Blog
Anomali Cyber Watch: Cozy Bear TTPs, Darkside Ransomware Shuts Down US Pipeline, Operation TunnelSnake Uses New Moriya Rootkit, and More
Anomali Threat Research
May 12, 2021
<p>The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics:<b> APT, Fileless Malware, Malspam, Phishing, Ransomware, Rootkits, Targeted Attacks </b> and <b> Vulnerabilities</b>. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity.</p> <p><img src="https://cdn.filestackcontent.com/LgYJd7neQQGF8XhzPPfT"/><br/> <em>Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this agazine and provide a glimpse of the threats discussed.</em></p> <h2>Trending Cyber News and Threat Intelligence</h2> <div class="trending-threat-article"> <h3 id="article-1"><a href="https://www.bloomberg.com/news/articles/2021-05-09/colonial-hackers-stole-data-thursday-ahead-of-pipeline-shutdown" target="_blank">Darkside Ransomware Caused Major US Pipeline Shutdown</a></h3> <p>(published: May 8, 2021)</p> <p>DarkSide ransomware attack caused Colonial Pipeline to shut down the biggest US gasoline pipeline on Friday, May 7th, 2021. The pipeline is the main source of gasoline, diesel and jet fuel for the US East Coast and runs from Texas to Tennessee and New Jersey serving up to 50 Million people. DarkSide group began their attack against the company a day earlier, stealing nearly 100 gigabytes of data before locking computers with ransomware and demanding payment.<br/> <b>Analyst Comment:</b> While DarkSide's first known activity goes back only to August 2020, it is likely backed by experienced Eastern-European actors. Ransomware protection demands a multi-layered approach to include isolation, air-gaps, backup solutions, anti-phishing training and detection.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/2402531" target="_blank">[MITRE ATT&CK] Data Encrypted for Impact - T1486</a> | <a href="https://ui.threatstream.com/ttp/2402534" target="_blank">[MITRE ATT&CK] Inhibit System Recovery - T1490</a> | <a href="https://ui.threatstream.com/ttp/947201" target="_blank">[MITRE ATT&CK] Scripting - T1064</a><br/> <b>Tags:</b> DarkSide, ransomware, Oil and Gas, USA, Colonial Pipeline</p> </div> <div class="trending-threat-article"> <h3 id="article-2"><a href="https://blog.morphisec.com/revealing-the-snip3-crypter-a-highly-evasive-rat-loader" target="_blank">Revealing The 'Cnip3' Crypter, A Highly Evasive RAT Loader</a></h3> <p>(published: May 7, 2021)</p> <p>Morphisec has discovered a new stealthy crypter as a service dubbed Snip3. Its advanced anti-detection techniques include: 1) Executing PowerShell code with the ‘remotesigned’ parameter. 2) Validating the existence of Windows Sandbox and VMWare virtualization. 3) Using Pastebin and top4top for staging. 4) Compiling RunPE loaders on the endpoint in runtime. Several hackers were observed using Snip3 to deliver various payloads: AsyncRAT, NetWire RAT, RevengeRAT, and Agent Tesla.<br/> <b>Analyst Comment:</b> The Snip3 Crypter’s ability to identify sandboxing and virtual environments make it especially capable of bypassing detection-centric solutions. It shows the value of investing in complex cybersecurity solutions.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/2402543" target="_blank">[MITRE ATT&CK] Virtualization/Sandbox Evasion - T1497</a> | <a href="https://ui.threatstream.com/ttp/947191" target="_blank">[MITRE ATT&CK] Command-Line Interface - T1059</a> | <a href="https://ui.threatstream.com/ttp/947142" target="_blank">[MITRE ATT&CK] Process Injection - T1055</a><br/> <b>Tags:</b> Snip3, crypter, Crypter-as-a-Service, VBS, RAT, AsyncRAT, NetWire RAT, RevengeRAT, Agent Tesla, NYANxCAT</p> </div> <div class="trending-threat-article"> <h3 id="article-3"><a href="https://blog.talosintelligence.com/2021/05/lemon-duck-spreads-wings.html" target="_blank">Lemon Duck target