Blog
Anomali Cyber Watch: MuddyWater Hides Behind Legitimate Remote Administration Tools, Vice Society Tops Ransomware Threats to Education, Abandoned JavaScript Library Domain Pushes Web-Skimmers
Anomali Threat Research
December 13, 2022
<p>The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: <b>APT, Compromised websites, Education, Healthcare, Iran, Phishing, Ransomware,</b> and <b>Supply chain</b>. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity.</p> <p><img src="https://cdn.filestackcontent.com/D3CmimXqQWSrpvAzsVaO"/><br/> <b>Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed.</b></p> <h2>Trending Cyber News and Threat Intelligence</h2> <div class="trending-threat-article"> <h3><a href="https://www.deepinstinct.com/blog/new-muddywater-threat-old-kitten-new-tricks" target="_blank">New MuddyWater Threat: Old Kitten; New Tricks</a></h3> <p>(published: December 8, 2022)</p> <p>In 2020-2022, Iran-sponsored MuddyWater (Static Kitten, Mercury) group went through abusing several legitimate remote administration tools: RemoteUtilities, followed by ScreenConnect and then Atera Agent. Since September 2022, a new campaign attributed to MuddyWater uses spearphishing to deliver links to archived MSI files with yet another remote administration tool: Syncro. Deep Instinct researchers observed the targeting of Armenia, Azerbaijan, Egypt, Iraq, Israel, Jordan, Oman, Qatar, Tajikistan, and United Arab Emirates.<br/> <b>Analyst Comment:</b> Network defenders are advised to establish a baseline for typical running processes and monitor for remote desktop solutions that are not common in the organization.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/ttp/3905074" target="_blank">[MITRE ATT&CK] Phishing - T1566</a> | <a href="https://ui.threatstream.com/ttp/947139" target="_blank">[MITRE ATT&CK] Remote Access Tools - T1219</a><br/> <b>Tags:</b> mitre-group:MuddyWater, actor:Static Kitten, actor:Mercury, Iran, source-country:IR, APT, Cyberespionage, Ministry of Intelligence and Security, detection:Syncro, malware-type:RAT, file-type:MSI, file-type:ZIP, OneHub, Windows</p> </div> <div class="trending-threat-article"> <h3><a href="https://blog.morphisec.com/babuk-ransomware-variant-major-attack" target="_blank">Babuk Ransomware Variant in Major New Attack</a></h3> <p>(published: December 7, 2022)</p> <p>In November 2022, Morphisec researchers identified a new ransomware variant based on the Babuk source code that was leaked in 2021. One modification is lowering detection by abusing the legitimate Microsoft signed process: DLL side-loading into NTSD.exe — a Symbolic Debugger tool for Windows. The mechanism to remove the available Shadow Copies was changed to using Component Object Model objects that execute Windows Management Instrumentation queries. This sample was detected in a large, unnamed manufacturing company where attackers had network access and were gathering information for two weeks. They have compromised the company’s domain controller and used it to distribute ransomware to all devices within the organization through Group Policy Object. The delivered BAT script bypasses User Account Control and executes a malicious MSI file that contains files for DLL side-loading and an open-source-based reflective loader (OCS files).<br/> <b>Analyst Comment:</b> The attackers strive to improve their evasion techniques, their malware on certain steps hides behind Microsoft-signed processes and exists primarily in device memory. It increases the need for the defense-in-depth approach and robust monitoring of your organization domain.