Priya Nair — Digital Forensics Analyst
Key Takeaways
- The attack chained multiple techniques from initial phishing to Qakbot deployment, leading to subsequent ransomware payload deployment.
- The prominent use of T1071 – Application Layer Protocol indicated sophisticated command and control (C2) capabilities, utilizing legitimate services to obfuscate communications.
- Investigation revealed lateral movement techniques including T1021 – Remote Services, utilizing native tools for access to additional systems on the network.
Executive Summary
During our investigation of the latest phishing attack attributed to a known threat actor, we observed that it employed the Qakbot trojan as an initial access vector. The actor leveraged social engineering tactics to entice users into executing a malicious attachment, leading to a series of actions that culminated in the deployment of a ransomware payload. The attack chain exemplifies a sophisticated blend of tactics, techniques, and procedures (TTPs) designed to achieve significant operational impact.
Initial Access
The attack commenced with phished emails reflecting urgency and impersonation of trusted entities. We analyzed the email headers and identified that the malicious links redirect to a credential harvesting site. Analysis of the attachments, which were primarily Word documents, disclosed macros that, when executed, culminated in the download of the Qakbot malware from a remote server. This was facilitated by an encoded PowerShell command executed via cmd.exe, a common method utilized by threat actors to bypass user defenses.
Execution & Persistence
Upon successful execution, the sample we examined demonstrated typical Qakbot behavior. It wrote itself to the startup folder under the path %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\, thus ensuring persistence across system reboots. Our dynamic analysis revealed that Qakbot performs a series of internal checks to determine the system environment, making it adept at evading detection solutions deployed within an enterprise.
Command and Control
Command and control communications leveraged multiple Application Layer Protocols via T1071 – Application Layer Protocol, notably using HTTP for beaconing back to the actor’s infrastructure. Throughout our analysis, we identified several C2 domain names that were utilized for initial connections. One of the notable characteristics was the use of SSL/TLS to encrypt the traffic, providing an additional layer of obscurity. Our investigations also pinpointed inconsistencies in reported malware hashes leading to rapid domain fluxing techniques employed by the criminal group attempting to diminish the lifespan of their C2 infrastructure.
Lateral Movement & Discovery
Following initial Qakbot infection, we observed the actor employing lateral movement techniques. Utilizing T1021 – Remote Services, the actor leveraged Windows Management Instrumentation (WMI) for executing commands on other machines within the network. This activity was largely undetected as the operations were performed using native Windows tools, which are often overlooked by standard monitoring solutions. During this phase, Qakbot gathered extensive credential information and system inventories, further enriching the actor’s access.
Impact & Objectives
The ultimate objective of the actors appeared to evolve past simple information harvesting, leading to the deployment of a ransomware payload known as REvil. The mechanism of the ransomware payload was executed shortly after lateral movement was established. The timing suggested careful planning by the threat actor to maximize the impact on the organization, converting an initial data exfiltration operation into a more disruptive ransomware attack, causing both operational and reputational damage.
MITRE ATT&CK Mapping
- T1071 – Application Layer Protocol: Utilized legitimate networking protocols to exfiltrate data and maintain communications.
- T1021 – Remote Services: Leveraged services like WMI to execute commands on other networked machines.
- T1070 – Indicator Removal on Host: Employed various techniques to remove indicator traces during the infection phase.
Detection Opportunities
- Monitor for anomalous outbound HTTP/HTTPS traffic with unusual destination domains that deviate from normal patterns.
- Implement strict controls on PowerShell execution, along with logging and alerting on script execution events.
- Utilize Windows Event Logs to track WMI usage and alert on unexpected remote command executions.
Analyst Notes
This attack serves as a potent reminder of the evolving tactics employed by threat actors. The initial access methods combined with the lateral movement tactics highlight the numerous opportunities for detection and mitigation. Organizations must maintain heightened awareness of their email security practices to fend off phishing attempts and strengthening their overall incident response capabilities. While the focus this time was ransomware, the potential for data exfiltration should not be underestimated. We recommend a multifaceted defense strategy to identify, block, and respond to such sophisticated attacks.
Source: Original Report