Sarah Chen — Malware Reverse Engineer
Key Takeaways
- Actor utilized phishing emails to gain initial access, leading to a moderate-severity incident.
- Cobalt Strike was deployed as a beaconing payload, with multiple layers of persistence mechanisms in place.
- Lateral movement was achieved using the Pass-the-Hash technique across the network, targeting sensitive systems.
Executive Summary
During our investigation into a recent incident involving high-value targets in the finance sector, we uncovered a sophisticated attack chain executed by a well-known APT group. The attack commenced with a malicious email that contained a seemingly benign document. Once the document was opened, it executed a series of scripts leading to the deployment of Cobalt Strike, a legitimate tool often abused by threat actors for post-exploitation operations. Our analysis revealed that the deployment methods, infrastructure used, and techniques employed reflected significant planning and resourcefulness by the adversary.
Initial Access
The attack began with the delivery of a spear-phishing email to targeted employees within the organization. The email contained a link to a document hosted on a compromised cloud service, encouraging recipients to open it under the pretense of a business communication. Once the document was opened, it triggered a macro-enabled Word document that utilized T1059.001 – PowerShell to execute a PowerShell script, which downloaded the Cobalt Strike beacon from a remote server hosted by the threat actor.
Execution & Persistence
Upon successful execution of the beacon, the initial foothold was established on the victim’s machine. Our investigation indicated that the payload dropped additional files at C:\Users\Public\Documents\update.exe and registered itself via a run key located at HKEY_CURRENT_USER\Software\Microsoft\Windows\Current\CurrentVersion\Run. This ensured that the beacon would be persistent across system reboots. The beacon had various configurations to evade detection, such as using sleep and wait commands to avoid sandbox environments.
Command and Control
The Cobalt Strike beacon initiated contact with its Command and Control (C2) server through HTTP using a randomized domain generation algorithm (DGA). We noted the domain represented a combination of gibberish and legitimate words, making it less suspicious. The beacon was configured to retrieve further commands and transmit stolen data back to the adversary. The communication would occur over HTTPS, leveraging encryption to obscure the interactions and making mitigation via passive network monitoring considerably more challenging.
Lateral Movement & Discovery
After establishing communication with its C2 server, the actor began lateral movement using the T1075 – Pass-the-Hash technique to exploit Windows authentication systems. The analysis revealed that the adversary utilized valid credentials extracted from memory using Mimikatz. This allowed for the spread of the payload across multiple systems within the environment, most notably targeting domain controllers and key data servers, which exponentially increased their access to sensitive information.
Impact & Objectives
The primary objective of the actor appeared to be data exfiltration, targeting financial records and personally identifiable information (PII) across the enterprise. During the infection lifecycle, various PowerShell-based commands were employed to aggregate and compress sensitive files for streamlined data exfiltration. The sheer volume and sensitivity of the data accessed indicated clear intent to exploit the information for financial gain or potentially facilitate further attacks on third-party partners in the financial ecosystem.
MITRE ATT&CK Mapping
- T1566 – Phishing: Delivery method via malicious email containing URL to a document.
- T1059.001 – PowerShell: Execution of a PowerShell script via malicious document macros.
- T1075 – Pass-the-Hash: Credential theft and lateral movement using hashed passwords.
Detection Opportunities
- Monitor Exchange and web proxy logs for anomalous patterns indicating phishing attempts.
- Set up alerts for the execution of PowerShell scripts especially for non-administrative accounts.
- Implement endpoint detection solutions capable of identifying known signatures associated with Cobalt Strike beacons and communications.
Analyst Notes
This incident highlights the importance of user education on recognizing phishing attempts, as initial access was facilitated through seemingly innocuous communications. The use of advanced tools such as Cobalt Strike for malicious purposes emphasizes the need for robust defenses and monitoring capabilities within organizations, particularly in sectors handling sensitive data. Continued vigilance and proactive threat hunting will be key strategies in defending against such sophisticated threats.
Source: Original Report