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/ttp/2402531" target="_blank">[MITRE ATT&CK] Data Encrypted for Impact - T1486</a> | <a href="https://ui.threatstream.com/ttp/3906164" target="_blank">[MITRE ATT&CK] Abuse Elevation Control Mechanism - T1548</a> | <a href="https://ui.threatstream.com/ttp/3905764" target="_blank">[MITRE ATT&CK] Hijack Execution Flow - T1574</a> | <a href="https://ui.threatstream.com/ttp/2402538" target="_blank">[MITRE ATT&CK] Group Policy Modification - T1484</a> | <a href="https://ui.threatstream.com/ttp/3905778" target="_blank">[MITRE ATT&CK] Impair Defenses - T1562</a> | <a href="https://ui.threatstream.com/ttp/947136" target="_blank">[MITRE ATT&CK] Deobfuscate/Decode Files or Information - T1140</a> | <a href="https://ui.threatstream.com/ttp/2402535" target="_blank">[MITRE ATT&CK] Service Stop - T1489</a> | <a href="https://ui.threatstream.com/ttp/2402534" target="_blank">[MITRE ATT&CK] Inhibit System Recovery - T1490</a> | <a href="https://ui.threatstream.com/ttp/3905086" target="_blank">[MITRE ATT&CK] Inter-Process Communication - T1559</a><br/> <b>Tags:</b> detection:Babuk, malware-type:Ransomware, Leaked source code, Russian-speaking, target-industry:Manufacturing, UAC bypass, COM objects, WMI queries, DLL side-loading, file-type:BAT, file-type:MSI, file-type:DLL, file-type:OCS, Windows</p> </div> <div class="trending-threat-article"> <h3><a href="https://www.microsoft.com/en-us/security/blog/2022/12/06/dev-0139-launches-targeted-attacks-against-the-cryptocurrency-industry/" target="_blank">DEV-0139 Launches Targeted Attacks Against the Cryptocurrency Industry</a></h3> <p>(published: December 6, 2022)</p> <p>DEV-0139, a suspected state-sponsored group, has been involved in sophisticated targeting of the cryptocurrency investment industry. The social engineering phase of the attack started in October 2022. The attackers showed a deep knowledge of the targeted industry; they communicated with targets both in existing and in newly-created, attacker-controlled Telegram groups. After gaining initial trust, DEV-0139 delivers malicious macros in an XLS spearphishing attachment (alternative infection chain starts with a malicious MSI file). The attackers rely on DLL side-loading to execute the final payload, the Wolfic implant.<br/> <b>Analyst Comment:</b> Attackers go to a great length in their social engineering attacks and are creating fake professional profiles and groups. It’s important to combine anti-phishing awareness with system hardening. Do not disable runtime macro scanning by Antimalware Scan Interface. Implement rules to block Office applications from creating executable content, block Office communication application from creating child processes, and block Win32 API calls from Office macros.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/ttp/947205" target="_blank">[MITRE ATT&CK] User Execution - T1204</a> | <a href="https://ui.threatstream.com/ttp/3904527" target="_blank">[MITRE ATT&CK] Ingress Tool Transfer - T1105</a> | <a href="https://ui.threatstream.com/ttp/3904523" target="_blank">[MITRE ATT&CK] Rogue Domain Controller - T1207</a> | <a href="https://ui.threatstream.com/ttp/947136" target="_blank">[MITRE ATT&CK] Deobfuscate/Decode Files or Information - T1140</a> | <a href="https://ui.threatstream.com/ttp/3905074" target="_blank">[MITRE ATT&CK] Phishing - T1566</a> | <a href="https://ui.threatstream.com/ttp/3906161" target="_blank">[MITRE ATT&CK] Command and Scripting Interpreter - T1059</a> | <a href="https://ui.threatstream.com/ttp/3905769" target="_blank">[MITRE ATT&CK] Native API - T1106</a> | <a href="https://ui.threatstream.com/ttp/947141" target="_blank">[MITRE ATT&CK] Masquerading - T1036</a> | <a href="https://ui.threatstream.com/ttp/3905071" target="_blank">[MITRE ATT&CK] Application Layer Protocol - T1071</a> | <a href="https://ui.threatstream.com/ttp/947259" target="_blank">[MITRE ATT&CK] Data Encoding - T1132</a> | <a href="https://ui.threatstream.com/ttp/3904494" target="_blank">[MITRE ATT&CK] Exfiltration Over C2 Channel - T1041</a><br/> <b>Tags:</b> actor:DEV-0139, target-industry:Cryptocurrency, Social engineering, Telegram, Cryptocurrency exchange, OKX Binance, Huobi, file-type:XLS, file-type:PNG, file-type:TMP, file-type:MSI, OpenDrive, detection:Wolfic</p> </div> <div class="trending-threat-article"> <h3><a href="https://unit42.paloaltonetworks.com/vice-society-targets-education-sector/" target="_blank">Vice Society: Profiling a Persistent Threat to the Education Sector</a></h3> <p>(published: December 6, 2022)</p> <p>Among ransomware groups targeting the education sector in 2022, Vice Society was the most impactful with at least 33 educational institutions having been listed on the group’s data leak site. Other Vice Society’s common victims include healthcare and regional governments, followed by 15 other targeted industries. The group targeted 29 countries with approximately half of the cases being in the US and the UK. In their attacks, Vice Society uses commodity ransomware families such as the Linux-targeting variant of HelloKitty (FiveHands) and Zeppelin ransomware targeting Windows.