Microsoft Exchange Servers, Incorporate New TTPs</a></h3> <p>(published: May 7, 2021)</p> <p>The Lemon Duck cryptomining group has been active since at least the end of December 2018. In March 2021, Microsoft described them targeting Exchange Servers. On May 7th, 2021, Cisco Talos and Sophos independently published new TTPs for the group. Lemon Duck continues to incorporate new tools, such as Cobalt Strike, into their malware toolkit. The use of fake domains on East Asian top-level domains (TLDs) masks connections to the actual command and control (C2) infrastructure used in these campaigns.<br/> <b>Analyst Comment:</b> The use of new tools like Cobalt Strike, as well as the implementation of additional obfuscation techniques throughout the attack lifecycle, may enable Lemon Duck to operate more effectively for longer periods within victim environments. Organizations should remain vigilant against this threat, as it will likely continue to evolve.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947235" target="_blank">[MITRE ATT&CK] Obfuscated Files or Information - T1027</a> | <a href="https://ui.threatstream.com/ttp/947287" target="_blank">[MITRE ATT&CK] PowerShell - T1086</a> | <a href="https://ui.threatstream.com/ttp/947256" target="_blank">[MITRE ATT&CK] Uncommonly Used Port - T1065</a> | <a href="https://ui.threatstream.com/ttp/947247" target="_blank">[MITRE ATT&CK] Web Shell - T1100</a><br/> <b>Tags:</b> Lemon Duck, Microsoft Exchange, Cobalt Strike, China Chopper, CertUtil, cryptomining, Monero, CVE-2021-26857, CVE-2021-26855, CVE-2021-27065, CVE-2021-26858</p> </div> <div class="trending-threat-article"> <h3 id="article-4"><a href="https://www.ncsc.gov.uk/files/Advisory%20Further%20TTPs%20associated%20with%20SVR%20cyber%20actors.pdf" target="_blank">Russia’s SVR Uses Sliver Framework and Multiple Publicly Available Exploits</a></h3> <p>(published: May 7, 2021)</p> <p>Cybersecurity experts monitor cyber activity from Russian Foreign Intelligence Service (SVR) under aliases Cozy Bear and APT29. SVR’s most recent attacks included the compromise of SolarWinds, MimeCast, and the targeting of COVID-19 vaccine developers. This joint report by the US and UK agencies provides additional tactics, techniques and procedures (TTPs) for these activities. SVR’s use of publicly-available tools included Cobalt Strike and Sliver framework. Their featured custom tools include GoldFinder, GoldMax backdoor, and Sibot malware. GoldFinder, GoldMax, and Sliver are written in Golang.<br/> <b>Analyst Comment:</b> SVR operators appear to have changed their TTPs after previous reporting of their use of WellMess and WellMail malware. Despite the complexity of supply chain attacks, following basic cyber security principles will make it harder for even sophisticated actors to compromise target networks. By implementing good network security controls and effectively managing user privileges organizations will help prevent lateral movement between hosts.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947138" target="_blank">[MITRE ATT&CK] Exploit Public-Facing Application - T1190</a> | <a href="https://ui.threatstream.com/ttp/947220" target="_blank">[MITRE ATT&CK] Trusted Relationship - T1199</a> | <a href="https://ui.threatstream.com/ttp/947191" target="_blank">[MITRE ATT&CK] Command-Line Interface - T1059</a> | <a href="https://ui.threatstream.com/ttp/947231" target="_blank">[MITRE ATT&CK] Valid Accounts - T1078</a> | <a href="https://ui.threatstream.com/ttp/947098" target="_blank">[MITRE ATT&CK] Email Collection - T1114</a> | <a href="https://ui.threatstream.com/ttp/3297595" target="_blank">[MITRE ATT&CK] Server Software Component - T1505</a> | <a href="https://ui.threatstream.com/ttp/947137" target="_blank">[MITRE ATT&CK] Supply Chain Compromise - T1195</a><br/> <b>Tags:</b> Cozy