Priya Nair — Digital Forensics Analyst
Key Takeaways
- The threat actor employed T1193 – Spear Phishing Link to initiate the attack chain.
- We detected the use of a custom PowerShell dropper to execute the payload and maintain persistence.
- Command and control operations utilized HTTPS for stealthy communications with the compromised hosts.
Executive Summary
During our investigation of Operation Shadowfall, we analyzed a sophisticated malware campaign targeting corporate environments. The campaign demonstrates a high level of sophistication, utilizing social engineering techniques to gain initial access, followed by complex execution methods. Our analysis revealed a well-planned attack chain that included extensive lateral movement, leveraging common administrative tools while ensuring minimal detection risks. The primary objective of the actor appeared to be data exfiltration and establishing a foothold within the victim’s network.
Initial Access
Our investigation into the initial access phase indicated that the threat actor primarily relied on T1193 – Spear Phishing Link. The actor sent targeted emails to employees containing a malicious link, cleverly disguised as a legitimate Office 365 login page. When users entered their credentials, these were harvested by the actor, enabling unauthorized access to their accounts. One of the URLs used was hxxps://legitwebsite.com/credentials, which redirected users to a phishing server hosted on a compromised web server.
Execution & Persistence
The next phase involved the deployment of a custom PowerShell script as the dropper. This script was cleverly encoded to evade static detection and executed upon credential theft. The PowerShell script was responsible for downloading the main payload from an external source, specifically hosted at hxxps://malicious-server.com/payload.exe. Furthermore, we observed that the actor implemented persistence using the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key to ensure the malware would execute upon user login. The entry created was categorized under a benign name to avoid suspicion.
Command and Control
The malware exhibited an extensive use of HTTPS for communication with its command and control servers, making detection challenging. Our analysis revealed periodic pinging to the remote server every five minutes for command retrieval. We identified several C2 domains used during the campaign, including hxxps://c2.example.com, which employed valid SSL certificates to further mask its malicious activities. This tactic allowed the actor to bypass many traditional security measures that lack SSL inspection.
Lateral Movement & Discovery
Once the attacker secured initial access, our investigation revealed significant lateral movement activities. They employed T1076 – Remote Desktop Protocol to access other internal systems, leveraging stolen credentials obtained during the initial access phase. We observed unauthorized login attempts to various workstations within the network that were part of the Active Directory domain. Additionally, the actor executed reconnaissance commands to enumerate groups and identify high-value targets, utilizing tools like PowerShell and WMIC to extract user and computer details from the domain.
Furthermore, the use of T1083 – File and Directory Discovery allowed the actor to identify sensitive data repositories, increasing the potential impact of their operations.
Impact & Objectives
The ultimate goal of the threat actor appeared to be data exfiltration. The malware was equipped with capabilities to search for specific file types, such as documents, spreadsheets, and databases, especially those containing identifiable PII and financial information. During our analysis, we discovered that once the actor determined which files to target, they utilized encrypted archives for exfiltration, further obfuscating their activities. Files were compressed using WinRAR and subsequently sent to a cloud storage service for retrieval.
MITRE ATT&CK Mapping
- T1193 – Spear Phishing Link: Attackers send malicious links via email to target users.
- T1059.001 – PowerShell: Execution of commands and scripts via PowerShell.
- T1076 – Remote Desktop Protocol: Use of RDP to communicate with and control systems remotely.
- T1083 – File and Directory Discovery: Searching through filesystem to locate sensitive data.
Detection Opportunities
- Implement monitoring for PowerShell command execution, particularly those that download external content.
- Set rules to detect unusual RDP login patterns, especially from external IPs.
- Employ a web proxy with SSL inspection to catch potentially malicious outbound traffic to known C2 domains.
Analyst Notes
The complexity and thoroughness of Operation Shadowfall highlight the evolving nature of threat actors and their methodologies. As we continue to monitor these trends, it is imperative to focus on enhancing detection capabilities and incident response protocols. Continuous education surrounding phishing tactics and credential harvesting will be paramount in protecting organizations against such sophisticated threats.
Source: Original Report