If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.

Related Unit 42 Topics Ransomware
Ransomware Groups Discussed ALPHV, Akira, CL0P, Hive, LockBit 3.0, Play, Ransomed, Royal, ThreeAM, Trigona, Vice Society

Leak Sites and Our Dataset

Analysis for this article is based on data from ransomware leak sites, sometimes known as dedicated leak sites and abbreviated as DLS.

Ransomware leak sites first appeared in 2019, when Maze ransomware began using a double extortion tactic. Stealing a victim’s files before encrypting them, Maze was the first known ransomware group to establish a leak site to coerce a victim and release stolen data.

These threat actors pressure victims to pay – not only to decrypt their files, but to prevent the attackers from publicly exposing their sensitive data. Since 2019, ransomware groups have increasingly adopted leak sites as part of their operations.

Our team monitors data from these sites, often accessible through the dark web, and we review this data to identify trends. Since leak sites are now commonplace among most ransomware groups, researchers often use this data to determine overall levels of ransomware activity and pinpoint the date a specific ransomware group was first active.

However, defenders should use leak site data with caution because it might not always reflect actuality. A ransomware group might start without a leak site as it builds its infrastructure and expands operations. Furthermore, if a victim offers immediate payment, the ransomware incident might not appear on a group’s leak site. As a result, leak sites do not always provide a clear or accurate picture of a ransomware group's activities. The true scope of ransomware's impact might be different from what these sites suggest.

Despite these drawbacks, data pulled from ransomware leak sites provides valuable insight on the state of ransomware operations in 2023.

Key Findings

The dataset we have compiled reveals the rise and fall of ransomware groups in 2023, along with affected industries and geographical distribution of attacks. Most importantly, the volume of ransomware activity reflects the large-scale impact of zero-day exploits targeting critical vulnerabilities.

Critical Vulnerabilities

In 2023, we observed 3,998 posts from ransomware leak sites, compared to 2,679 posts in 2022. This marks approximately a 49% increase for the year as illustrated below in Figure 1.

Image 1 is a column graph comparing ransomware leak site reports from 2022 to 2023. There were 2,679 instances in 2022. There were 3,998 in 2023.
Figure 1. Comparison of ransomware leak site posts in 2022 and 2023.

The increase in activity can likely be attributed to zero-day exploits targeting critical vulnerabilities such as CVE-2023-0669 for GoAnywhere MFT or CVE-2023-34362, CVE-2023-35036 and CVE-2023-35708 for MOVEit Transfer SQL Injection.

CL0P has taken credit for exploiting the MOVEit transfer vulnerability. In June 2023, the U.S. Cybersecurity and Infrastructure Agency (CISA) estimated TA505, a group known for leveraging CL0P ransomware, has compromised more than 3,000 US-based organizations and approximately 8,000 victims globally. The scale of these attacks forced vulnerable organizations to shorten their response times so they could effectively counter the threat. However, the sheer volume of data from compromised websites also forced ransomware groups to adapt.

For example, the CL0P ransomware group updated its extortion tactics in 2023. By midyear, CL0P was leveraging torrents to distribute stolen data – a quicker and more efficient method than hosting stolen data on the group’s Tor website. We previously reported this activity in September 2023, and our article provides notable insight on recent CL0P ransomware operations.

CL0P was not the only group exploiting critical vulnerabilities. Ransomware groups like LockBit, Medusa, ALPHV (BlackCat) and others leveraged a zero-day exploit for the Citrix Bleed vulnerability CVE-2023-4966, which led to numerous compromises by these groups in November 2023.

When reviewing the number of compromises reported by ransomware leak sites in 2023 on a month-by-month basis, we find increased compromises during certain months as shown below in Figure 2. These increases loosely align with the dates ransomware groups began exploiting specific vulnerabilities.

Image 2 is a bar graph comparing monthly counts of leak site posts by ransomware groups in 2023. Included are specific vulnerabilities. These include GoAnywhere, PaperCut CVE-2023-27350, MOVEit and Citrix Bleed.
Figure 2. Bar graph showing monthly count of ransomware leak site reports in 2023.

Not all ransomware threat actors are capable of leveraging zero-day vulnerabilities. Some ransomware groups are run by inexperienced threat actors who will leverage anything at their disposal.

For example, an unknown ransomware group targeted VMware ESXi environments during a campaign nicknamed ESXiArgs. This campaign exploited CVE-2021-21974, a vulnerability already two years old at the time of the attacks.

According to CISA, ESXiArgs impacted over 3,800 servers. These types of campaigns are usually not posted on ransomware leak sites because the threat actors are interested in a quick payout instead of extorting victims for maximum impact or selling their data. Even though these groups use older exploits, their campaigns can have as much impact as efforts by more experienced ransomware threat actors.

But experienced or not, ransomware threat actors have come and gone in the evolving threat landscape. Let's review the new ransomware threat actors seen in 2023.

Newcomers in 2023

Due to high payouts by victims in recent years, cybercriminals are often enticed by the idea of ransomware as a source of revenue. As these criminals form new ransomware groups, not every attempt is successful or sustainable.

A new ransomware group must consider several challenges not applicable to other malware, such as communicating with victims and increased operational security. The public nature of ransomware operations increases their risk of detection by law enforcement agencies, security vendors and other defenders.

Ransomware groups must also consider their competition. Profit sharing, software capabilities and affiliate support can significantly impact a new group's standing in the highly competitive criminal market for ransomware.

Despite these challenges, the data reveals 25 new leak sites in 2023. These groups have at least launched a ransomware-as-a-service (RaaS) offering, hoping to become a contender in the ransomware marketplace. The names of these threat groups are shown below in Table 1.

8Base Cyclops RA Group
Abyss DarkRace Rancoz
Akira Hunters International Ransomed.Vc
BlackSuit INC Rhysida
Cactus Knight ThreeAM
CiphBit LostTrust (MetaEncryptor) Trigona
Cloak NoEscape U-Bomb
CrossLock Meow
CryptNet Money Message

Table 1. Names of 25 new leak sites for ransomware that appeared in 2023.

Of note, at least three of these sites were reported as first active sometime in 2022. But we consider these ransomware families as new in our analysis for two reasons. First, even if analysis indicates these ransomware families started operations sometime in 2022, they were all first publicly reported in 2023. Second, leak sites are necessary to become a notable player in today’s criminal ransomware market.

The three ransomware families that reportedly started in 2022 with newly established leak sites in 2023 are:

The new groups reflected by leak site data reveal a competitive criminal market for ransomware. Of the 25 groups with newly established leak sites in 2023, at least five had no new posts in the second half of 2023, indicating these groups might have shut down. Table 2 shows a list of these new ransomware leak sites that might have shut down before the end of 2023.

Group Date of Last Leak Site Post
U-Bomb March 20, 2023
CryptNet April 15, 2023
CrossLock May 2, 2023
Rancoz May 2, 2023
DarkRace June 8, 2023

Table 2. Last known date of leak site posts from five new ransomware groups in 2023.

A lack of leak site posts does not necessarily mean these groups have ceased operations. Criminals from these groups could have moved to other types of operations, retreated from public view or merged with other ransomware groups.

If some of these groups did not last the entire year, new threat actors can fill the void. The second half of 2023 revealed posts from 12 new leak sites, indicating these groups might have started later in the year, as indicated below in Table 3.

Group Date of First Leak Site Post
BlackSuit June 18, 2023
Cyclops July 4, 2023
Cactus July 17, 2023
INC Aug. 8, 2023
ThreeAM Aug. 14, 2023
LostTrust (MetaEncryptor) Aug. 16, 2023
Cloak Aug. 23, 2023
Ransomed.Vc Aug. 24, 2023
Meow Sept. 4, 2023
Knight Sept. 11, 2023
CiphBit Sept. 15, 2023
Hunters International Oct. 19, 2023

Table 3. First date of leak site posts from 12 ransomware groups in 2023.

These 25 new leak sites contributed to approximately 25% of the total ransomware posts from 2023. Of these new groups, Akira led with the most posts as illustrated in Figure 3.

First observed in March 2023, Akira has been described as a fast-growing ransomware group, and researchers have linked this group to Conti through cryptocurrency transactions associated with the Conti leadership team.

Second place in the number of leak site posts in 2023 is 8Base ransomware. 8Base is one of the ransomware groups active since 2022, but this group started publicly disclosing its victims in May 2023.

Image 3 is a column chart of post count of new 2023 ransomware leak sites. The top three posts are from Akira, 8Base, NoEscape.
Figure 3. Posts from leak sites established in 2023.

Goners in 2023

2023 saw the downfall of several prominent ransomware groups. Reasons include overexposure and aggressive tactics, which attracted the attention of law enforcement agencies and cybersecurity organizations. These ransomware groups were under a spotlight that led to increased pressure and operational challenges.

The crucial role played by international law enforcement agencies in 2023 cannot be overstated. Their increased collaborative efforts led to major successes in disrupting ransomware operations.

These actions include providing decryption keys to victims, seizing infrastructure and arresting key threat actors. Law enforcement efforts destabilized notable ransomware groups and prevented them from earning as much money. The results forced affiliates to abandon these groups and seek more profitable alternatives.

Let's review some of the notable ransomware operations that appear to have ceased activity in 2023.

Hive

One of the most prolific groups in 2022, Hive ransomware was shut down as part of a law enforcement-led operation reported in January 2023. This operation captured the group's decryption keys and offered them to victims worldwide, saving victims over $130 million in potential ransom payments.

The FBI seized Hive ransomware's main site as shown below in Figure 4. Hive affiliates scattered, and this group disappeared for the remainder of 2023.

Image 4 is a screenshot of the Tor site for Hive ransomware after it had been seized by the FBI. This hidden site has been seized. Hive logo and name. The Federal Bureau Of Investigation seized this site as part of a coordinated law enforcement action taken against Hive Ransomware. There are six logos of law enforcement agencies from around the world and multiple flags of countries.
Figure 4. Screenshot of Tor site for Hive ransomware seized by the FBI. Source: SecurityWeek.