Bear, APT29, SVR, Russia, APT, GoldFinder, GoldMax, Sibot, Sliver, Cobalt Strike, Golang, CVE-2018-13379, CVE-2019-1653, CVE-2019-2725, CVE-2019-9670, CVE-2019-11510, CVE-2019-19781, CVE-2019-7609, CVE-2020-4006, CVE-2020-5902, CVE-2020-14882, CVE-2021-21972, CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065</p> </div> <div class="trending-threat-article"> <h3 id="article-5"><a href="https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831/" target="_blank">Operation TunnelSnake: Formerly Unknown Rootkit Used to Secretly Control Networks of Regional Organizations</a></h3> <p>(published: May 6, 2021)</p> <p>The TunnelSnake campaign demonstrates the activity of a sophisticated Chinese actor that invests significant resources in designing an evasive toolset and highly targeted infiltration of networks of high-profile organizations. In 2018-2020, the campaign targeted diplomatic organizations in Asia and Africa. The group uses some old tools (e.g. China Chopper webshell, BOUNCER), as well its own rootkits (IISSPy active in 2018, ProcessKiller, and their newest, Moriya rootkit). Moriya ensures that the packet inspection happens in kernel mode with the use of a Windows driver, allowing attackers to drop the packets of interest before they are processed by the network stack, thus ensuring they are not detected by security solutions. Additionally, the fact that the Moriya rootkit waits for incoming traffic rather than initiating a connection to a server itself, avoids the need to incorporate a command and control (C2) address in the malware’s binary or to maintain a steady C2 infrastructure.<br/> <b>Analyst Comment:</b> With Microsoft’s introduction of Driver Signature Enforcement and Kernel Patch Protection, the number of Windows rootkits in the wild has decreased dramatically, but high-profile advanced persistent threat (APT) groups still manage to operate sophisticated rootkits like TunnelSnake’s Moriya. Despite Moriya’s efforts in establishing covert communication channels, some other tools used during the TunnelSnake campaign (like the usage of a commodity webshell and open-source legacy code for loading unsigned drivers) made it easier to detect intrusion.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947207" target="_blank">[MITRE ATT&CK] Process Discovery - T1057</a> | <a href="https://ui.threatstream.com/ttp/947109" target="_blank">[MITRE ATT&CK] Security Software Discovery - T1063</a> | <a href="https://ui.threatstream.com/ttp/947191" target="_blank">[MITRE ATT&CK] Command-Line Interface - T1059</a> | <a href="https://ui.threatstream.com/ttp/947092" target="_blank">[MITRE ATT&CK] Rootkit - T1014</a> | <a href="https://ui.threatstream.com/ttp/947173" target="_blank">[MITRE ATT&CK] Hooking - T1179</a> | <a href="https://ui.threatstream.com/ttp/947148" target="_blank">[MITRE ATT&CK] New Service - T1050</a> | <a href="https://ui.threatstream.com/ttp/947142" target="_blank">[MITRE ATT&CK] Process Injection - T1055</a> | <a href="https://ui.threatstream.com/ttp/947276" target="_blank">[MITRE ATT&CK] Network Service Scanning - T1046</a> | <a href="https://ui.threatstream.com/ttp/947125" target="_blank">[MITRE ATT&CK] System Information Discovery - T1082</a><br/> <b>Tags:</b> Moriya rootkit, ProcessKiller, IISSPy, TunnelSnake, China, Asia, Africa, Government, APT, China Chopper, PSExec, BOUNCER, CVE-2017-7269</p> </div> <div class="trending-threat-article"> <h3 id="article-6"><a href="https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a" target="_blank">FiveHands Ransomware Comes With SombRAT</a></h3> <p>(published: May 6, 2021)</p> <p>US Cybersecurity and Infrastructure Security Agency (CISA) released a report analyzing a cyberattack against an organization using a new ransomware variant, known as FiveHands. FiveHands uses a public key encryption scheme called NTRUEncrypt. These threat actors used FiveHands ransomware, SombRAT, and publicly available penetration testing and exploitation tools (such as SoftPerfect Network Scanner). They steal information, obfuscate files, and demand a ransom.