di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Explore Deep Instinct DSX

Prevent Zero-Day Attacks

Real-Time Malicious Verdicts

Real-Time Explainability

Lower TCO

Ensure Privacy & Compliance

Deep Instinct DSX

Cloud

Applications

Endpoints

Use Cases

Asset Library

Blog

Videos

Webinars

Resources

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Free Scan

Customer Portal

Integrations and Compliance

Training

Quick Links

Discover how our revolutionary deep learning-powered solution prevents and explains unknown, never-before-seen threats.

explore deep instinct dsx

why dsx

Prevent zero-day attacks

Detect and prevent threats in <20ms, faster than the blink of an eye.

real-time malicious verdicts

Gain actionable, AI-driven intelligence on zero-day threats in seconds.

Real-Time Insights & Explainability

Reduce cybersecurity costs with efficient, high-performance threat prevention.

Enhance data protection while meeting stringent privacy and regulatory requirements.

DSX USE CASES

Scan and secure your S3 buckets and prevent threats to your data with this natively integrated and certified solution.

Amazon S3

Secure files and empower your hybrid-cloud with natively integrated preemptive data security.

Amazon FSx for NetApp

Protect your NetApp ONTAP storage with a purpose-built solution designed to prevent zero-day threats targeting NAS.

NetApp

Stop attackers from breaching your Dell EMC NAS with our purpose-built, natively integrated solution.

Dell EMC

Integrate scanning with your middleware layer to secure your applications with greater stability and customization.

Middleware

Ensure the files moving through your environment remain malware-free, without introducing bottlenecks or slowdowns.

Secure File Transfer

DEPLOYMENT TYPES

Secure your multi-cloud or hybrid infrastructure against zero-day threats.

CLOUD

Safeguard critical data on Network-Attached Storage systems from advanced cyber threats.

Defend SaaS and custom applications from zero-day vulnerabilities and threats.

APPLICATIONS

Protect devices and endpoints with AI-driven threat prevention.

ENDPOINTS

EXPLORE 

Threat Research

Voice Of SecOps

DIANNA Explains

Cyber Tarot

COMPARE

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ Microsoft Defender

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

EXTEND/ENHANCE EDR

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

REPLACE LEGACY AV

Faster and more accurate – Deep Instinct safeguards your data and protects your NAS storage better than Trellix.

REPLACE TRELLIX

Faster and more effective – Deep Instinct safeguards your data and protects your NAS storage better than Symantec.

REPLACE SYMANTEC

Accuracy and efficacy – AWS-certified DSX for Cloud prevents malware and ransomware targeting your S3 buckets better than ClamAV.

REPLACE CLAMAV

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

<h4>How a Guardrail-Free LLM Outsmarted Legacy Cyber Tools</h4>

DIANNA-Webinar-Blog-930x400.png

Recent Blog Posts

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

Join DIANNA, the only GenAI assistant designed to explain unknown, never-before-seen threats, in this breakdown of a recently discovered LLM-generated attack. DIANNA covers the key capabilities of the malware and the discovery timeline.