Ragnar Locker

Ragnar Locker also felt the wrath of international law enforcement agencies. This group originally started in 2019 and had been very active since then.

In October 2023, Europol reported a coordinated international law enforcement effort that seized Ragnar Locker infrastructure, and the main perpetrator was subsequently presented to the Paris Judicial Court. Figure 5 shows a screenshot of Rangar Locker's Tor site in 2023 shortly after it was taken over by law enforcement.

Image 5 is a screenshot of the Tor site for Ragnar Locker after its seizure by law enforcement. This service has been seized as part of a coordinated international law enforcement action against the RagnarLocker group. There are many logos of law enforcement agencies from around the world.
Figure 5. Screenshot of Tor site for Ragnar Locker seized by law enforcement. Source: Europol.

Ransomed.Vc

Ransomed.Vc started operations in August 2023 and brought attention to itself by claiming responsibility for a compromise of Sony in September. Also known simply as Ransomed, this group ceased operations and put its available infrastructure up for auction near the end of October, making its success very short-lived.

The shutdown likely occurred due to law enforcement intervention. The following month, six individuals affiliated with this group were allegedly arrested.

Trigona

Trigona was another noteworthy ransomware departure in 2023. First spotted in 2022, Trigona was taken down not from law enforcement action, but from the efforts of pro-Ukrainian hacktivists.

A hacktivist group that calls itself the Ukrainian Cyber Alliance took advantage of a Critical vulnerability in Confluence and used a zero-day exploit to access Trigona's infrastructure. The hacktivist group erased all of Trigona's data, an action that ultimately led to the ransomware group's demise.

Below, Figure 6 shows a screenshot of Trigona's Tor site after it was defaced by the Ukrainian Cyber Alliance.

Image 6 is a screenshot of Trigona’s Tor site after it had been defaced by the Ukrainian Cyber Alliance. Picture of owl made out of circuits. Trigona is gone! The servers of the Trigona ransomware gang has been exfiltrated and wiped out. Welcome to the world you created for others. Hacked by Ukrainian Cyber Alliance. Disrupting Russian criminal enterprises (both public and private) since 2014.
Figure 6. Screenshot of Trigona’s Tor site defaced by the Ukrainian Cyber Alliance. Source: @vx_herm1t on X (Twitter).

ALPHV (BlackCat): Almost a Goner

Also known as BlackCat, the ALPHV group was hit hard during 2023. In December, the FBI disrupted ALPHV (BlackCat) operations and released a decryption tool that allowed compromised victims to recover their data. This was a huge setback for ALPHV, and it offered incentives to keep its criminal affiliates from being spooked by the FBI. Meanwhile, other ransomware groups like LockBit began poaching ALPHV affiliates.

The ALPHV group has since responded to the FBI disruption and fought back against law enforcement action. But if this group cannot fix its reputation, it could shut down and rebrand as a new ransomware gang.

Possible Rebrands

2023 also saw the sudden disappearance of Royal ransomware and Vice Society. Both were active in 2022 through the first half of 2023 performing multi-extortion strategies, and both have attracted the attention of law enforcement.

Royal ransomware was created by former members of Conti, and it has been involved in multiple high-profile attacks against critical infrastructure. The Royal leak site ceased operations sometime in July 2023. Various sources have reported similarities in code between Royal and the newly established BlackSuit ransomware, indicating a possible rebranding from Royal to BlackSuit.

Vice Society attracted the attention of the public and law enforcement by targeting organizations in healthcare and education. This group stopped posting on its leak site in June 2023, but Vice Society might not have completely vanished. Multiple researchers have linked Vice Society to the newly established Rhysida ransomware, suggesting a rebrand.

One of the new ransomware groups in 2023 appears to have been rebranded during the same year. Leak site data indicates Cyclops ransomware was active in July 2023, but a version 2.0 update of Cyclops was rebranded as Knight ransomware. Cyclops had no more leak site posts after July 2023, while Knight’s leak site posts started later that year in September.

Leak Site Statistics for 2023

Analyzing leak site data provides key insight into the ransomware threat. We reviewed 3,998 leak site posts from 2023, and this data suggests the most active groups, the most affected industries and areas of the world that have been hit hardest by ransomware.

Group Distribution

Of the 3,998 leak site posts from 2023, LockBit ransomware remains the most active, with 928 organizations accounting for 23% of the total.

Operating since 2019 with minimal breaks, LockBit has been the most prolific ransomware group for two years in a row now. With the downfall of groups like Conti, Hive and Ragnar Locker, LockBit has become the ransomware of choice for many threat actors who have subsequently become its affiliates.

LockBit has launched multiple variants that affect both Linux and Windows operating systems. By repurposing freely available software tools and taking advantage of LockBit’s fast encryption, affiliates can tailor ransomware operations to meet their individual needs.

Second place in leak posts was ALPHV (BlackCat) ransomware, with roughly 9.7% of the total leak site posts in 2023. Third place was CL0P ransomware, with approximately 9.1% of 2023’s posts.

CL0P is notorious for utilizing zero-day exploits of critical vulnerabilities like those for Progress Software's MOVEit and Fortra’s GoAnywhere MFT. However, the number of organizations reported by CL0P on the group's leak site might not accurately reflect the full impact of these vulnerabilities.

For example, CL0P's leak site data indicates it had compromised 364 organizations during the year, but a report analyzing CL0P's exploitation of the MOVEit vulnerability in 2023 states 2,730 organizations were affected. This is a prime example of the disparities we often find between leak site data and real-world impact.

Figure 7 illustrates the leak site post count from different ransomware families in 2023.

Image 7 is a column chart of post count of all 2023 ransomware leak site posts by group. The top three posts are from LockBit 3.0, ALPHV, Cl0p. LockBit is significantly higher than the rest.
Figure 7. Leak site posts in 2023 sorted by ransomware group.

Monthly and Weekly Averages

The 3,998 ransomware posts we reviewed mean ransomware groups generated an average of 333 posts per month in 2023. This annual number also equates to an average of almost 77 posts each week. The numbers for 2023 show a growth in ransomware activity compared to 2022.

2022 saw a total of 2,679 leak site posts with an average of 223 each month and an average of 52 each week. The annual total marks a 49% increase of ransomware leak site posts in 2023 compared to the previous year.

The number of leak site reports in 2023 was highest in July, with 495 posts. CL0P had the most posts that month, probably due to its large-scale exploitation of the MOVEit vulnerability.

According to the leak site post count, January and February were the least active months for ransomware in 2023. A line graph illustrating the occurrence of leak site posts throughout the year is shown in Figure 8.

Image 8 is a chart of leak site post counts by month through all of 2023. The highest amount is over 70 in August.
Figure 8. Ransomware leak site post distribution through 2023.

Affected Industries

Some ransomware groups might focus on specific countries or industries, but most are opportunistic and primarily concerned with making a profit. As a result, many ransomware groups compromise organizations across multiple industries.

Leak site posts in 2023 reveal the manufacturing industry was most impacted by ransomware, with 14% of the total posts as shown below in Figure 9.

Image 9 is a column chart of industries affected in 2023 by ransomware leak site posts. The top three industries are manufacturing, professional and legal services and high technology.
Figure 9. Leak site post distribution by industry in 2023.

Why was manufacturing hit the most by ransomware? Manufacturers usually have limited visibility into their operational technology (OT) systems, often lack adequate network monitoring and occasionally fail to implement best security practices.

Geographic Impact

Leak site data reveals most victims in 2023 were based in the U.S., with 47.6% of the total posts. The U.K. was second at 6.5%, then Canada at 4.6% and Germany at 4%. See Figure 10 for a pie chart showing the most affected locations.

Image 10 is a pie graph of leak site post distribution by country in 2023. The majority is the United States at 47.6%, followed by the UK at 6.5%, Canada at 4.6%, Germany at 4%, and France at 3.4%.
Figure 10. Leak site post distribution by country in 2023.

Organizations in the U.S. have been the top target of ransomware since leak sites first appeared in 2019. The U.S. presents a very attractive target, especially when examining the Forbes Global 2000, which ranks the largest companies in the world according to sales, profits, assets and market value. In 2023, the U.S. accounted for 610 of these organizations, consisting of almost 31% of the Forbes Global 2000, indicating a high concentration of wealthy targets.

While ransomware groups tend to target wealthy regions like the U.S., this threat remains a widespread global issue. Leak site data from 2023 reveals victims from at least 120 different countries across the world.

Conclusion

2023 presented a thriving and evolving ransomware landscape as reflected in posts from ransomware leak sites. Posts from these sites indicate a notable increase in activity, and this data also reflects new ransomware groups that have appeared and existing groups that have declined. Although the landscape remains fluid, law enforcement's growing effectiveness in combating ransomware signals a welcome change.

Ransomware groups such as CL0P have used zero-day exploits against newly discovered critical vulnerabilities, which represent a complex challenge for potential victims. While ransomware leak site data can provide valuable insight on the threat landscape, this data might not accurately reflect the full impact of a vulnerability. Organizations must not only be vigilant about known vulnerabilities, but they must also develop strategies to quickly respond to and mitigate the impact of zero-day exploits.

Protections and Mitigations

Palo Alto Networks customers are better protected from ransomware through the following products:

  • Advanced WildFire: The Advanced WildFire machine-learning models and analysis techniques are frequently updated with information discovered from our day-to-day research on ransomware.
  • Cortex Xpanse: Cortex Xpanse can be used to detect vulnerable services exposed directly to the internet that might be exploitable and infected by ransomware.
  • Cortex XDR and XSIAM: All known ransomware samples are prevented by the XDR agent out of the box using the following modules:
    • Anti-ransomware module to prevent encryption behaviors on Windows
    • Local Analysis prevention for ransomware binaries on Windows
    • Behavioral Threat Protection (BTP) rule helps prevent ransomware activity on Windows as well as Linux
  • Next-Generation Firewall (NGFW) with Cloud-Delivered Security Services:
    • Advanced URL Filtering and DNS Security block related malicious URLs and domains as ransomware, command and control (C2), and malware categories.
    • Advanced Threat Prevention can block ransomware threats at both the network and application layers, including port scans, buffer overflows and remote code execution.
  • Prisma Cloud: Any cloud infrastructure running Windows virtual machines (VMs) should monitor their Windows-based VMs using Cortex XDR Cloud Agents or Prisma Cloud Defender Agents. Both agents will monitor the Windows VM instances for known malware, using signatures pulled from Palo Alto Networks WildFire.

