Alex Morgan — Threat Intelligence Analyst
Key Takeaways
- Ransomware actors exploited a vulnerable web application to gain initial access to the network.
- The payload utilized advanced evasion techniques, including process hollowing and fileless execution methods.
- Our investigation revealed significant lateral movement to deploy ransomware across interconnected systems.
Executive Summary
During our analysis of a recent ransomware incident attributed to the Obsidian threat group, we observed a multi-stage attack chain that leveraged both social engineering and software vulnerabilities for initial access. The breach originated from a compromised corporate web application, leading to the deployment of a sophisticated implant designed to evade detection and move laterally within the environment. Our investigation revealed various ~TTPs~ and attack vectors that not only compromised critical data but also disabled essential security measures.
Initial Access
The initial access point was a web application that had known vulnerabilities in its user authentication module. After reconnaissance, the operator identified the specific endpoint `https://victim.com/login` which lacked proper input validation. Our analysis revealed that the actor employed a crafted payload targeting this weakness, allowing for SQL injection, ultimately leading to the exfiltration of user credentials.
Once the credentials were collected, the attacker accessed the corporate VPN using a stolen username and password. This step was particularly critical, as it provided a foothold into the internal network, allowing for deeper exploration.
Execution & Persistence
Following initial access, the adversaries deployed a modular payload, identified as ObsidianLoader, which was executed via a PowerShell command that allowed for fileless execution. The specific command used was a series of encoded strings passed through `powershell.exe -e
As for persistence, the attackers created a new service named ObsidianService under the path C:\Windows\Obsidian\ob_service.exe. They also modified a registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ObsidianService to ensure the service would restart upon system reboots. This implementation exemplified their intention to maintain long-term access.
Command and Control
The implant established a command and control (C2) channel using a well-known dynamic DNS service, allowing the actor to send and receive commands discreetly. The established C2 endpoint regularly changed, employing DNS rotation techniques for evasion. Specifically, the domain updates-obfuscated.com was observed as the primary endpoint used for both command reception and data exfiltration.
Communication was heavily encrypted using TLS, thus complicating the task for network monitoring tools. Our analysis examined several beacons sent every five minutes, which typically contained system information that the actor would utilize to assess their next steps.
Lateral Movement & Discovery
Once the initial implant was verified, lateral movement occurred with impressive efficiency. The adversaries leveraged SMB/NetSession techniques to enumerate shares and extract data from other machines within the network. Using the PTH (Pass-the-Hash) technique, they elevated privileges and accessed administrative shares such as \Target-PC.
oot$
Moreover, we discovered that they employed remote PowerShell sessions to execute commands across various systems, a tactic in line with the T1086 technique. This enabled them to expand their attack surface and deploy the ransomware payload simultaneously to numerous machines.
Impact & Objectives
The final objective was to encrypt critical files across the affected systems, effectively locking out legitimate users from accessing their data. Once the ransomware payload was unleashed, the actors left a ransom note named README_OBSIDIAN.txt on every affected device, demanding payment in cryptocurrency for decryption keys.
Our analysis estimated that tens of gigabytes of sensitive files were compromised, including client databases and employee records. The operational impact was severe, leading the organization to halt operations for a duration, exposing them to potential compliance violations regarding data protection regulations.
MITRE ATT&CK Mapping
- T1190 – Exploit Public-Facing Application: The initial credential theft was executed through exploiting a vulnerable web application.
- T1059.001 – PowerShell: Fileless execution of malicious payload via PowerShell commands.
- T1071.001 – Application Layer Protocol: Web Protocols: Encrypted C2 communications utilizing HTTPS.
- T1021.001 – Remote Services: Remote Desktop Protocol: Lateral movement using remote PowerShell for command execution.
Detection Opportunities
- Monitor for unusual DNS query patterns or communication to known dynamic DNS services.
- Implement strict whitelisting for PowerShell execution and monitor for encoded commands.
- Employ endpoint detection and response (EDR) solutions that can detect anomalous service creation and modifications to the registry.
Analyst Notes
Continuous monitoring for behaviors indicative of lateral movement and command execution is crucial. Organizations should prioritize patching known vulnerabilities and enhancing their web application security posture. The use of threat intelligence feeds can aid in identifying previously observed malicious behavior patterns and expedite response times during such incidents.
Source: Original Report