Mike Torres — Incident Response Specialist
Key Takeaways
- The attack utilized a multi-stage deployment leveraging Cobalt Strike for lateral movements.
- Initial entry was gained through a phishing email containing a malicious document exploiting Microsoft Office vulnerabilities.
- Indicators of compromise (IOCs) include specific file paths and registry keys associated with the Cobalt Strike payload.
Executive Summary
In the recent analysis of an active threat campaign, we investigated a sophisticated attack that leveraged Cobalt Strike as the primary means of lateral movement and payload delivery. The actors demonstrated high levels of evasion tactics and operational security, making detection challenging. Our investigation reveals the entire attack chain, from initial access via a targeted phishing campaign to the post-exploitation phase where various tools were utilized to maintain persistence.
Initial Access
Our analysis identified that the attackers gained initial access through a highly targeted phishing email. The email contained a malicious attachment that was a Microsoft Word document. When opened, the document prompted the user to enable macros, which exploited the vulnerability identified in CVE-XXXX-XXXX. Upon enabling macros, a PowerShell command was executed that downloaded the first-stage payload from a remote server, effectively delivering the dropper.
Execution & Persistence
The dropper we examined was responsible for executing the Cobalt Strike beacon. This was achieved through the execution of a hidden PowerShell command that initiated the download of the beacon directly from the attacker-controlled server. The beacon established the initial communication loop with the command and control (C2) server, which was facilitated via DNS over HTTPS to evade detection. Persistence was maintained by creating a scheduled task located at C:\Windows\System32\Tasks\CobaltStrikeTask, which ensured that the beacon would re-establish communication upon system reboots.
Command and Control
During the investigation, we discovered that the C2 infrastructure was dynamic, utilizing multiple domains with rapid TLD changes to avoid detection. The beacon employed periodic beacons every 15 minutes to https://malicious-domain.com/api/endpoint, allowing the attackers to issue commands and receive exfiltrated data seamlessly. The use of obfuscation techniques in the network traffic added layers of complexity to tracking the communications, making it challenging for traditional security measures to recognize the abnormal patterns.
Lateral Movement & Discovery
Once the implant was successfully deployed, we observed the actor exploiting native Windows tools for lateral movement, notably leveraging PowerShell and Windows Management Instrumentation (WMI) techniques. Using T1071.001 (Application Layer Protocol: Web Protocols), the actor executed commands to enumerate network shares and available accounts on the local and neighboring systems. The analysis revealed the use of commands like Get-WmiObject -Class Win32_NetworkConnection to facilitate the enumeration of networked devices. Subsequently, they utilized credential dumping techniques to elevate privileges, specifically employing T1003.001 (Credential Dumping: LSASS Memory).
Impact & Objectives
The ultimate objective of this campaign appeared to be data exfiltration and potentially establishing a foothold for broader access within the environment. Our investigation noted that sensitive data was likely targeted, with attempts to access various databases across the network. The actors showed signs typical of financial gain objectives, possibly intending to deploy additional ransomware payloads once they had gathered sufficient credentials and access rights.
MITRE ATT&CK Mapping
- T1566 – Phishing: Delivering a malicious document to enable a macro exploit.
- T1059.001 – PowerShell: Using PowerShell to execute malicious commands.
- T1071.001 – Application Layer Protocol: Web Protocols: Creating beacons to communicate back to C2 using web protocol.
- T1003.001 – Credential Dumping: LSASS Memory: Dumping credentials from the system memory.
Detection Opportunities
- Monitor for abnormal PowerShell execution patterns, particularly those downloading external content.
- Implement endpoints monitoring for scheduled tasks that create instances of unknown binaries.
- Utilize IoC feeds to correlate known Cobalt Strike signatures and C2 domain patterns in security alerts.
Analyst Notes
This case exemplifies sophisticated integration of legitimate administrative tools used in tandem with malicious intent. It highlights the necessity for vigilance in monitoring email communications and endpoint behavior. Recognizing early signs of compromise can significantly improve an organization’s ability to respond effectively to similar threats in the future. Regular training and simulations against phishing attacks will also fortify the human factor, which remains the weakest link in most security postures.
Source: Original Report