If you think you might have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

  • North America Toll-Free: 866.486.4842 (866.4.UNIT42)
  • EMEA: +31.20.299.3130
  • APAC: +65.6983.8730
  • Japan: +81.50.1790.0200

Additional Resources

The following reports were referenced in this article. These can provide more insight on ransomware operations, individual ransomware families or specific operations related to ransomware in 2023.

Updated on Feb. 20, 2024 at 12:56 p.m. PT. 

Updated on April 25, 2024 at 2:10 p.m. PT. 

Exploring the Latest Mispadu Stealer Variant

Posted on by Josh Grunzweig

Executive Summary

Unit 42 researchers recently discovered activity attributed to Mispadu Stealer, a stealthy infostealer first reported in 2019. We found this activity as part of the Unit 42 Managed Threat Hunting offering. We discovered this threat activity while hunting for the SmartScreen CVE-2023-36025 vulnerability.

When we hunted for exploitation of the CVE-2023-36025 vulnerability in this case, we discovered an infostealer family that targets specific regions and URLs that are most commonly associated with citizens of Mexico. We identified a new variant of Mispadu Stealer, which we analyze here.

Palo Alto Networks customers are better protected from the threats described in this article through Cortex XDR and WildFire malware analysis. Advanced URL Filtering and DNS Security identify known domains and URLs associated with Mispadu Stealer activity as malicious. If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.

Related Unit 42 Topics Banking Trojan, CVE-2023-36025

Mispadu Stealer Background

Mispadu Stealer is a known and stealthy banking Trojan first reported by ESET in November 2019. Written in Delphi, it originally targeted victims in Brazil and Mexico.

We discovered samples we strongly attribute to the Mispadu Stealer after the recent publication of the Windows SmartScreen bypass vulnerability identified as CVE-2023-36025. While hunting for bypass attempts, we identified a new variant of Mispadu that was created and executed before the CVE publication, which was potentially not intended to bypass this feature.

SmartScreen Vulnerability CVE-2023-36025

CVE-2023-36025 is categorized as a security feature bypass vulnerability within the Windows SmartScreen function. SmartScreen is designed to protect users from untrusted sources by warning them about potentially harmful websites and files.

An example of a SmartScreen warning is shown below in Figure 1. However, attackers can bypass these warnings by exploiting CVE-2023-36025.

Image 1 is a screenshot of Microsoft Defender SmartScreen. Windows protected your PC. Microsoft Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk. Link for more info. Button: Don't run.
Figure 1. Windows SmartScreen warning.

This exploit revolves around the creation of a specifically crafted internet shortcut file (.url) or a hyperlink pointing to malicious files that can bypass SmartScreen’s warnings.

The bypass is simple and relies on a parameter that references a network share, rather than a URL. The crafted .url file contains a link to a threat actor’s network share with a malicious binary as shown below in Figure 2.

Using this crafted .url file, Windows will not display SmartScreen’s warning message. Upon clicking the .url file, the victim is redirected to the threat actor’s network share to retrieve and execute the malicious payload.

Image 2 is a screenshot of the code that bypasses SmartScreen’s warning to run proc.exe.
Figure 2. Crafted .url file that runs proc.exe without SmartScreen’s warning.

SmartScreen Attack Explained

In November 2023, while hunting for attempts to bypass SmartScreen by searching for binaries executed from a network share, we observed a .url file at the following file path:

  • C:\Users\<USER>\AppData\Local\Temp\4af8a553-b773-4448-b256-17329eb35676_RFC.Online.[redacted].1981.d9f.zip.676\[redacted].[redacted].1209.url

The contents of this URL file are shown below in Figure 3.

Image 3 is a screenshot of the contents of a URL with crafted content.
Figure 3. Crafted .url file content.

This .url file executed the following command to retrieve and execute a malicious binary named 2456719228.exe:

  • file[:]\\24.199.98[.]128@80\expediente38\1477606991\2456719228.exe

The malicious .url file was originally contained in a .zip archive that was downloaded by the Microsoft Edge browser:

  • C:\Users\<USER>\Downloads\RFC.Online.[redacted].1981.d9f.zip

These types of ZIP archives can be distributed as email attachments or as downloads from malicious websites. Based on the filename pattern of this ZIP example, we believe the threat actor likely distributed it as an email attachment.

Upon further investigation, we identified similar payloads downloaded from the same command and control (C2). These binaries were all compiled and executed before publication of the SmartScreen bypass. This helped us identify that the WebDAV client was intended to execute those files.

Navigating a UNC path in a .url file prompts the system to use the protocol based on network shares. While SMB is typically the default, the system would attempt to use WebDAV if SMB is not enabled. In such scenarios, the operating system will initiate a request through the rundll32.exe utility, as shown in Figure 4.

Image 4 is a screenshot of a Rundll32 command utilizing WebDAV.
Figure 4. Rundll32 command intended to utilize the WebDAV client.

Notably, specifying an HTTP port (@80) within the UNC path compels Windows to leverage WebDAV over HTTP instead of SMB. This method is not limited to Mispadu Stealer. A different stealer described in a report by Team Axon has also used this technique.

While diving into our newly discovered samples, we found a strong connection to the Mispadu Stealer that appears to have evolved its techniques in recent years. To explore this evolution, we analyzed one of these new malware samples.


Sample Analysis

Through this research, we ultimately discovered a number of historical samples aligning to the Mispadu Stealer malware family. However, a small cluster of five recent samples heavily aligns with this campaign. These samples share numerous characteristics, including internal program database (PDB) strings, file size and compilation dates, as noted below:

While we encountered hundreds of samples, this article uses the sample shown in Table 1 for our analysis:

Characteristic Value
SHA256 8e1d354dccc3c689899dc4e75fdbdd0ab076ac457de7fb83645fb735a46ad4ea
SHA1 ba6d10e36f41c4ebc85f6beb95afd2b7c92406ad
MD5 723df0296951abd2aeed01361cec6b0d
Size 4,298,240 bytes
File Type PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
PDB C:\src\client\build\Release-x64\client.pdb
Compile Timestamp 2023-11-12 16:15:02 UTC

Table 1. Static characteristics of analyzed file.

Upon initial execution, this malware sample initially queries the bias (or difference in minutes) between the local time zone and UTC. The threat will then calculate the difference by subtracting 300 and checking to see if the resulting value is greater than 180. If the result is greater than 180, the malware will immediately exit.

By performing this check, the malware targets certain areas of the world and ignores other regions. These checks result in the malware executing within most parts of the Americas, as well as certain regions of Western Europe.

Throughout its execution, this sample selectively decrypts various strings. The sample uses the AES encryption algorithm to perform the necessary decryption routines through the bcrypt.dll library. By brute-forcing the identified functions, we’ve extracted the following strings from this sample.

The malware identifies the %TEMP% directory on the victim host, which it will use for temporary file storage during the remainder of its execution. After it performs this action, the malware identifies the version of Windows the victim host is running and performs its initial HTTP/HTTPS check-in to the remote C2 server.

The malware will perform either an HTTP or HTTPS GET request based on the version of Microsoft Windows the host is running. In the event that the victim machine is running Windows 7 or older, the malware will perform an HTTP request. Otherwise, the malware will perform an HTTPS request. Figure 5 shows what this request looks like.

Image 5 is a screenshot of the code that creates a custom error page to disguise the campaign from web crawlers.
Figure 5. Custom error page displayed by the campaign to cloak itself from crawlers.

In the example above, the w= parameter in the GET header line contains the version of Windows running on the victim host.

After it performs this initial check-in and the C2 server receives a successful response, the malware proceeds to interact with the victim’s Microsoft Edge or Google Chrome browser history via SQLite. It copies these browser history databases to the previously discovered %TEMP% directory, and it executes the following query against the copied files.

Note that in the SQL statement above, 13337916118295160 is a Unix timestamp that aligns to a date of Aug. 29, 2023. By executing the SQL statement, the malware is looking at observed URLs the victim navigated to on Microsoft Edge or Google Chrome after that date. This provides additional information about the age of these attacks and how long they’ve been taking place.

The malware then checks the extracted URLs against a targeted list. To build a list of URLs the attackers are interested in, the malware leverages a prebuilt list of SHA256 hashes. The malware makes these hashes from the URLs after splitting them by the “.” character. The malware also prepends the 0x23155CA4D7D94B1E511228924940CAD2A19F801DDC8A445A819C1F9FD1B10226 hash to the data that it’s hashing. This prevents researchers and analysts from brute-forcing or otherwise searching the internet for the hashes it uses.

To provide a practical example of how this process works, we’ll use an example of our website at https://unit42.paloaltonetworks.com/.

  • The malware first removes https:// from the URL, as well as the trailing /, resulting in unit42.paloaltonetworks.com.
  • It then splits this string by the “.” character, resulting in three strings of unit42, paloaltonetworks and com.
  • Finally, the malware hashes each of these strings with the prepended hash, resulting in the following three hashes:
    • dd4018e2cff36fc896497d4539397e8334aa9a5910e73b45bde4f7206aa5ebe3
    • 135c9ef3baaef856dd9ca7801bfb690a3662646ab97568e916a1af06d382b81f
    • 4c21caa1fc4c01fa51d918be8ab40077e79b5b8dbaea098328ff953fc7aca8c2

We observed a total of 15 groupings of hashes for this malware – in other words, this malware targets 15 URLs. By brute-forcing the algorithm the malware leveraged, we identified a number of underlying strings, as noted below in Table 2.

