Alex Morgan — Threat Intelligence Analyst
Key Takeaways
- The attack utilized a sophisticated email phishing campaign to initiate credential harvesting.
- Once inside the network, the threat actor leveraged T1569.002 – Container Deployment to deploy malicious containers for lateral movement.
- Indicators of Compromise (IOCs) revealed a multi-stage payload architecture designed for stealth and persistence.
Executive Summary
In our investigation of a targeted credential harvesting campaign, we discovered a well-orchestrated attack leveraging multiple tactics, techniques, and procedures (TTPs) across different stages of the infiltration process. The actor initially gained access via a phishing scheme targeting employees in finance and HR. Post-initial access, we observed various methods used to maintain persistence and facilitate lateral movement throughout the enterprise network. This report will delve into the specifics of the attack, including execution techniques, command and control infrastructure, and potential impacts on the affected organization.
Initial Access
Our analysis revealed that the initial access vector was a highly tailored phishing email campaign. The emails impersonated internal financial communications, containing a malicious link leading to a credential harvesting page hosted on a compromised website. The domain appeared legitimate, thereby deceiving users into inputting their credentials. Using T1566.001 – Phishing: Spear Phishing Link, the actor targeted specific employees, significantly increasing the chances of success. Once the victim entered their login details, the credentials were siphoned off to a remote server controlled by the threat actor.
Execution & Persistence
After successfully harvesting credentials, the actor proceeded to establish a foothold within the network. We observed them using T1071.001 – Application Layer Protocol: Web Protocols for communication with their command and control (C2) server via standard HTTPS traffic, effectively blending in with legitimate user activities. During the investigation, we traced the execution of a PowerShell script that employed Invoke-WebRequest to download a second-stage payload — a modular backdoor we identified as Shadownet. The backdoor allowed the actor to create persistence through registry alterations at HKCU\Software\Microsoft\Windows\CurrentVersion\Run, where they added an entry to ensure re-execution at every system startup.
Command and Control
Our examination of the C2 infrastructure revealed a robust framework designed to operate under the radar. The malicious payload generated periodic beacons to the C2 server using T1071.003 – Application Layer Protocol: Mail Protocols, which provided a convincing layer of encryption and obfuscation. The server responded with commands that enabled the actor to exfiltrate data and deploy additional tools as needed. The C2 domains were registered through known bulletproof hosting services, thus complicating mitigation efforts. We discovered that the control server was capable of dynamically adjusting its IP address, evading IP-based blocking strategies.
Lateral Movement & Discovery
As the incident response progressed, we traced lateral movement techniques back to the initial compromise point. The backdoor allowed the actor to leverage valid credentials to access shared resources across the network. Using T1075 – Pass the Hash, they exploited stored NTLM hashes from compromised machines to access additional administrative shares. Tools like Mimikatz were likely utilized to aid in harvesting further credentials. We also identified their use of T1080 – Taint Shared Content where they manipulated user access controls to facilitate movement to sensitive systems.
Impact & Objectives
The ultimate objective of this attack appeared to be the exfiltration of sensitive corporate information and financial data. During our investigation, we identified large data sets being compressed and encrypted before transmission back to the threat actor’s C2 server. The actors had designed this operation to blend in with regular network traffic, significantly complicating detection efforts for security operations teams. As the attack unfolded, the potential for financial fraud and reputational damage to the organization heightened, necessitating urgent remediation measures.
MITRE ATT&CK Mapping
- T1566.001 – Phishing: Spear Phishing Link: A spear phishing campaign targeted employees, leading to credential harvesting.
- T1071.001 – Application Layer Protocol: Web Protocols: C2 communication established over HTTPS.
- T1075 – Pass the Hash: Lateral movement facilitated by utilizing NTLM hashes obtained from compromised systems.
Detection Opportunities
- Implement monitoring for anomalous email traffic patterns indicative of phishing campaigns.
- Utilize endpoint detection and response (EDR) tools to identify suspicious PowerShell activity and specific registry modifications.
- Monitor for unexpected outbound connections to known C2 domains or IP addresses involved in credential harvesting campaigns.
Analyst Notes
Investigating this campaign has highlighted the importance of user training in recognizing phishing attempts and the value of layered security strategies. The threat landscape continues to evolve; therefore, ongoing vigilance and adaptation of detection capabilities are essential to mitigate future risks. Additionally, integrating threat intelligence feeds into security platforms can enhance active defenses, allowing for real-time responses to emerging TTPs.
Source: Original Report