<br/> <b>Analyst Comment:</b> Ransomware is an evolving threat that requires a defense-in-depth approach. For backups, follow the 3-2-1 rule: 3 copies, 2 devices, and 1 stored in a secure location. Data loss is manageable through segmentation, off-line storage, encrypting data at rest, and limiting the storage of personal and sensitive data.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/ttp/2402531" target="_blank">[MITRE ATT&CK] Data Encrypted for Impact - T1486</a> | <a href="https://ui.threatstream.com/ttp/3905074" target="_blank">[MITRE ATT&CK] Phishing - T1566</a> | <a href="https://ui.threatstream.com/ttp/947231" target="_blank">[MITRE ATT&CK] Valid Accounts - T1078</a> | <a href="https://ui.threatstream.com/ttp/947138" target="_blank">[MITRE ATT&CK] Exploit Public-Facing Application - T1190</a> | <a href="https://ui.threatstream.com/ttp/947077" target="_blank">[MITRE ATT&CK] Windows Management Instrumentation - T1047</a> | <a href="https://ui.threatstream.com/ttp/947127" target="_blank">[MITRE ATT&CK] Scheduled Task - T1053</a> | <a href="https://ui.threatstream.com/ttp/3906161" target="_blank">[MITRE ATT&CK] Command and Scripting Interpreter - T1059</a> | <a href="https://ui.threatstream.com/ttp/3905040" target="_blank">[MITRE ATT&CK] Create or Modify System Process - T1543</a> | <a href="https://ui.threatstream.com/ttp/3905768" target="_blank">[MITRE ATT&CK] Boot or Logon Autostart Execution - T1547</a> | <a href="https://ui.threatstream.com/ttp/3905764" target="_blank">[MITRE ATT&CK] Hijack Execution Flow - T1574</a> | <a href="https://ui.threatstream.com/ttp/947233" target="_blank">[MITRE ATT&CK] Exploitation for Privilege Escalation - T1068</a> | <a href="https://ui.threatstream.com/ttp/947141" target="_blank">[MITRE ATT&CK] Masquerading - T1036</a> | <a href="https://ui.threatstream.com/ttp/947142" target="_blank">[MITRE ATT&CK] Process Injection - T1055</a> | <a href="https://ui.threatstream.com/ttp/947194" target="_blank">[MITRE ATT&CK] Indicator Removal on Host - T1070</a> | <a href="https://ui.threatstream.com/ttp/947166" target="_blank">[MITRE ATT&CK] Modify Registry - T1112</a> | <a href="https://ui.threatstream.com/ttp/2402543" target="_blank">[MITRE ATT&CK] Virtualization/Sandbox Evasion - T1497</a> | <a href="https://ui.threatstream.com/ttp/3905778" target="_blank">[MITRE ATT&CK] Impair Defenses - T1562</a> | <a href="https://ui.threatstream.com/ttp/3905348" target="_blank">[MITRE ATT&CK] OS Credential Dumping - T1003</a> | <a href="https://ui.threatstream.com/ttp/947276" target="_blank">[MITRE ATT&CK] Network Service Scanning - T1046</a> | <a href="https://ui.threatstream.com/ttp/2402537" target="_blank">[MITRE ATT&CK] Domain Trust Discovery - T1482</a> | <a href="https://ui.threatstream.com/ttp/947162" target="_blank">[MITRE ATT&CK] Remote Services - T1021</a> | <a href="https://ui.threatstream.com/ttp/947110" target="_blank">[MITRE ATT&CK] Taint Shared Content - T1080</a> | <a href="https://ui.threatstream.com/ttp/3904544" target="_blank">[MITRE ATT&CK] Lateral Tool Transfer - T1570</a> | <a href="https://ui.threatstream.com/ttp/947193" target="_blank">[MITRE ATT&CK] Automated Exfiltration - T1020</a> | <a href="https://ui.threatstream.com/ttp/3904494" target="_blank">[MITRE ATT&CK] Exfiltration Over C2 Channel - T1041</a> | <a href="https://ui.threatstream.com/ttp/947224" target="_blank">[MITRE ATT&CK] Exfiltration Over Alternative Protocol - T1048</a> | <a href="https://ui.threatstream.com/ttp/3905082" target="_blank">[MITRE ATT&CK] Exfiltration Over Web Service - T1567</a> | <a href="https://ui.threatstream.com/ttp/947139" target="_blank">[MITRE