SHA256 Hash String
cf546a4c5c7fdd3935ed7d93f5482057e3c8ff8723c3a73caba1fc5e3a5c96b4 bitso
4c21caa1fc4c01fa51d918be8ab40077e79b5b8dbaea098328ff953fc7aca8c2 com
018beb515d323dee4f04ad9663863324859f4eb896576dbef1df950568084030 enlace
bbaba0482f486b0d7b7738af8bc4731dbb80faef7f8b3888d9859726dbd53957 hsbc
748a57a4d4e806daa6c5e54af96f9e7839bc2260e5f0258e5edf617a92045085 mx
3e165f375f498d802ce7f47739ae9d93236f83811335da55aef1dc1c17694f53 nbem
0332d65ee6d896d1b326748e0108b1ac1ad97e94796dd17c7e15fa10317445a9 nixe
974fe99972905800c1dd1a3527de58c291ed1f8f1c654f2f302d6b3b70af2b10 see
ac027e988dad213707537bdc0172509b9135115337c5744816b079390d5a3e82 www
4a774438d15381d9ab308dd73c2917aee83897d654c39db24f4dd6f173564914 ixe
4b276d43308450619fec6befdf92c5171298e3651ed6f06a5a637f8a5afc407f monex
e8deebe849f80654b53b73d41a379919a86c4c356715d34729335e79089127c7 secure
d4fed9ca90249707099926e336c0ec5abc0be8fbeb0e1889f7259e0e7312b9a0 wallet
d752b7472110cbf7f4513b64658c751148304f287b13df26890642d64b75c264 bbvanet
4e209b1dd2d4eaa3b041dddbe7f1bd0c6b07145c0102999060d7ceeb64978e90 hsbcnet
b70ad99286733a4eb2ebc615fbfdbc9b278aaa15ad23d661696ae54eb186a5a4 www1
44c505974154050ec0c671eb2f1d27f72886243bfafff8c3523b0ce1d64f944a www2

Table 2. Brute-forced strings used to target specific URLs within the browser.

While we were unable to identify the majority of the full groupings, we were able to understand the following URLs where ?? represents unidentified SHA256 hashes:

  • www.??.??.hsbc[.]com[.]mx
  • www1.secure.hsbcnet[.]com
  • bancadigital.monex[.]com[.]mx
  • nixe.ixe[.]com[.]mx
  • empresas.bbvanet[.]com[.]mx

These hosts align toward financial institutions, financial exchanges and organizations aligned with cryptocurrency. The majority of these URLs are based in Mexico, based on their .mx suffixes.

In the event it notes any matches, the malware proceeds to upload data via an HTTP/S POST request, as noted in Figure 6 below.

Image 6 is a screenshot of a HTTP/S POST. It includes the host and the user agent.
Figure 6. HTTP POST request generated by Mispadu.

This request has a number of additional URI parameters, which Table 3 outlines below.

Variable Description
v1 User UI language
v2 Keyboard layout
v4 Operating system
v5 Process permissions (user/admin)
v6 CPU architecture (X64/X86)

Table 3. URI parameters and their associated data.

After it has successfully updated the data, the malware will send a final HTTP/S GET request, as shown in Figure 7 below.

Image 7 is a screenshot of a GET request Mispadu generates. It includes the host and the user agent.
Figure 7. Final GET request generated by Mispadu.

This request differs from the first insofar as the f parameter is set to a value of 9 instead of the value of 2 that we originally observed.

Attribution

The C2 infrastructure and info-stealing functionality discovered in this sample are similar to the ones used by a Mispadu AutoIt sample from May 2023. This information helped form our assumption that the recently compiled binaries are a new version of the Mispadu Stealer previously reported by MetabaseQ.

We also found a connection between this sample and another Mexican infostealer campaign.

Mispadu Stealer

Mispadu is notorious information-stealing malware first identified in 2019, which specifically targets Spanish- and Portuguese-speaking victims. The typical distribution method for Mispadu involves spam campaigns, where victims receive malicious emails containing a .zip file housing a deceptive URL.

Mispadu is multistage malware, containing various techniques that its developers are constantly changing. Over the past year, recent versions have had multiple changes, but some techniques remained similar.

This section summarizes the similarities and differences between this malware and other malware targeting Latin America (LATAM).

March 2023

The new malware’s C2 traffic heavily aligns with the Mispadu campaign that MetabaseQ previously discussed in March 2023. In our analysis, we also identified a strong similarity within the info-stealing capability, which the developers wrote as an AutoIt script in the earliest samples.

The following similarities and differences are notable between the samples:

  • While the C2 servers keep changing, we observed a similar .php file in both campaigns: it.php
  • The .php file accepts parameters such as system language, system architect and operating system.
  • In this new sample, we observed the same parameter names being passed to it.php, as in the campaign described in May 2023:
    • v1: Computer language
    • v2: Keyboard layout (language)
    • v4: Operating system
    • v5: Whether the process is admin or not
    • v6: System architecture

A significant difference we observed between the campaigns is the execution chain and the main payload. While the campaign of May 2023 contained a multistage malware sample with an AutoIt script main payload, the newest sample is an executable that contains the same info-stealing functionality as the former AutoIt script.

As mentioned above, the info-stealing technique in both samples seems to be similar in the following ways:

  • Both use SQLite to read stored credentials. This is a legitimate library that other infostealers also use.
  • Previous samples of Mispadu used known tools such as WebBrowserPassView and Mail PassView for credential extraction. However, we suspect that the authors changed this method to use SQLite to evade detection.
  • While they won’t extract all credentials, both samples are targeting specific banking websites.
  • Both samples use Bcrypt.dll and AES encryption.

August 2023

We observed additional similarities between the payload shown below in Figure 8 and the payload from a Mexican campaign shown below in Figure 9 that Team Axon reported on in August 2023.

Unlike the new samples, the campaign from August 2023 implements its info-stealing capability using PowerShell code. On top of that functionality, samples from this campaign have additional capabilities not observed in the current case, such as the installation of malicious Chrome extensions. However, in this case the common ground between this campaign and our new sample is the initial delivery via .url files.

Additionally, the campaign in August 2023 also leveraged the WebDAV feature for execution. While the .url file pointed to a .jse file, the new variant used a .url file that pointed to an executable file (.exe).

Image 8 is a screenshot of many lines of code. Highlighted in a black box is the URL as it points to the .exe file.
Figure 8. URL pointing to an .exe file in the new campaign.
Image 9 is a screenshot of many lines of code. Highlighted in a black box is the URL as it points to the .jse file.
Figure 9. URL pointing to a .jse file in the campaign of August 2023.

Mispadu typically focuses on LATAM countries and Spanish- or Portuguese-speaking users. This particular campaign has been detected across various regions, with Mexico being the most prominent, as noted in Figure 10 below. This campaign is spreading rapidly, reaching other European regions that we haven’t seen targeted in previous campaigns.

Although the malware doesn’t steal credentials from untargeted regions, it’s only a matter of time until the threat authors release the next version of their malware. At that time, the threat might expand its targets.

Image 10 is a column graph of the affected countries. Mexico, France and Spain are the top three, followed by the U.S., Switzerland, Germany, Texas, Belgium and Argentina.
Figure 10. Statistics of infected countries.

Conclusion

This new Mispadu variant keeps evolving and changing techniques – until it’s almost impossible to attribute it to previous campaigns. However, minor similarities can shed light into the attribution of different samples. These differences mean that a comprehensive and multifaceted approach to cybersecurity becomes critical. This approach includes staying informed on the latest threat intelligence, employing robust endpoint protection and fostering a culture of cybersecurity awareness among users.

Palo Alto Networks customers are better protected from malware discussed in this article through Cortex XDR, including WildFire, Behavioral Threat Protection and Local Analysis. Additionally, Advanced URL Filtering and DNS Security identify known domains and URLs associated with Mispadu Stealer activity as malicious.

If you think you might have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

  • North America Toll-Free: 866.486.4842 (866.4.UNIT42)
  • EMEA: +31.20.299.3130
  • APAC: +65.6983.8730
  • Japan: +81.50.1790.0200

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Indicators of Compromise

File Indicators

  • 8e1d354dccc3c689899dc4e75fdbdd0ab076ac457de7fb83645fb735a46ad4ea
  • bc25f7836c273763827e1680856ec6d53bd73bbc4a03e9f743eddfc53cf68789
  • fb3995289bac897e881141e281c18c606a772a53356cc81caf38e5c6296641d4
  • 46d20fa82c936c5784f86106838697ab79a1f6dc243ae6721b42f0da467eaf52
  • 03bdae4d40d3eb2db3c12d27b76ee170c4813f616fec5257cf25a068c46ba15f
  • 1b7dc569508387401f1c5d40eb448dc20d6fb794e97ae3d1da43b571ed0486a0
  • e136717630164116c2b68de31a439231dc468ddcbee9f74cca511df1036a22ea

Network Indicators

  • plinqok[.]com
  • trilivok[.]com
  • xalticainvest[.]com
  • moscovatech[.]com
  • hxxp://trilivok[.]com/4g3031ar0/cb6y1dh/it.php
  • hxxps://plinqok[.]com/3dzy14ebg/buhumo0/it.php
  • 24.199.98[.]128/expediente38/8869881268/8594605066.exe
  • 24.199.98[.]128/verificacion58/6504926283/3072491614.exe
  • 24.199.98[.]128/impresion73/5464893028/8024251449.exe

YARA Rules

Additional Resources

XQL Queries

Updated Feb. 7, 2024 at 10:44 a.m. PT to make some redactions. 

ApateWeb: An Evasive Large-Scale Scareware and PUP Delivery Campaign

Posted on by Royce Lu

Executive Summary

Unit 42 researchers discovered a large-scale campaign we call ApateWeb that uses a network of over 130,000 domains to deliver scareware, potentially unwanted programs (PUPs) and other scam pages. Among these PUPs, we have identified several adware programs including a rogue browser and different browser extensions.

Although the programs involved in this campaign are not traditional malware, they could present ways for cybercriminals to gain initial access. Consequently, these programs could expose victims to more severe cyberthreats.

