Malvertising Enables BlackCat: SpyBoy Terminator Joins the Arsenal

In a recent investigation conducted by the Trend Micro incident response team, a targeted organization fell victim to a sophisticated cyberattack. The threat actors employed malvertising techniques to distribute malware through cloned webpages of legitimate organizations, specifically targeting users searching for the popular WinSCP application. This Threatfeed dives deep into the underlying details of the attack, analyzing the initial access, the malicious activities performed, & the lessons we can learn from this event.

Unveiling the Infection Chain

The attack begins when a user searches for the "WinSCP Download" on the Bing search engine. Disguised as an ad, the malvertisers manipulate chosen keywords to display a deceptive advertisement for the WinSCP application above the organic search results. Upon clicking the "Download" button, the user unwittingly initiates the download of an ISO file from an infected WordPress webpage. The payload's URL has recently been changed to a file-sharing service called 4shared, adding another layer of complexity to the attack.

Delving into the Malicious Payload

Once the ISO file is mounted, two files, namely `setup.exe` and `msi.dll`, are extracted. `setup.exe` is, in fact, a renamed version of `msiexec.exe` executable. On the other hand, `msi.dll` acts as a dropper for both the legitimate WinSCP installer and a malicious Python execution environment responsible for downloading Cobalt Strike beacons. These files play a crucial role in the subsequent stages of the attack.

A Web of Malicious Activities

The threat actors meticulously orchestrate a series of actions to infiltrate the target organization's network and escalate their privileges. Let's explore the key techniques they employ:

Unauthorized Activities with Administrator Privileges: The cybercriminals exploit stolen top-level administrator privileges to carry out unauthorized activities within the company's network.
Persistence and Backdoor Access: They attempt to establish persistence by deploying remote management tools like AnyDesk, enabling them to maintain backdoor access to the compromised environment.
Password Theft and Backup Server Intrusion: The attackers try to steal passwords and gain access to backup servers, further jeopardizing the target organization's security.

Had the intervention been delayed, the enterprise would have undoubtedly suffered severe consequences. The threat actors had already obtained domain administrator privileges and established backdoors and persistence within the network.

The Tools and Techniques Behind the Attack

The attackers skillfully leverage various tools and techniques to achieve their malicious objectives. Here are the key elements used in this cyber assault:

AdFind:

The threat actors employ AdFind, a tool primarily designed for retrieving and displaying information from Active Directory environments. By misusing this tool, the attackers perform enumeration of user accounts, privilege escalation, and even password hash extraction.

PowerShell Commands:

PowerShell commands are an integral part of the attacker's arsenal. The threat actors utilize PowerShell to gather user information and save it in a CSV file, as well as execute scripts for various purposes.

Findstr:

The command-line tool findstr, typically used for searching strings or regular expressions within files, is employed by the attackers to identify XML files containing the string "cpassword." This is significant from a security perspective, as "cpassword" is associated with a deprecated method of storing passwords in Group Policy Preferences within Active Directory.

PowerView:

PowerView, belonging to the PowerSploit collection, serves as a reconnaissance and exploitation tool the attackers use. It enables them to gather information about the domain, identify misconfigurations, and exploit vulnerabilities.

Cobalt Strike:

Cobalt Strike, a commercially available penetration testing tool, plays a central role in this attack. The attackers utilize Cobalt Strike beacons to establish command-and-control (C2) communication with the compromised systems, enabling them to control and monitor the network remotely.

AnyDesk:

AnyDesk, a legitimate remote desktop software, is misused by the threat actors to gain persistent access to the compromised environment. They deploy AnyDesk to establish backdoor access, enabling them to control the compromised systems even after the initial intrusion.

Mimikatz:

Mimikatz, a well-known post-exploitation tool, is used to extract plaintext passwords and perform pass-the-hash attacks. The attackers employ Mimikatz to steal credentials, further escalating their privileges and expanding their control over the compromised network.

Key Lessons Learned

The malvertising attack chain discussed in this article sheds light on several important lessons for organizations and users:

User Awareness and Vigilance: Users should exercise caution when downloading software or clicking on advertisements, particularly from unfamiliar sources. Verifying the legitimacy of the website and the application being downloaded is crucial to avoiding malicious traps.

Regular Software Updates: Keeping software, operating systems, and security applications up to date is vital. Outdated software often contains vulnerabilities that threat actors can exploit to infiltrate systems.

Multifactor Authentication (MFA): Implementing MFA for critical systems and accounts adds an extra layer of security, making it more difficult for attackers to gain unauthorized access, even if they possess stolen credentials.

Network Segmentation and Access Control: Implementing proper network segmentation and access controls limits the lateral movement of attackers within the network. This can help contain the impact of a potential breach and prevent further compromise.

Continuous Monitoring and Incident Response: Organizations should have robust monitoring mechanisms to detect and respond to potential security incidents promptly. This includes monitoring for suspicious activities and anomalous network behavior, and regularly reviewing logs and security alerts.

Employee Education and Training: Regular cybersecurity awareness training for employees is crucial in creating a security-conscious culture within an organization. Employees should be educated about the latest threats, phishing techniques, and best practices for online safety.