Sarah Chen — Malware Reverse Engineer
Key Takeaways
- The recent AVEVA malware campaign utilizes sophisticated phishing methods for initial access.
- Attackers establish command and control (C2) through a series of encrypted communications, evading traditional detection techniques.
- Post-exploitation tactics reveal lateral movement strategies that underscore the importance of monitoring internal network traffic for anomalous behavior.
Executive Summary
During our investigation into the recent malware campaign attributed to a sophisticated threat actor targeting AVEVA systems, we uncovered a multi-stage attack chain characterized by heavily obfuscated payloads and a focus on industrial control systems (ICS). The preliminary phase of the attack leveraged social engineering tactics to bypass initial defenses, while subsequent stages involved persistent access leveraging advanced lateral movement techniques. Our analysis focused on the actor’s use of the Sysinternals Suite tools for reconnaissance and the deployment of custom malware designed to extract sensitive data without triggering conventional alerts.
Initial Access
The attack began with spear-phishing emails crafted to impersonate legitimate AVEVA communication. We observed the actor utilizing malicious documents with embedded macros, which, when enabled, downloaded the primary payload from a compromised web server. By executing a PowerShell script embedded in the document, the initial access was seamlessly achieved without raising immediate alarms. The script then executed commands to download the second stage payload, a variant of Emotet, which we traced through behavioral analysis to its source—indicative of the actor’s meticulous planning.
Execution & Persistence
Upon execution, the Emotet variant not only established a foothold but also continued the infection process. Using %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\, the actor ensured that the implant would persist through system reboots. In addition, our analysis revealed the creation of a registry entry at HKCU\Software\Microsoft\Windows\CurrentVersion\Run\, employed to execute the malware on user login. During this phase, the malware utilized reflective DLL injection to evade detection by mainstream antivirus platforms.
Command and Control
The C2 infrastructure employed was particularly sophisticated, leveraging a blend of hard-coded IPs and domain generation algorithms (DGAs) to frequently rotate endpoints. Communications were heavily encrypted using AES, complicating our deep packet inspection efforts. We noted that the implant would perform regular heartbeats against the C2 server every 30 seconds, utilizing non-standard ports typically used for other communications to blend in with legitimate traffic. This level of obfuscation indicated the actor’s awareness of defensive monitoring practices.
Lateral Movement & Discovery
After establishing a reliable C2 link, lateral movement techniques employed by the actor relied on stolen credentials harvested from the initial infection. We observed logins to several valid user accounts utilizing common tools like Psexec and WMIC to execute commands on other machines in the environment. Discovery techniques, including Credential Dumping (T1003) and Remote File Copy (T1105), were integral to expanding their control over the network. Our investigations helped identify a pattern of unusual authentication requests, prompting urgent investigation into user privileges to mitigate potential data loss.
Impact & Objectives
The ultimate goal of this AVEVA targeting operation appeared to be the exfiltration of industrial control systems data and proprietary project details, likely aimed at future competitive leverage. The malware deployed multiple exfiltration vectors including secure FTP (SFTP) and email-based operations that triggered alerts in some environments. However, due to the well-crafted tactics, many enterprises were left unaware of the ongoing operation. This underscores not only the threat to intellectual property but also the potential jeopardy faced by physical infrastructure reliant on compromised ICS.
MITRE ATT&CK Mapping
- T1193 – Spear Phishing Link: The initial spear-phishing emails containing malicious document links.
- T1059.001 – PowerShell – Command and Scripting Interpreter: The usage of PowerShell in the embedded scripts to execute the next stage payload.
- T1071.001 – Application Layer Protocol: Web Protocols: Communication with C2 over HTTPS, utilizing encrypted traffic patterns.
- T1075 – Pass the Hash: The lateral movement strategy employed through stolen credentials.
Detection Opportunities
- Implement regular monitoring for unusual outbound connections to known C2 IPs, especially those utilizing non-standard ports.
- Configure endpoint solutions to detect and remediate suspicious PowerShell activity, particularly concerning script execution from unexpected directories.
- Enhance logging on authentication events, particularly across administrative accounts, to identify and respond to potential lateral movement activities.
Analyst Notes
Our investigation highlighted the need for organizations to bolster their defenses not just at the network perimeter but also internally, focusing on user behavior analytics and continuous monitoring. As attackers evolve their techniques, staying ahead requires a proactive and adaptive security posture. Additionally, training employees to recognize phishing tactics remains a cornerstone of preventing initial access.
Source: Original Report