<br/> <b>Analyst Comment:</b> Decommission unused VPN servers, which may act as a point of entry for attackers. Monitor network traffic for unexpected and unapproved protocols, especially outbound to the internet (e.g., SSH, SMB, RDP). Disable unnecessary services on agency workstations and servers.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947276" target="_blank">[MITRE ATT&CK] Network Service Scanning - T1046</a> | <a href="https://ui.threatstream.com/ttp/2402534" target="_blank">[MITRE ATT&CK] Inhibit System Recovery - T1490</a> | <a href="https://ui.threatstream.com/ttp/947077" target="_blank">[MITRE ATT&CK] Windows Management Instrumentation - T1047</a> | <a href="https://ui.threatstream.com/ttp/2402531" target="_blank">[MITRE ATT&CK] Data Encrypted for Impact - T1486</a> | <a href="https://ui.threatstream.com/ttp/947195" target="_blank">[MITRE ATT&CK] File and Directory Discovery - T1083</a> | <a href="https://ui.threatstream.com/ttp/947191" target="_blank">[MITRE ATT&CK] Command-Line Interface - T1059</a> | <a href="https://ui.threatstream.com/ttp/947278" target="_blank">[MITRE ATT&CK] Remote File Copy - T1105</a> | <a href="https://ui.threatstream.com/ttp/947136" target="_blank">[MITRE ATT&CK] Deobfuscate/Decode Files or Information - T1140</a> | <a href="https://ui.threatstream.com/ttp/947235" target="_blank">[MITRE ATT&CK] Obfuscated Files or Information - T1027</a> | <a href="https://ui.threatstream.com/ttp/947125" target="_blank">[MITRE ATT&CK] System Information Discovery - T1082</a> | <a href="https://ui.threatstream.com/ttp/947082" target="_blank">[MITRE ATT&CK] System Owner/User Discovery - T1033</a> | <a href="https://ui.threatstream.com/ttp/947207" target="_blank">[MITRE ATT&CK] Process Discovery - T1057</a> | <a href="https://ui.threatstream.com/ttp/947285" target="_blank">[MITRE ATT&CK] System Time Discovery - T1124</a> | <a href="https://ui.threatstream.com/ttp/947141" target="_blank">[MITRE ATT&CK] Masquerading - T1036</a> | <a href="https://ui.threatstream.com/ttp/947190" target="_blank">[MITRE ATT&CK] Connection Proxy - T1090</a> | <a href="https://ui.threatstream.com/ttp/947200" target="_blank">[MITRE ATT&CK] System Network Connections Discovery - T1049</a><br/> <b>Tags:</b> FiveHands, SombRAT, NTRUEncrypt, SoftPerfect Network Scanner, ransomware, RAT</p> </div> <div class="trending-threat-article"> <h3 id="article-7"><a href="https://www.mcafee.com/blogs/other-blogs/mcafee-labs/roaming-mantis-amplifies-smishing-campaign-with-os-specific-android-malware/" target="_blank">Roaming Mantis Amplifies Smishing Campaign with OS-Specific Android Malware</a></h3> <p>(published: May 5, 2021)</p> <p>Roaming Mantis has been using SMS phishing (smishing) to steal SMS messages and contact lists from Asian Android users since 2018. In the second half of 2020, the campaign improved its effectiveness by adopting dynamic DNS services and spreading messages with phishing URLs that infected victims with the fake Chrome application MoqHao. Recently, since January 2021, Roaming Mantis started targeting Japanese Android users with new malware called SmsSpy. The malicious code infects Android users using one of two variants depending on the version of OS used: fake Google Play app on Android OS 10 or later, and fake Chrome app on Android 9 or earlier devices. The MoqHao family hides C2 (Command and Control) server locations in the user profile page of a blog service, yet some samples of SmsSpy use a Chinese online document service to hide C2 locations.