Mike Torres — Incident Response Specialist
Key Takeaways
- BlueNoroff leveraged advanced social engineering to gain initial access, targeting specific industries.
- The malicious payload was delivered using a dropper that employed anti-sandboxing techniques.
- Post-exploitation tactics included the use of the Cobalt Strike framework for lateral movement and data exfiltration.
Executive Summary
During our investigation into a recent activity attributed to the BlueNoroff group, we observed an intricate attack chain marked by sophisticated phishing attacks and post-exploitation techniques. The group’s primary objective seemed to center around financial theft and intelligence gathering, particularly aimed at industries like finance and cryptocurrency. The malicious payloads exhibited a range of evasion techniques, making detection challenging for standard security measures.
Initial Access
The intrusion began with highly targeted phishing emails containing malicious attachments. These attachments were crafted to look like legitimate documents, luring users into enabling macros. An analysis of the email headers revealed that the actors employed spoofing methods to increase the credibility of their messages. This aligns with the T1566 – Phishing technique from MITRE ATT&CK. Upon user interaction with the attachment, a dropper was executed which further facilitated the infection process.
Execution & Persistence
Our analysis revealed that the dropper utilized multiple layers of obfuscation and was designed to bypass common endpoint detection systems. It dropped a secondary payload, which was a variant of the NetLoader malware. We noted that this malware was configured to establish persistence through registry modifications at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, creating a registry key that executed the payload upon user login. The value set was “SystemUpdater” and pointed to the dropped executable located at C:\Users\Public\System32\svchost.exe.
Command and Control
Once executed, the payload initiated communication with the command and control (C2) server via encrypted HTTPS traffic, which complicated network monitoring efforts. The C2’s domain had been registered using a rapidly changing registration strategy, enhancing the actor’s ability to evade detection. Investigations uncovered that one of the domains used was example-c2.com, which dynamically changed every week, indicative of T1071 – Application Layer Protocol techniques.
Lateral Movement & Discovery
Post-exploitation activities indicated that the attacker subsequently employed Cobalt Strike for lateral movement, a well-known red team tool favored by various APT groups. The compromised host began scanning the local network for other vulnerable machines using T1210 – Exploitation of Remote Services. We confirmed this by examining internal traffic patterns, which showed attempts to exploit MS EternalBlue vulnerabilities. Successful lateral movement led to further infiltration into the corporate network.
Impact & Objectives
The overall impact of the attack was significant, targeting sensitive financial data with the intention to facilitate fraudulent transactions. Furthermore, the actor exfiltrated sensitive corporate files using a custom script that packed the data into an encrypted ZIP archive which was then sent to their C2 server. We noted multiple instances of T1041 – Exfiltration Over Command and Control Channel throughout the HTTP communications, enabling the attackers to siphon vast amounts of sensitive data without raising immediate suspicion.
MITRE ATT&CK Mapping
- T1566 – Phishing: Targeted emails containing malicious attachments.
- T1071 – Application Layer Protocol: Encapsulating C2 traffic within HTTPS.
- T1210 – Exploitation of Remote Services: Utilizing EternalBlue for lateral movement.
- T1041 – Exfiltration Over Command and Control Channel: Data exfiltration via encrypted channels.
Detection Opportunities
- Implement monitoring for anomalous registry modifications under
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. - Monitor outgoing HTTPS traffic for connections to newly registered domains or known malicious domains.
- Utilize endpoint detection tools to identify instances of NetLoader or similar known indicators of compromise on endpoints.
Analyst Notes
This incident underscores the importance of continuous user education regarding phishing threats and emphasizes the necessity of robust network segmentation to thwart lateral movement. Additionally, organizations must consider investing in advanced C2 traffic analysis to preemptively detect traffic that may indicate a compromise.
Source: Original Report