Attackers craft deceptive emails to lure victims into clicking on their campaign URLs and embed JavaScript into website pages that redirect traffic to their content. ApateWeb has a complex infrastructure with a multilayered system that includes a series of intermediate redirections between the entry point and delivery of the final malicious payload.

A group using a centralized infrastructure largely controls the entry point by tracking victims before forwarding traffic to the next layer of this campaign. This group also uses evasive tactics like cloaking malicious content and abusing wildcard DNS in an attempt to prevent defenders from detecting their campaign.

We observed a spike in ApateWeb activity since August 2022, though the campaign has been active throughout 2022, 2023 and 2024 so far. The impact of this campaign on internet users could be large, since several hundred attacker-controlled websites have remained in Tranco’s top 1 million website ranking list.

In our telemetry, we saw millions of monthly hits on these websites from multiple parts of the world, including the U.S., Europe and Asia. For instance, we blocked an estimated 3.5 million sessions from this campaign across 74,711 devices during November 2023.

Next-Generation Firewall customers who use Advanced URL Filtering and DNS Security subscriptions are better protected against known URLs and hostnames of the campaign described in this research. Cortex XDR flags adware described in this article as suspicious. If you think you might have been impacted or have an urgent matter, get in touch with the Unit 42 Incident Response team.

Related Unit 42 Topics Scareware, Web threats

Campaign Infrastructure and Workflow

In this section, we will provide an in-depth investigation of this campaign to understand its workflow, characteristics and infrastructure. We will also open campaign entry point URLs in a sandbox to analyze traffic and the malicious payload.

Figure 1 breaks down the complex chain of redirection used in this campaign and highlights key characteristics of the campaign’s infrastructure.

Image 1 is a diagram of the different layers involved in the campaign. Layer 1 is the campaign entry point containing the URL, Initial Payload and Evasion Tactics. This later is linked to deceptive email and embedding redirect JavaScript on websites. The second layer is intermediate redirections. The third layer is the final payload delivery of PUP downloads, scareware and scam pages.
Figure 1. Key characteristics of the campaign’s infrastructure and workflow.

Layer 1 is the entry point of the ApateWeb campaign. Attackers distribute the entry point URL to victims in Layer 1 through emails. From Layer 1, traffic is forwarded to Layer 2, where a series of intermediate redirections that include adware or anti-bot verification lead to the final layer, which we call Layer 3. Layer 3 delivers a malicious payload that could be scareware, PUP or a scam page.

We named the campaign ApateWeb after Apate, a goddess of deceit in Greek mythology, due to the campaign’s deceptive strategies and its efforts to elude security defenders.

Layer 1: Campaign Entry Point

Attackers craft a custom URL that serves as the entry point to the campaign, loading an initial payload. This payload uses centralized infrastructure to track victims and then share that information with the server side to determine the next redirection.

Layer 1 protects itself against defenders by employing multiple safeguards. The techniques employed include the following activities:

  • Redirection to search engines
  • Displaying error pages to bots/crawlers
  • Abusing wildcard DNS (allowing an attacker to generate a large number of subdomains)

Entry Point URL

The campaign uses URLs with specific parameters (e.g., key and submetrics) shown in Figure 1. The campaign delivers malicious content only with these specific parameters, and if these parameters are missing or modified, then victims would either get an error page or no content.

It is unclear how the values of these parameters are used. We hypothesize they could be defined for internal usage on the server side, such as locating the next redirection URL. After the entry point URL is opened in the browser, the campaign loads an initial payload.

Initial Payload

The initial payload has two important code snippets. An example of the first code snippet is shown in Figure 2, which queries a centralized infrastructure to track victims.

Image 2 is a screenshot of the script that tracks victims through a centralized infrastructure.
Figure 2. Script that uses a centralized infrastructure to track victims.

Each visit on the campaign’s website is tracked with a unique identifier (UUID) that ApateWeb assigns to each visitor by contacting a centralized server. Below is a set of domains the campaign recently rotated through to contact the centralized server.

  • professionalswebcheck[.]com
  • hightrafficcounter[.]com
  • proftrafficcounter[.]com
  • experttrafficmonitor[.]com

For example, the campaign contacted professionalswebcheck[.]com/stats to get the in Figure 2 above. This UUID is stored in the cookie and also shared on the server side, as we’ll discuss next.

Figure 3 shows the second code snippet that sets this UUID in a hidden field of an HTML form auto-submitted to share information on the server side. Additional data is also set in the form, such as an identifier that indicates whether the victim's browser tab is incognito. This is an HTTP GET request that sends information to the server using an /api/users/ URL path. We surmise the server uses this information to determine the next redirection.

Image 3 is a screenshot of the script setting the Universally Unique IDentifier. It is automatically submitted to share info to the server side.
Figure 3. Script that sets UUID in the form that is auto-submitted to share information on the server side, followed by redirection into the next layer.

Evasion Tactics

The campaign safeguards Layer 1 from defenders by employing the following evasion tactics:

  • Protecting domains from detection: ApateWeb protects attacker-controlled domains when detecting defense mechanisms by showing benign content. If someone directly views the website of an ApateWeb-controlled domain, the domain either redirects to a popular search engine or an empty page as illustrated below in Figure 4. The campaign forwards traffic to the next layer if a victim's browser retrieves an entry URL with specific parameters. This strategy helps the campaign to protect its domains from being blocked by security crawlers performing periodic scans of websites.
Image 4 is a screenshot of an empty web page. It says empty OK. The address is hoanoola[.]net.
Figure 4. The domain of the website is protected from being blocked by security crawlers by showing an empty page instead of delivering a malicious payload.
  • Displaying error pages to bots/crawlers: If a security crawler accesses the entry URL, ApateWeb tries to cloak itself by showing an error page. The campaign detects crawlers and bots by inspecting their user agent. Figure 5 shows the contents of the error page generated by this campaign.
Image 5 is a screenshot of the code that creates a custom error page to disguise the campaign from web crawlers.
Figure 5. Custom error page displayed by the campaign to cloak itself from crawlers.
  • Having a large number of registered domains and wildcard DNS: ApateWeb controls more than 10,000 registered domains and abuses wildcard DNS, which allows the campaign to deliver malicious content via a virtually infinite number of subdomains. We estimate that more than 92% of ApateWeb domains use wildcard DNS patterns to create subdomains. For example, we matched 110,000 subdomains to an ApateWeb domain by searching for a prefix matching the following Perl Compatible Regular Expression (PCRE): pl[0-9].*\

This approach allows ApateWeb to disseminate entry point URLs through a large number of randomized domains, increasing the difficulty for defenders to detect against it.

DNS Resolution

The vast majority of ApateWeb domains are resolved to a limited number of servers. Reviewing DNS activity associated with this campaign, we found 93% of ApateWeb domains resolve to the following 10 IP addresses:

  • 192[.]243[.]59[.]20
  • 192[.]243[.]59[.]13
  • 192[.]243[.]59[.]12
  • 192[.]243[.]61[.]227
  • 192[.]243[.]61[.]225
  • 173[.]233[.]139[.]164
  • 173[.]233[.]137[.]60
  • 173[.]233[.]137[.]52
  • 173[.]233[.]137[.]44
  • 173[.]233[.]137[.]36

These IP addresses belong to two Autonomous System (AS) designators. The first AS owns the first five IPs (192.243.*), and the second AS owns the next five IPs (173.233.*).

The shared servers among the majority of domains on Layer 1 indicate control of the infrastructure by a single group, which is what led us to initially identify this campaign. We unmasked ApateWeb by analyzing WHOIS data of the registered domains. While WHOIS no longer provides the registrant's information, we identified a consistent pattern, indicating a single threat actor registered 84% of domains associated with this campaign through the reseller registrar eNom.

Layer 2: Intermediate Redirections

After traffic is forwarded from Layer 1, the second layer generates a series of intermediate redirections. We cannot yet determine if the same threat actor controls the first and second layers, because these Layer 2 redirections use random domains before delivering a malicious payload. The same Layer 1 entry URL generated a different series of redirections in Layer 2 during each of our test runs.

Redirect traffic from our test runs either led to common adware, or they led to anti-bot verification that stopped the chain of events.

Forward Traffic to Popular Adware

Among the Layer 2 redirect traffic we saw examples of traffic forwarded to adware sites such as tracker-tds[.]info and jpadsnow[.]com.

The redirection URL includes several parameters to share with the adware sites. By inspecting these parameters, we discovered the campaign could be monetized by simply forwarding traffic to the adware.

For example, Figure 4 shows a URL forwarded to tracker-tds[.]info that has a parameter named COST_CPM, which is a common term used in advertising for cost per mile or cost per impression. Other parameters in the URL share campaign-related information such as CAMPAIGN_ID, and the target's device information such as BROWSER_NAME or USER_OS. This data enables an adware group to either pay the threat actor behind ApateWeb or to further redirect traffic to a malicious payload targeted to the victim's operating system.

Image 6 is a screenshot a redirect URL. Some of the text is highlighted in red.
Figure 6. Example of an ApateWeb Layer 2 URL with target data sent to an adware site.


Anti-Bot Verifications

Some of our test runs led to anti-bot verification that temporarily halted redirection traffic and required some sort of human interaction. Figure 7 shows one such example, where redirection ceased and the browser presented a CAPTCHA. After solving the CAPTCHA, traffic continued redirecting to a final page for a rogue browser download shown later in Figure 9.

Image 7 is a screenshot of an anti-bot CAPTCHA. Popup window: I am not a robot. There is a checkbox to click. ReCAPTCHA refresh symbol.
Figure 7. Example of anti-bot verification CAPTCHA that halted the redirection.

During our test runs, we saw examples where Layer 1 skipped the intermediate redirections in Layer 2 and went directly to Layer 3.

Layer 3: Redirection to Final Payload

The final phase of this attack chain is Layer 3, where ApateWeb leads to a final page. This is the malicious payload, which could be a PUP, scareware or a notification scam as shown in Figure 8.

