Priya Nair — Digital Forensics Analyst
Key Takeaways
- The actor utilized a sophisticated phishing technique involving malicious Office documents to establish initial access.
- We observed the use of a backdoor implant that facilitates remote command execution, leveraging T1059 – Command-Line Interface for persistence.
- Indicators of compromise (IOCs) including file hashes and C2 domain information are crucial for detection and blocking of this threat.
Executive Summary
During our investigation of a recent malware campaign, we uncovered a well-orchestrated phishing operation that primarily targeted organizations in the financial sector. The attack vector began with recipients receiving emails that contained seemingly benign Microsoft Office attachments. Instead, these attachments executed macros that downloaded a sophisticated backdoor, ultimately leading to extensive data exfiltration. Our analysis revealed that the actor employed tactics known for their stealth and efficacy, aligning with advanced persistent threat (APT) behaviors.
Initial Access
The phishing emails were meticulously crafted to appear legitimate, featuring branding from reputable companies. Each email contained an attachment named Invoice_April_2023.docm. The file extension indicates that it was a macro-enabled document, designed to evade traditional security measures. When opened, the user was prompted to enable macros, a common social engineering tactic. Once enabled, the document executed a Visual Basic for Applications (VBA) script, which initiated a PowerShell command that downloaded the payload from a remote server. Our investigation identified the C2 domain malicious-c2.example.com serving the malware.
Execution & Persistence
Upon execution, the payload, which we identified as Backdoor.Malware.XYZ, established a connection to the C2 server using T1071 – Application Layer Protocol over HTTPS. This backdoor allowed the actor to maintain persistent access by creating entries in the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key, ensuring execution on system startup. During our analysis, we noted that the backdoor employed T1083 – File and Directory Discovery to locate sensitive files and directories, demonstrating an intent to escalate its operations.
Command and Control
Communication with the C2 server was characterized by periodic HTTP POST requests containing system environment information, which allowed the actor to maintain a foothold on the infected hosts. The decoded traffic revealed that the implant was capable of receiving commands to exfiltrate documents and sensitive data. Additionally, the actor utilized DNS over HTTPS (DoH) to obscure C2 traffic, complicating detection efforts and highlighting the sophistication of the actor’s operational security. Notably, our threat hunting activities surfaced several alternate DNS records associated with the C2, indicating multiple layers of redundancy.
Lateral Movement & Discovery
After establishing a connection, the threat actor employed T1075 – Pass the Hash to move laterally within the network. By exploiting cached credentials, they navigated from the compromised workstation to neighboring systems, further expanding their reach. The backdoor frequently executed T1087 – Account Discovery, revealing user accounts and groups to facilitate lateral movements and targeting systems with less stringent security controls. This reconnaissance phase was critical for the actor as it increased their overall access to sensitive information.
Impact & Objectives
The primary objective of the campaign appeared to be the exfiltration of sensitive financial data. Our analysis of the commands issued through the backdoor indicated targeted file types, including spreadsheets and Word documents containing financial disclosures. The actors also leveraged the runtime environment to identify and exfiltrate emails from common clients. The malicious activity, however, did create a significant footprint in network logs, drawing attention to their activities and prompting incident response engagements from the targeted organizations.
MITRE ATT&CK Mapping
- T1566 – Phishing: The initial access was facilitated through well-crafted phishing emails targeting potential victims.
- T1059 – Command-Line Interface: The backdoor leveraged command-line tools for execution and persistence.
- T1071 – Application Layer Protocol: C2 communication utilized HTTPS for command execution and data exfiltration.
- T1075 – Pass the Hash: The actor utilized credential dumping to perform lateral movements within the environment.
- T1083 – File and Directory Discovery: The implant facilitated discovery of sensitive files on the network.
Detection Opportunities
- Monitor for PowerShell execution of scripts from Office documents, particularly those showing unusual outbound requests.
- Implement logging for registry changes, especially to the
HKCU\Software\Microsoft\Windows\CurrentVersion\Runkey. - Employ DNS monitoring to identify anomalous C2 domain resolutions, particularly those utilizing DoH.
Analyst Notes
This case serves as a poignant reminder of the inherent risks posed by social engineering attacks, particularly those leveraging macros in Office documents. As organizations increasingly enforce macro restrictions, the shift towards obfuscation techniques, like DNS over HTTPS, highlights the need for layered defense strategies. Continued vigilance and adaptive detection protocols are essential for safeguarding against this evolving threat landscape.
Source: Original Report