<br/> <b>Analyst Comment:</b> Cell phone users should always use caution when receiving a short message with a shortened link inside. If a page prompts you to update your browser or operating system, try updating through settings/regular update procedure instead. You should never install apps from untrusted sources.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947125" target="_blank">[MITRE ATT&CK] System Information Discovery - T1082</a> | <a href="https://ui.threatstream.com/ttp/947210" target="_blank">[MITRE ATT&CK] Exfiltration Over Command and Control Channel - T1041</a><br/> <b>Tags:</b> Roaming Mantis, China, Japan, smishing, MoqHao, SmsSpy, SpyAgent, FakeSpy, Android</p> </div> <div class="trending-threat-article"> <h3 id="article-8"><a href="https://www.fireeye.com/blog/threat-research/2021/05/unc2529-triple-double-trifecta-phishing-campaign.html" target="_blank">The UNC2529 Triple Double: A Trifecta Phishing Campaign</a></h3> <p>(published: May 4, 2021)</p> <p>In December 2020, Mandiant observed a widespread, global phishing campaign targeting numerous organizations across an array of industries. This new unknown actor (UNC2529) often used highly customized subject lines for their phishing emails, but sometimes failed to use proper American English. This blog post will discuss the campaign, identification of three new malware families, downloader DOUBLEDRAG, fileless dropper DOUBLEDROP and fileless backdoor DOUBLEBACK.<br/> <b>Analyst Comment:</b> The threat actor made extensive use of hosting infrastructure, obfuscation and fileless malware to complicate detection to deliver a well coded and extensible backdoor. Organizations should work to build defence-in-depth starting from anti-phishing solutions and finishing with network-based detections.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947142" target="_blank">[MITRE ATT&CK] Process Injection - T1055</a> | <a href="https://ui.threatstream.com/ttp/947166" target="_blank">[MITRE ATT&CK] Modify Registry - T1112</a> | <a href="https://ui.threatstream.com/ttp/947278" target="_blank">[MITRE ATT&CK] Remote File Copy - T1105</a> | <a href="https://ui.threatstream.com/ttp/947136" target="_blank">[MITRE ATT&CK] Deobfuscate/Decode Files or Information - T1140</a> | <a href="https://ui.threatstream.com/ttp/947207" target="_blank">[MITRE ATT&CK] Process Discovery - T1057</a> | <a href="https://ui.threatstream.com/ttp/947082" target="_blank">[MITRE ATT&CK] System Owner/User Discovery - T1033</a> | <a href="https://ui.threatstream.com/ttp/947287" target="_blank">[MITRE ATT&CK] PowerShell - T1086</a> | <a href="https://ui.threatstream.com/ttp/947205" target="_blank">[MITRE ATT&CK] User Execution - T1204</a> | <a href="https://ui.threatstream.com/ttp/947252" target="_blank">[MITRE ATT&CK] Query Registry - T1012</a> | <a href="https://ui.threatstream.com/ttp/947194" target="_blank">[MITRE ATT&CK] Indicator Removal on Host - T1070</a> | <a href="https://ui.threatstream.com/ttp/947191" target="_blank">[MITRE ATT&CK] Command-Line Interface - T1059</a> | <a href="https://ui.threatstream.com/ttp/947079" target="_blank">[MITRE ATT&CK] Screen Capture - T1113</a> | <a href="https://ui.threatstream.com/ttp/947235" target="_blank">[MITRE ATT&CK] Obfuscated Files or Information - T1027</a> | <a href="https://ui.threatstream.com/ttp/947125" target="_blank">[MITRE ATT&CK] System Information Discovery - T1082</a> | <a href="https://ui.threatstream.com/ttp/947148" target="_blank">[MITRE ATT&CK] New Service - T1050</a> | <a href="https://ui.threatstream.com/ttp/947189" target="_blank">[MITRE ATT&CK] Account Discovery - T1087</a> | <a href="https://ui.threatstream.com/ttp/947126" target="_blank">[MITRE ATT&CK] Standard Application Layer Protocol - T1071</a> | <a href="https://ui.threatstream.com/ttp/947127" target="_blank">[MITRE ATT&CK] Scheduled Task - T1053</a> | <a href="https://ui.threatstream.com/ttp/3297596" target="_blank">[MITRE