Image 8 is a collection of three screenshots. Clockwise from left to right: Get notifications popup with options to Allow or Block. Popup window for Go Blocker extension. Includes logo, General Comments, and Accept and continue button. Microsoft Services popup against a MS WINDOWS DEFENDER warning alert. Threat detected: Trojan spyware. Access has been blocked for security reasons and safety. Cancel and Scan options.
Figure 8. Examples of ApateWeb’s Layer 3 payload.

We did not find any evidence of infrastructure sharing between Layer 1 and Layer 3. These malicious payloads are generally hosted on public cloud environments or ISP/data centers.

The final content is either an unwanted program, or some sort of scam.

Unwanted Browsers and Extensions

Examples of PUP distributed by ApateWeb include unwanted browser extensions like Browse Keeper and Go Blocker, or rogue browser executables like Artificus Browser. Searching these names on any popular search engine reveals removal instructions by various sites that identify these as PUPs.

Figure 9 shows a Layer 3 page from ApateWeb offering a Windows executable for the Artificius browser.

Image 9 is a screenshot of the Artifices browser installation process. Almost There… If your download didn’t start automatically click here. Download Now option. Run the Setup option
Figure 9. ApateWeb Layer 3 page that offers the Artificius browser.

Artificius poses significant risks due to its intrusive behavior. In an attempt to monetize victim activity, this browser updates a victim's default search engine, injects advertisements and performs unwanted redirects.

This browser opens its own website at artificius[.]com when victims open a new tab or window. Figure 10 illustrates an example of the default search engine when a victim types a search query in the Artificius browser's URL bar.

Image 10 is a screenshot of how the Artificius browser uses its own search engine when searching in the URL.
Figure 10. Example of the Artificius browser using its own search engine in its URL bar.

Another example of an ApateWeb PUP, the Go Blocker browser extension obtains extremely intrusive permissions that include obtaining access to websites that a target visits and performing unwanted redirects.

While these programs are essentially PUPs and not traditional malware themselves, they could provide initial access to cybercriminals through malvertisement, redirections and possible script injections. Such access could expose internet users to more serious traditional malware (e.g., ransomware).

Fake Antivirus (AV) Alert

ApateWeb also delivers scareware alerts for fake AV to trick victims into purchasing real AV software. Threat actors often abuse, take advantage of or subvert the reputation of legitimate products for malicious purposes. This does not necessarily imply a flaw or malicious quality to the legitimate product being abused.

Figure 11 shows a scareware alert attempting to trick viewers into believing their device is infected.

Image 11 is a screenshot of a popup using the McAfee logo to warn the end user of a security alert. You’ve visited illegal infected website. You have visited unsafe site with illegal content. Your PC is at risk of being infected by viruses. To continue browsing safely — perform an antivirus scan. Scan button.
Figure 11. Redirection to a fake AV alert.

The alert sends the victim to a legitimate AV website as shown in Figure 12.

Image 12 is a screenshot of the McAfee website Secure Checkout page asking the end user to input their email. A security subscription is listed in the shopping cart.
Figure 12. Legitimate AV site redirected from ApateWeb Layer 3 scareware page.

The final redirection URL for this type of scareware contains parameters like affid, which indicates that ApateWeb could be monetizing this activity with affiliate programs.

Our Advanced URL Filtering categorizes examples of malicious content described in this article as either grayware or phishing. Scareware pages are typically categorized as phishing while PUP and adware is categorized as grayware.

Campaign Dissemination

ApateWeb brings traffic to its campaign by loading a script on other websites or tricking users into clicking URLs through deceptive emails.

Embedded Redirection JavaScript on Websites

The threat actor behind ApateWeb has authored a malicious JavaScript code that is embedded on other webpages to bring traffic to the campaign. This script typically creates an overlay on the website, and clicking on a webpage could forward a victim to an ApateWeb entry point URL.

ApateWeb’s JavaScript is hosted on attacker-controlled domains from Layer 1. An example of this embedded JavaScript is shown below in Figure 13.

Image 13 is a screenshot of embedded ApateWeb JavaScript code.
Figure 13. Example of ApateWeb’s embedded JavaScript code.

We found similar scripts embedded on more than 34,000 websites. A random sampling of these websites reveals most of them serve adult or streaming content that could generate a high volume of traffic.

We believe ApateWeb might pay these websites to forward traffic by including the campaign’s redirection script on their webpages. The alternative is that these sites could be legitimate but compromised with ApateWeb's embedded JavaScript code. However, we did not find evidence that these websites were compromised.

Deceptive Emails

ApateWeb also leverages email to disseminate entry URLs to its targets. These emails have deceptive subject lines to trick victims into opening the message and clicking on links for ApateWeb URLs.

Some examples of subject lines for these emails include:

  • Your Ticket No. 10739979 payment is processed
  • Shipment Update GS813211MC
  • Did you send a cancellation letter to discard invoice no 60817749
  • Dear User, You have no outstanding for order no 16405067

While email and web traffic are two ways of distributing ApateWeb URLs, this campaign might also use other methods of distribution.

Conclusion

In our research, we dissected the infrastructure of a large-scale campaign that we call ApateWeb. This campaign distributed malicious content including scareware, PUP and other scam pages. The distributed programs could expose victims to more severe cyberthreats because they present opportunities for cybercriminals to gain initial access.

We illustrated ApateWeb infrastructure by breaking down its complex system of redirections into three layers. These layers generate a series of intermediate redirections between the initial entry point and final malicious payload.

ApateWeb’s first layer is an entry point using a large majority of wildcard DNS domains hosted on 10 IP addresses. This layer uses evasive tactics such as displaying benign content to bots/crawlers to prevent detection. This layer also uses a centralized infrastructure to track victims and then forward traffic to the second layer.

ApateWeb’s second layer generates a series of intermediate redirections including adware domains and anti-bot verification pages. Finally, this campaign’s third layer delivers a final malicious payload hosted on public cloud infrastructure or IPS/datacenters.

We found that attackers disseminated the URLs to the campaign entrypoint through emails. The campaign used a comprehensive network of over 130,000 domains and has remained active throughout 2022, 2023 and 2024 so far. The impact of this campaign on internet users could be large, because several hundred websites have remained in Tranco’s top 1 million website ranking list this year.

We hope this post helps our readers to stay protected from the harmful effects of this campaign. Next-Generation Firewall customers who use Advanced URL Filtering and DNS Security subscriptions are better protected against known URLs and hostnames of the campaign described in this article. Cortex XDR flags adware described in this article as suspicious.

If you think you might have been impacted or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

  • North America Toll-Free: 866.486.4842 (866.4.UNIT42)
  • EMEA: +31.20.299.3130
  • APAC: +65.6983.8730
  • Japan: +81.50.1790.0200

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Indicators of Compromise

Campaign entry point example

  • featuresscanner[.]com

Domains part of centralized infrastructure to track victims

  • professionalswebcheck[.]com
  • hightrafficcounter[.]com
  • proftrafficcounter[.]com
  • experttrafficmonitor[.]com

IP addresses hosting campaign entry point

  • 192[.]243[.]59[.]20
  • 192[.]243[.]59[.]13
  • 192[.]243[.]59[.]12
  • 192[.]243[.]61[.]227
  • 192[.]243[.]61[.]225
  • 173[.]233[.]139[.]164
  • 173[.]233[.]137[.]60
  • 173[.]233[.]137[.]52
  • 173[.]233[.]137[.]44
  • 173[.]233[.]137[.]36

Traffic forwarded to adware

  • tracker-tds[.]info
  • jpadsnow[.]com
  • ad-blocking24[.]net
  • Myqenad24[.]com

PUP download example:

  • bd62d3808ef29c557da64b412c4422935a641c22e2bdcfe5128c96f2ff5b5e99
  • artificius[.]com

Other campaign domains:

  • hoanoola[.]net
  • allureoutlayterrific[.]com

Acknowledgements

We’d like to thank the entire Unit 42 team for supporting us with this post. Special thanks to Bradley Duncan, Lysa Myers, and Jun Javier Wang for their invaluable input on this blog.

Threat Assessment: BianLian

Posted on by Samantha Stallings

Executive Summary

Unit 42 researchers have been tracking the BianLian ransomware group, which has been in the top 10 of the most active groups based on leak site data we’ve gathered. From that leak site data, we’ve primarily observed activity affecting the healthcare and manufacturing sectors and industries, and impacting organizations mainly in the United States (US) and Europe (EU).

We also observed that the BianLian group shares a small, customized tool in common with the Makop ransomware group. This shared tool indicates a possible connection between the two groups, which we will explore further.

BianLian has also recently moved from a double extortion scheme to one of extortion without encryption. Rather than encrypting their victims’ assets before stealing data and threatening to publish it if they do not pay the ransom, they’re now moving straight to stealing data to motivate victims to pay.

The Unit 42 Incident Response team has responded to several BianLian ransomware incidents since September 2022.

Palo Alto Networks customers are better protected against ransomware used by the BianLian ransomware group through Cortex XDR, as well as by Cloud-Delivered Security Services for the Next-Generation Firewall such as WildFire and Advanced URL Filtering.

In particular, the Cortex XDR anti-ransomware module included out-of-the-box protections that prevented adverse behavior from the ransomware samples we tested without the need for specific detection logic or signatures.

The Prisma Cloud Defender should be deployed on cloud-based Windows virtual machines to ensure they are protected. Cortex Xpanse is able to provide visibility that can prove valuable for proactive protection.

The Unit 42 Incident Response team can also be engaged to help with a compromise or to provide a proactive assessment to lower your risk.

Related Unit 42 Topics Ransomware, Cybercrime

BianLian Threat Overview

The BianLian group has been extremely active ever since it emerged in 2022, with new organizations compromised by the group being reported on their leak site almost on a weekly basis. Figure 1 below details their activity throughout 2023, as illustrated by their leak site data.

Image 1 is a graph of BianLian group activity from January to December 2023. The sharpest spike occurs in May and then falls with the lowest point in August. It then starts to climb upward again.
Figure 1. Activity of the BianLian group throughout 2023.

This group impacts mainly the healthcare, manufacturing, professional and legal services sectors. Their attacks have primarily taken place in North America, but they were also seen in the EU and India.