ATT&CK] Remote Access Tools - T1219</a> | <a href="https://ui.threatstream.com/ttp/3297598" target="_blank">[MITRE ATT&CK] Account Access Removal - T1531</a><br/> <b>Tags:</b> actor:Vice Society, malware-type:Ransomware, target-industry:Education, target-industry:Healthcare, detection:HelloKitty, file-type:ELF, Linux, detection:Zeppelin, Windows, PrintNightmare, CVE-2021-1675, CVE-2021-34527, target-country:US, target-country:UK</p> </div> <div class="trending-threat-article"> <h3><a href="https://blog.sucuri.net/2022/12/infected-wordpress-plugins-redirect-to-push-notification-scam.html" target="_blank">Infected WordPress Plugins Redirect to Push Notification Scam</a></h3> <p>(published: December 6, 2022)</p> <p>A new malicious campaign targeting WordPress websites adds a listener to the whole page’s onclick event causing fraudulent redirects whenever a site visitor clicks on any link. Sucuri researchers discovered that the malicious script avoids detection by using obfuscation followed by unusual hexadecimal encoding of the binary string. Additionally this script detects open Developer Tools using multiple alternative methods, including checks for the following functions: checkByImageMethod, checkDevByScreenResize, detectDevByKeyboard, checkByFirebugMethod, and checkByProfileMethod.<br/> <b>Analyst Comment:</b> Website owners should pay attention to the feedback from website visitors as some malicious activity can be seen only by those who match certain profiling (such as the absence of dev tools). Update and patch your content management system, plugins, themes, and other extensible components.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/ttp/947235" target="_blank">[MITRE ATT&CK] Obfuscated Files or Information - T1027</a><br/> <b>Tags:</b> Redirect, WordPress, WordPress Plugin, Scam, Obfuscation, hex2dec, Compromised website</p> </div> <div class="trending-threat-article"> <h3><a href="https://blog.jscrambler.com/defcon-skimming-a-new-batch-of-web-skimming-attacks" target="_blank">Defcon Skimming: A New Batch of Web Skimming Attacks</a></h3> <p>(published: December 5, 2022)</p> <p>Jscrambler researchers analyzed three new web-skimming clusters (categorized under Magecart umbrella term) dubbed Group X, Group Y, and Group Z. All three were disguising their malicious Javascript as Google code (Google Tag Manager or Google Analytics). Common tactics included code obfuscation, and referrer fingerprinting. Group X was able to mass-inject their code by exploiting a free, third-party JavaScript library that was discontinued in December 2014. They re-registered the abandoned domain name and used it to serve their skimming scripts via the URL that the old library was hosted at.<br/> <b>Analyst Comment:</b> Site administrators should be aware of supply-chain dependencies and remove ones that are unsupported and/or abandoned. Keep their systems updated and secure the administrator panel with two-factor authentication or other access restrictions. If your site was infected, perform a core file integrity check, query for any files containing the same injection, and check any recently modified or added files. All known network indicators associated with this campaign are available in the Anomali platform and customers are advised to block these on their infrastructure.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/ttp/947137" target="_blank">[MITRE ATT&CK] Supply Chain Compromise - T1195</a> | <a href="https://ui.threatstream.com/ttp/947259" target="_blank">[MITRE ATT&CK] Data Encoding - T1132</a> | <a href="https://ui.threatstream.com/ttp/947235" target="_blank">[MITRE ATT&CK] Obfuscated Files or Information - T1027</a><br/> <b>Tags:</b> Supply chain, Web skimming, Cockpit, target-industry:E-commerce, Payment Card Industry, Credit card data, Google Analytics, JavaScript</p> </div>
Discover More About Anomali
Get the latest news about Anomali's Security and IT Operations platform,
Propel your mission with amplified visibility, analytics, and AI.
Learn how Anomali can help you cost-effectively improve your security posture.