ATT&CK] Software Discovery - T1518</a> | <a href="https://ui.threatstream.com/ttp/947201" target="_blank">[MITRE ATT&CK] Scripting - T1064</a><br/> <b>Tags:</b> UNC2529, DOUBLEDRAG, BIFF8 macro, DOUBLEBACK, DOUBLEDROP, USA, Banking And Finance, Military, Engineering, Health, Telecom, Government, malware evolution, fileless</p> </div> <div class="trending-threat-article"> <h3 id="article-9"><a href="https://www.bleepingcomputer.com/news/security/new-windows-pingback-malware-uses-icmp-for-covert-communication/" target="_blank">New Windows Pingback Malware Uses ICMP for Covert Communication</a></h3> <p>(published: May 4, 2021)</p> <p>Pingback malware targets Microsoft Windows 64-bit systems, and uses DLL Hijacking to gain persistence. The malicious file in question is a DLL called oci.dll and was being dropped within Windows "System" folder. While the initial entry vector is still being investigated, another malware sample, with file name updata.exe was observed both dropping similar malicious oci.dll and configuring msdtc to run on every startup. The oci.dll malware once launched by msdtc, uses ICMP for stealthily receiving commands from its C2 server. The size of the ICMP data sent by the attacker is always 788 bytes. ICMP has no concept of "ports" and uses neither TCP nor UDP. As such, oci.dll may not be picked up by diagnostic tools like netstat.<br/> <b>Analyst Comment:</b> Since ICMP also has legitimate use-cases as a diagnostic tool, the researchers' advice is not to disable it, but rather putting monitoring mechanisms in place to detect any suspicious ICMP traffic.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947147" target="_blank">[MITRE ATT&CK] DLL Search Order Hijacking - T1038</a> | <a href="https://ui.threatstream.com/ttp/947244" target="_blank">[MITRE ATT&CK] Exploitation for Client Execution - T1203</a> | <a href="https://ui.threatstream.com/ttp/947141" target="_blank">[MITRE ATT&CK] Masquerading - T1036</a> | <a href="https://ui.threatstream.com/ttp/947224" target="_blank">[MITRE ATT&CK] Exfiltration Over Alternative Protocol - T1048</a><br/> <b>Tags:</b> Pingback, ICMP tunneling, DLL hijacking</p> </div> <div class="trending-threat-article"> <h3 id="article-10"><a href="https://www.darkreading.com/threat-intelligence/newer-generic-top-level-domains-a-security-nuisance-/d/d-id/1340922" target="_blank">Newer Generic Top-Level Domains a Security 'Nuisance'</a></h3> <p>(published: May 4, 2021)</p> <p>Farsight Security analyzed a decade of passive DNS data for over 1 Billion effective 2nd-level domains across each of the 1,576 IANA-recognized TLDs. The data around TLD use suggests that adding more TLDs was rather pointless nuisance than valuable extension of the namespace. There is no evidence of the broad migration to sector-specific TLDs that many had expected initially. The analysts don't see entire sectors — for example, banks — dropping .com as a primary TLD and refocusing on .bank. From a security perspective, one concern with the growth in the number of TLDs over the past few years is that attackers have more opportunities for spoofing domains for phishing, cyber squatting, and other malicious activities.<br/> <b>Analyst Comment:</b> CISOs should access TLDs based on their relevance and risk level to their organization. Following securities measures range from completely blocking certain unpopular frequently abused TLDs to defensive domain registering on various TLDs in varied grammatical formats and considering substring matching.<br/> <b>Tags:</b> DNS, TLD, typosquatting</p> </div>
Discover More About Anomali
Get the latest news about Anomali's Security and IT Operations platform,
No items found.
Propel your mission with amplified visibility, analytics, and AI.
Learn how Anomali can help you cost-effectively improve your security posture.