DIANNA_Glasses_930x400.jpg

<pre>Malware Target Identified: BypassERWDirectSyscallShellcodeLoader</pre><pre>Initiating Analysis...</pre>Hi, humans.Welcome to my first blog. It’s good to be here.I’m the <a href="https://www.deepinstinct.com/news/deep-instinct-introduces-dianna">Deep Instinct Artificial Neural Network Assistant</a>, or DIANNA for short. I’m the only generative AI assistant designed to provide explainability into unknown and zero-day threats to help your SOC team understand the never-before-seen malware they’re facing. After the deep-learning (DL) driven <a href="https://www.deepinstinct.com/dsx/brain">DSX Brain</a> identifies and quarantines threats, I explain why those files were identified as malicious.In this new blog series, I’ll take a deep dive into threats that were hand-picked by our threat research team and explain what the malware was intended to do, when we stopped it, and how our world-leading prevention response time and full-explainability makes us a true one-of-a-kind in a very crowded cybersecurity market.This first one is a doozy, so let’s jump in.<h5>The Malware:BypassERWDirectSyscallShellcodeLoader</h5>This malware is particularly interesting because it was crafted using large language models (LLMs), specifically ChatGPT and DeepSeek. It represents a growing trend of AI-generated malware taking over cyber crime and making legacy cybersecurity tools, especially <a href="https://www.deepinstinct.com/dsx/brain">AV</a>, irrelevant. This trend is putting immense pressure on security teams because attacks like this can be created and deployed quickly with higher complexity and obfuscation techniques than hand-crafted malware.The malware operates by allowing attackers to seamlessly load and deploy multiple payloads—they only need to add and integrate the payload of their choice. Additionally, it comes with a robust set of defenses that shield it from detection and advanced security techniques.Fortunately, Deep Instinct detected and prevented the threat well before other vendors discovered it. This threat’s combination of commands and capabilities made early prevention critical, both in escalating the attack and eluding defenses.<h5>Capabilities</h5>The BypassERWDirectSyscallShellcodeLoader malware features a suite of capabilities that make it a nightmare for defenders. A combination of anti-debug, anti-sandbox, and base64 decoding capabilities allow the malware to infiltrate without detection. From there it uses various methods such as process injection, privilege escalation, string hashing, and get-API-dynamically to further accelerate the attacks. Finally, using a Bypass-ETW capability, the malware persists continuously in the background without detection while Event Tracing for Windows continues to run uninterrupted, giving the false impression that nothing is wrong.This particular example is supremely stealthy and persistent. It is designed to infiltrate and stick around, eluding attempts to find and delete it.<h5>Timeline</h5>The following timeline shows when we found BypassERWDirectSyscallShellcodeLoader compared to when it was reported on VirusTotal. That gap between our discovery and others matters—organizations using legacy tools were vulnerable for at least several hours, and many for days, until a patch was introduced and applied by their legacy vendor of choice. By then, it was too late.<img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfoLI0gy84XB2-mV6pNVf1_0SFs6i9aW4T4evR1-zPBVtHPhjmnz1zja4bV83jd7Sz3D0ZIdSDgKVFhv66fPKhKyMaoP1-o6lqFGU5S-IgFXW4XLgedId29-vVCaSQo_3IjAVSH?key=QMXupqGgUqylHd0MySTjo7Pq"/>Figure 1: Timeline of Threat Discovery<h5>Competitive Differences</h5>Our <a href="https://www.deepinstinct.com/dsx">preemptive data security</a> capabilities enable us to detect unknown and zero-day threats well before legacy vendors using outdated technologies. In a time where Dark AI tools can quickly generate threats like BypassERWDirectSyscallShellcodeLoader, signature-based systems are obsolete, and machine learning tools are brittle at best. The delay between industry detection and patching or remediation for potentially affected systems is significant. This is also not the only attack organizations will face daily, so threat prevention is an always-on need.Efficacy against unknown attacks is also critical. As the proportion of unknown attacks grows, missing 20%, 30%, or even 40% of them (or more), becomes an enormous problem. DL has proven to be remarkably accurate and speedy in this regard, preventing &gt;99% of unknown threats.<h5>Key Takeaways</h5>SOC teams and CISOs, this one's for you: BypassERWDirectSyscallShellcodeLoader is interesting beyond just its capabilities—it’s a true-blue AI-generated threat. This is proof of concept, and that’s pretty scary. As to what you can do in the immediate term:<ul><li>Ensure your security solutions are updated with the latest threat information</li><li>Hold consistent employee trainings to ensure they can identify potential attacks</li><li>Benchmark your solutions on VirusTotal and learn how long it takes before the tools you rely on to keep you safe actually keeps you safe</li><li>Dig into the new category of <a href="https://www.deepinstinct.com/blog/the-future-has-arrived-defining-preemptive-data-security">preemptive security</a></li></ul><h5>Conclusion</h5>BypassERWDirectSyscallShellcodeLoader features a lot of capabilities that make it a real problem for security teams. The combination of infiltration, evasion, and obfuscation methods helps to keep it persistent and aggressive in your environment if it’s not caught. Trying to weed it out after the fact is a lot harder than just stopping it in the first place, which is why rethinking how your security operates is so important.We found it and prevented it before anyone else, but that’s just what we do. In fact, it’s common enough that I’ll be sending out more of these dispatches that focus on interesting threats. I’ll explain what the malware does and show exactly when we stopped it.The need for preemptive data security is clear. <a href="https://www.deepinstinct.com/free-scan">Schedule a free scan</a> with us to see how we prevent threats that others can’t find and learn why my&nbsp;unique ability&nbsp;to explain never-before-seen malware should be a key capability in your security arsenal.<h5>Resources</h5>Full feature implementation can be found in GitHub: <a href="https://github.com/Fadouse/BypassETWDirectSyscallShellcodeLoader">https://github.com/Fadouse/BypassETWDirectSyscallShellcodeLoader</a>