BianLian shares a small custom .NET tool with the Makop ransomware group, which indicates a possible connection between the two groups.

BianLian has moved from a double extortion scheme of encrypting their victims’ assets, stealing data, and threatening to publish it if they do not pay the ransom to a main focus of extortion without encryption.

The group’s leak site indicates that BianLian might be expanding by hiring new developers and affiliates, as noted in the “Work with us” section from the group's homepage shown below in Figure 2.

Image 2 is a screenshot of the BianLian leak site homepage as of December 2023. BianLian. Categories are Home, Companies, Tags, Contacts. Work with us: targets’ providers, software engineers, pentesters, journalists. Tox: [redacted]. Email: [redacted onion email]. Most of the following text is also redacted.
Figure 2. The BianLian leak site homepage, late December 2023.
The BianLian group regularly updates the list of compromised targets on their leak site. Figure 3 details the most affected countries. While BianLian has impacted organizations all over the world, the US is clearly the most affected country as of 2023.

Image 3 is a heat map of countries impacted by BianLian over 2023. The highest affected country is North America followed by parts of the EU and India.
Figure 3. A map showing the countries impacted by BianLian in 2023.

As detailed in Figure 4 below, healthcare is the sector most affected by the BianLian group, with manufacturing a close second. In January 2023, the group claimed to have exfiltrated 1.7 TB of data, including personal data of patients and employees, from a California-based hospital. Attacks on healthcare organizations are especially concerning because they disrupt hospitals’ day-to-day operations and potentially endanger patients' lives.

Image 4 is a column graph of all of the industries attacked by BianLian in 2023. The most-attacked sectors are healthcare, manufacturing and professional and legal services.
Figure 4. The distribution of the sectors that BianLian attacked in 2023.

Possible Connection to Makop Ransomware

During our analysis, we noticed a small .NET custom executable was shared between the BianLian and Makop ransomware groups. Both groups also used the same hash of the publicly available Advanced Port Scanner tool.

This .NET tool is responsible for retrieving file enumeration, registry and clipboard data. This tool contains some words in the Russian language, such as the numbers one to four. The use of such a tool indicates that the two groups might have shared a tool set or used the services of the same developers in the past.

A possible – yet not confirmed – explanation for this overlap is that BianLian could be sharing a codebase with the Makop group, or using the services of the same third-party developers. This phenomenon is well-known and documented among certain underground cybercrime groups.

Another noteworthy fact is that the Makop ransomware was documented excluding certain file extensions when encrypting an infected endpoint, including known extensions that are used by other ransomware strains. This is yet another indicator of possible existing relationships among these threat actors, or at least a “not stepping on someone’s toes” approach when it involves other ransomware groups.

Technical Analysis

Attack Lifecycle

We have mapped the attack stages that are common with the BianLian group to the MITRE ATT&CK framework, which is summarized below.

Initial Access

To infiltrate corporate networks, BianLian operators often perform the following activities:

  • Use stolen Remote Desktop Protocol (RDP) credentials
  • Exploit the ProxyShell vulnerability
  • Target virtual private network (VPN) providers
  • Use other previously reported techniques such as deploying web shells

During the last year, BianLian’s methods of infiltration and lateral movement did not change much. Nevertheless, we were able to retrieve interesting forensic data from our telemetry that provides additional behavioral indicators of compromise (IoCs).

After successfully infiltrating an organization’s network, our telemetry indicates the BianLian group uses various public tools to move laterally, dump credentials and remotely execute a backdoor payload.

Credential Dumping

In our telemetry, we have witnessed dumping of the Security Accounts Manager (SAM) registry hive into a file at %windir%\Temp. This is a common technique used by attackers.

The SAM stores hashed passwords from accounts used on the attacked machine, and it can be recovered when processing SYSTEM privileges. The corresponding Cortex XDR alert is shown in Figure 5.

Image 5 is a screenshot of an alert in Cortex XDR. The categories are Severity, which is high, the alert source, action, category, alert name and description.
Figure 5. SAM dumping alert in Cortex XDR.

Persistence

During the analysis of our telemetry, we saw the attackers drop the BianLian backdoor DLL component under the following path:

  • c:\\programdata\\vmware\\[filename].dll.

To execute the backdoor, they used the impacket tool to create the following scheduled task:

The creation of the task was detected by Cortex XDR, and the corresponding alert is shown in Figure 6 below.

Image 6 is a screenshot of an alert in Cortex XDR. The categories are Severity, which is high, the alert source, action, category, alert name and description.
Figure 6. The impacket task creation alert in Cortex XDR.

This task’s role is to periodically execute the backdoor DLL with its export function named Entry, using rundll32. The execution of the backdoor DLL was detected and prevented by Cortex XDR. The alert and prevention pop-up are shown in Figures 7 and 8, respectively.

Image 7 is a screenshot of an alert in Cortex XDR. The categories are Severity, which is medium, the alert source, action, category, alert name and description.
Figure 7. The backdoor execution detection by Cortex XDR in detect mode.
Image 8 is a screenshot of the Cortex XDR Prevention Alert window. Cortex XDR has blocked a malicious activity! Application name: Windows host process. Application publisher: Microsoft Corporation. File origin: Hard drive on this computer.
Figure 8. The backdoor execution prevention by Cortex XDR in prevent mode.

The backdoors themselves have different names and paths in each incident, thus making it difficult to implement naming-based behavioral detection.

Reconnaissance

To get a better picture of an already infected network’s open ports that attackers can later use for lateral movement, the tool Advanced Port Scanner by Famatech was used from the following path:

  • C:\\Users\\%username%\\AppData\\Local\\Temp\\31\\Advanced_Port_Scanner_2.5.3869.exe

This is the same Advanced Port Scanner file that Makop ransomware was previously documented using. The alerts raised by its execution are shown in Figure 9.

Image 9 is a screenshot of an alert in Cortex XDR. The categories are Severity, which is Informational (two instances) and medium (one instance), the alert source, action, category, and alert name.
Figure 9. Alerts raised by the execution of Advanced Port Scanner.

Encryptor and Backdoor

Since the beginning of their activity, BianLian used two main components for their final payloads: an encryptor and a backdoor. Figure 10 below shows the encryptor’s ransom note.

Image 10 is a screenshot of a BianLian ransomware note. Title: Look at this instruction.txt. Your network systems were attacked and encrypted. Contact us in order to restore your date. Don’t make any changes in your file structure: touch no files, don’t try to recover by yourself, that may lead to its complete loss. To contact us you have to download “tox” messenger. Add user with the following ID to get your instructions [redacted]. Alternative way [redacted email]. Your ID: [redacted]. You should know that we have been downloading data rom your network for a significant time before the attack: financial, client, business, post, technical and personal files. In 10 days it will be posted at our site. [redacted] with links. Send to your clients, partners, competitors and news agencies, that will lead to a negative impact on your company: potential financial, business and reputational loses.
Figure 10. Example of a ransom note generated by a BianLian encryptor first seen in April 2023.
In early 2023, Avast released a decryptor for BianLian's encryptor, which ultimately caused the group to cease most of its encryption activity. The threat actors then shifted their operation into a steal-and-extort scheme, mainly relying on their custom backdoor.

BianLian's backdoor, similar to the encryptor, is written in Go. Its core functionality is more of a loader than a classic backdoor, with its main functionality being downloading and executing additional payloads. The backdoor contains a hard-coded C2 IP address and port to communicate with.

As shown in Figures 11 and 12, Cortex XDR successfully detected the execution of the encryptor, using its anti-ransomware module and other behavioral and static detection signatures.

Image 11 is a screenshot of an alert in Cortex XDR.
Figure 11. BianLian encryptor detection by Cortex XDR in detect mode.
Image 12 is a screenshot of alerts in Cortex XDR. They were initiated by bianlian_encryptor.exe.
Figure 12. Alerts raised by Cortex XDR detecting the BianLian encryptor in detect mode.

As shown in Figure 13, when operating in prevent mode, the BianLian encryptor is prevented by Cortex XDR.

Image 13 is a screenshot of the Cortex XDR Prevention Alert window. Cortex XDR has blocked a malicious activity! Application name: bianlian_encrypotr.exe. Application publisher: Unknown
Figure 13. The BianLian encryptor is prevented by Cortex XDR in prevent mode.

Figures 14 and 15 below demonstrate how Cortex XDR also detected the BianLian custom backdoor in detect mode and prevented it in prevent mode.

Image 14 is a screenshot of an alert in Cortex XDR.
Figure 14. Cortex XDR detecting the BianLian backdoor in detect mode.
Image 15 is a screenshot of the Cortex XDR Prevention Alert window. Cortex XDR has blocked a malicious activity! Application name: bianlian_encrypotr.exe. Application publisher: Unknown.
Figure 15. The BianLian backdoor is prevented by Cortex XDR in prevent mode.

Conclusion

Following its discovery in 2022, the BianLian group has been one of the most active and prevalent extortion groups in the cyberthreat landscape. Out of the leak site data tracked by Unit 42 between January and mid-December of 2023, BianLian was in the top 10 of the most active groups. There is a growing list of alleged victims that they update on their leak site.

Maintaining their tactics, techniques and procedures (TTPs) of infiltrating corporate networks, the BianLian group has shown adaptiveness to the ransomware market demands. They have shifted from double-extortion into being focused solely on extortion efforts, pressuring their victims into paying the ransom without encrypting their files. A possible connection to the Makop ransomware group was also found, due to their mutual use of a custom tool.

Protections and Mitigations

SmartScore, a unique ML-driven scoring engine that translates security investigation methods and their associated data into a hybrid scoring system, scored an incident involving BianLian backdoor at 91 out of 100, as shown in Figure 16. This type of scoring helps analysts determine which incidents are more urgent and provides context about the reason for the assessment, assisting with prioritization.

Image 16 is a screenshot of SmartScore information scored at 91. It includes why the score was set and also insights.
Figure 16. SmartScore information about a BianLian backdoor incident.

Palo Alto Networks customers are better protected from the BianLian encryptor and backdoor components.

