Sarah Chen — Malware Reverse Engineer
Key Takeaways
- Targeted phishing campaigns leveraging social engineering to gain initial access.
- Utilization of PowerShell for execution and persistence, showcasing the actor’s focus on stealth.
- Command and Control (C2) infrastructure employed tactics to evade detection while maintaining access.
Executive Summary
During our investigation into a recent compromise linked to the Lacey threat actor, we observed a sophisticated attack chain characterized by initial access via phishing, followed by stealthy execution using PowerShell. Our analysis revealed a dedicated C2 setup that employed encrypted communication to obfuscate traffic. The incident spotlighted effective lateral movement strategies leveraging native tools and showcased the actor’s strategic objectives to exfiltrate sensitive information.
Initial Access
The attack began with well-crafted phishing emails targeting high-level executives within the organization. The emails contained malicious attachments disguised as legitimate documents. When opened, these attachments executed a macro that triggered a PowerShell script, linking back to the actor’s infrastructure. The initial communication pointed to a Dynamic DNS service, indicating a preference for anonymity in their operations.
Execution & Persistence
Upon execution, the PowerShell script downloaded additional components from the C2 server, establishing a foothold within the environment. This included a web shell which allowed the actor to execute commands on the compromised host remotely. The persistence mechanism involved the creation of a scheduled task under C:\Windows\System32\Tasks\LaceyPersistence, which ensured that the malicious payload was executed on system startup, further solidifying their access.
Command and Control
The C2 communications revealed a carefully orchestrated setup where the actor employed various domains registered shortly prior to the attack. Utilizing encrypted HTTPS traffic, they managed to avoid detection by traditional security tools. Communication patterns indicated a regular beaconing every 10 minutes, tipped off by data exfiltration attempts using Base64 encoding over a custom REST API. This method of obfuscation significantly hindered our detection efforts.
Lateral Movement & Discovery
After establishing presence, the actor utilized Windows Management Instrumentation (WMI) for lateral movement across the network. With access to credential dumps captured through a PowerShell script, they leveraged these credentials to access additional hosts. The lateral movement was facilitated by executing commands such as wmic /node:TARGET_IP process call create
Source: Original Report