The Cortex XDR and XSIAM platforms detect and prevent the execution flow described in the screenshots included in the previous section.

The Cortex XDR agent included out of the box protections that prevented adverse behavior from the samples we tested from this group, without the need for specific detection logic or signatures.

Cortex XDR and XSIAM detect user- and credential-based threats by analyzing user activity from multiple data sources including the following:

  • Endpoints
  • Network firewalls
  • Active Directory
  • Identity and access management solutions
  • Cloud workloads

Cortex XDR and XSIAM build behavioral profiles of user activity over time with machine learning. By comparing new activity to past activity, peer activity and the expected behavior of the entity, Cortex XDR and XSIAM detect anomalous activity indicative of credential-based attacks.

They also offer the following protections related to the attacks discussed in this post:

  • Prevent the execution of known malicious malware
  • Prevent execution of unknown malware using Behavioral Threat Protection and machine learning based on the Local Analysis module
  • Protect against credential-gathering tools and techniques using the Credential Gathering Protection, available from Cortex XDR 3.4
  • Protect against exploitation of different vulnerabilities including ProxyShell using the Anti-Exploitation modules as well as Behavioral Threat Protection

Cortex XDR Pro detects post-exploitation activity, including credential-based attacks, with behavioral analytics.

The Prisma Cloud Defender as well as Cortex XDR for cloud agents should be deployed on cloud-based Windows virtual machines to ensure they are protected from these known malicious binaries. WildFire signatures can be used by both Palo Alto Networks cloud services to ensure cloud-based Windows virtual machine runtime operations are being analyzed and those resources are protected.

Cloud-Delivered Security Services for the Next-Generation Firewall such as WildFire and Advanced URL Filtering include protections based on the IoCs shared in this article.

Cortex Xpanse is also able to detect exposed RDP and many other remote access interfaces which are often brute forced or exploited with compromised credentials. This visibility can prove valuable through proactive prevention.

Image 17 is a screenshot of Cortex Xpanse Attack Surface rules. It includes the following categories: Status. Severity, Rule Name, Description, Remediation Guidance and more.
Figure 17. A subset of the exposed remote access interface types that Cortex Xpanse can detect.

If you think you might have been impacted or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

  • North America Toll-Free: 866.486.4842 (866.4.UNIT42)
  • EMEA: +31.20.299.3130
  • APAC: +65.6983.8730
  • Japan: +81.50.1790.0200

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Indicators of Compromise

Examples of the BianLian Encryptor

  • af46356eb70f0fbb0799f8a8d5c0f7513d2f6ade4f16d4869f2690029b511d4f
  • 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e
  • 3a2f6e614ff030804aa18cb03fcc3bc357f6226786efb4a734cbe2a3a1984b6f
  • 46d340eaf6b78207e24b6011422f1a5b4a566e493d72365c6a1cace11c36b28b
  • 1fd07b8d1728e416f897bef4f1471126f9b18ef108eb952f4b75050da22e8e43
  • eaf5e26c5e73f3db82cd07ea45e4d244ccb3ec3397ab5263a1a74add7bbcb6e2

Examples of the BianLian Backdoor

  • c775e6d87a3bcc5e94cd055fee859bdb6350af033114fe8588d2d4d4f6d2a3ae
  • c57ca631b069745027d0b4f4d717821ca9bd095e28de2eafe4723eeaf4b062cf
  • c592194cea0acf3d3e181d2ba3108f0f86d74bcd8e49457981423f5f902d054b
  • df51b7b031ecc7c7fa899e17cce98b005576a20a199be670569d5e408d21048c
  • 2ed448721f4e92c7970972f029290ee6269689c840a922982ac2f39c9a6a838f
  • 264af7e7aa17422eb4299df640c1aa199b4778509697b6b296efa5ae7e957b40
  • 73d095abf2f31358c8b1fb0d5a0dc9807e88d44282c896b5033c1b270d44111f
  • 8b65c9437445e9bcb8164d8557ecb9e3585c8bebf37099a3ec1437884efbdd24
  • 4ca84be5b6ab91694a0f81350cefe8379efcad692872a383671ce4209295edc7
  • 93fb7f0c2cf10fb5885e03c737ee8508816c1102e9e3d358160b78e91fa1ebdb
  • afb7f11da27439a2e223e6b651f96eb16a7e35b34918e501886d25439015bf78
  • 53095e2ad802072e97dbb8a7ccea03a36d1536fce921c80a7a2f160c83366999
  • 16cbfd155fb44c6fd0f9375376f62a90ac09f8b7689c1afb5b9b4d3e76e28bdf
  • 60b1394f3afee27701e2008f46d766ef466caa7711c45ddfd443a71efc39a407
  • ba3c4bc99b67038b42b75a206d7ef04f6d8abaf87a76c373d4dec85e73859ce2
  • e7e097723d00f58eab785baf30365c1495e99aa6ead6fe1b86109558838d294e
  • 96e02ea8b1c508f1ee3c1535547f9b89396f557011e61478644ae5876cdaaca5
  • ac1d42360c45e0e908d07e784ceb15faf8987e4ba1744d56313de6524d2687f7
  • 1cba58f73221b5bb7930bfeab0106ae5415e70f49a595727022dcf6fda1126e9
  • 487f0d748a13570a46b20b6687eb7b7fc70a1a55e676fb5ff2599096a1ca888c
  • f84edc07b23423f2c2cad47c0600133cab3cf2bd6072ad45649d6faf3b70ec30
  • 93953eef3fe8405d563560dc332135bfe5874ddeb373d714862f72ee62bef518
  • f3f3c692f728b9c8fd2e1c090b60223ac6c6e88bf186c98ed9842408b78b9f3c
  • f6669de3baa1bca649afa55a14e30279026e59a033522877b70b74bfc000e276
  • 228ef7e0a080de70652e3e0d1eab44f92f6280494c6ba98455111053701d3759
  • 0e4246409cdad59e57c159c7cc4d75319edf7d197bc010174c76fe1257c3a68e
  • 90f50d723bf38a267f5196e22ba22584a1c84d719b501237f43d10117d972843
  • 4c008ac5c07d1573a98eb87bffe64e9c9e946de63b40df3f686881cf0698eef7
  • d3574cc69a5974a32a041d1dc460861fe1cef3c1f063171c5fc890ca0e8403c4
  • 99fc3e13f3b4d8debf1f2328f56f3810480ee2eed9271ebf413c0015c0a54c23
  • 4f4a2adc7ecc41f12defe864c78ad6bbf708355affac4115dcd5065b38198109
  • 188e95d6ed0810c216ab0043ecc2f54f514e624ca31ed1eec58cfc18cc9ac75e
  • 16b0f643670d1f94663179815bfac493f5f30a61d15c18c8b305b1016eece7ef
  • c5fa6a7a3b48a2a4bbcbbbb1ca50c730f3545e3fbb03fa17fb814ad7a400a21f
  • d3fc56b98af9748f7b6dd44e389d343781ff47db9ed3d92ae8fadc837f25f6ed
  • 23295c518f194dee7815728de15bafe07bf53b52d987c7ad2b2050f833f770f7
  • 06f10c935fae531e070c55bde15ee3b48b6bb289af237e96eec82124c19d1049
  • 7ba40902dc495d8da28d0c0788bcfb1449818342df89f005af8ce09f2ee01798
  • 3106e313f6df73b84acd8d848b467ac42c469ffabbad19e4fdcc963639cfff8c
  • 56e63edb832fdf08d19ecfe2de1c7c6c6581cedd431215ded0c8e44ac9aed925
  • 195c11ee41f5a80d8e1b1881245545d6529671b926eb67bd3186e3ffecefe362
  • ac14946fd31ca586368c774f3a3eed1620bf0f0b4f54544f5d25e87facf18d82
  • 29a14cb63a1900fe185fad1c1b2f2efb85a058ac3c185948b758f3ce4107e11e
  • 91ffe0ee445b82bd3360156feeecf8112d27c9333f9796caffcfda986fd7e9b4
  • 5162fd73cbe8f313d2b0e4180bab4cbe47185f73a3ffc3d1dcccc36bc2865142
  • 7dabe5d40c13c7c342b7182eaf7c63fbb5e326300316f6f6518b527d57e79ac8
  • 4e92b73a17e0646876fb9be09c4ee6f015f00273932d2422b69339e22b78b385
  • 9413ba4a33ea77326b837ba538f92348e1909d5263ca67a86aa327daa8fbba30
  • bd41ac2686beadc1cb008433960317b648caae37c93d8c0d61ad40fe27b5b67e
  • bd57af28c94c3b7f156511c48f4b62cd1b4c29a1a693f4dc831e0a928691cc56

Advanced Port Scanner

  • d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb

.NET Tool

  • 40126ae71b857dd22db39611c25d3d5dd0e60316b72830e930fba9baf23973ce

BianLian Command and Control Servers

  • 208.123.119[.]123
  • 13.215.228[.]73
  • 54.193.91[.]232
  • 172.96.137[.]159
  • 204.152.203[.]90
  • 144.208.127[.]119
  • 192.161.48[.]43
  • 146.70.87[.]197
  • 45.86.230[.]64
  • 45.56.165[.]17
  • 23.163.0[.]168
  • 172.96.137[.]249
  • 173.254.204[.]78
  • 185.56.137[.]117
  • 52.87.206[.]242
  • 45.66.249[.]118
  • 96.44.157[.]203
  • 103.20.235[.]122
  • 44.212.9[.]14
  • 149.154.158[.]154
  • 146.59.102[.]74
  • 96.44.135[.]76
  • 85.239.52[.]96
  • 66.85.156[.]83
  • 198.252.98[.]186
  • 3.236.161[.]7
  • 13.59.168[.]154
  • 172.245.128[.]35
  • 216.146.25[.]60
  • 172.86.122[.]183
  • 185.99.133[.]112
  • 149.154.158[.]214
  • 104.200.72[.]6
  • 23.163.0[.]228

Additional Resources

Get the latest news, invites to events, and threat alerts

Default Heading

Read the article Right Arrow