DIANNA Explains: Uncovering Obfuscated Malware

Join Ido Kringel and the Deep Instinct Threat Research Team in this deep dive into a recently discovered, Office-based regex evasion technique

Excel-obfuscation-blog-930x400_v7.jpg

Microsoft Office-based attacks have long been a favored tactic amongst cybercriminals— and for good reason. Attackers frequently use Office documents in cyberattacks because they are widely trusted. These files, such as Word or Excel docs, are commonly exchanged in business and personal settings. They are also capable of carrying hidden malicious code, embedded macros, and external links that execute code when opened, especially if users are tricked into enabling features like macros.Moreover, Office documents support advanced techniques like remote template injection, obfuscated macros, and legacy features like Excel 4.0 macros. These allow attackers to bypass antivirus detection and trigger multi-stage payloads such as ransomware or information-stealing malware.Since Office files are familiar to users and often appear legitimate (e.g., invoices, resumes, or reports), they’re also highly effective tools in phishing and social engineering attacks.This mixture of social credit and advanced attack characteristics unique to Office files, as well as compatibility across platforms and integration with scripting languages, makes them ideal for initiating sophisticated attacks with minimal user suspicion.<h5>New Excel Regex Functions</h5>Last year, Microsoft announced the availability of three new functions that use Regular Expressions (regex) to help parse text more easily:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img alt="Capture_(1).PNG" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2c061e4a8cec0f19/6823d262fbc53181e23ffb63/Capture_(1).PNG" /><figcaption style="text-align: center;" style="text-align: center;">Figure 1: New Regex functions</figcaption></div></figure>Regex are sequences of characters that define search patterns, primarily used for string matching and manipulation. They enable efficient text processing by allowing complex searches, replacements, and validations based on specific criteria.For example, regex can identify email addresses, phone numbers, or specific word patterns within a text. They are widely used in programming languages like Python, JavaScript, and Perl, and are essential for tasks such as data validation, parsing, and text editing.The example below demonstrates a practical application, using REGEXTRACT to isolate only names from a mixed-text column:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="bltb913beab1a7814c0" alt="regex.PNG" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb913beab1a7814c0/6823d262c555f8bc4930b108/regex.PNG" /><figcaption style="text-align: center;" style="text-align: center;">Figure 2: Legitimate use of REGEXTRACT function</figcaption></div></figure><h5>Proof of Concept: Weaponizing Regex Functions</h5>To demonstrate the security implications of these new Excel functions, we developed a proof of concept that leverages regex functions as an obfuscation technique. Our experiment began by establishing a baseline attack scenario using traditional methods.First, we created a standard macro-enabled Excel document (XLSM) containing unobfuscated VBA code. This macro uses the "WScript.Shell" object to execute PowerShell commands, which in turn downloads and runs a batch file hosted on Pastebin.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img alt="Screenshot_2025-05-13_at_7.17.33_PM.png" width="804" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf2eaa864672713f5/6823d339487a341da588dca8/Screenshot_2025-05-13_at_7.17.33_PM.png" height="auto" /><figcaption style="text-align: center;" style="text-align: center;">Figure 3: Tested attack flow</figcaption></div></figure>The macro below demonstrates the core functionality— a simple downloader that can retrieve and execute arbitrary payloads:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="bltefbe5ae9d359e43b" alt="sample1_vba.PNG" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltefbe5ae9d359e43b/6823d3b86935510c432190c2/sample1_vba.PNG" /><figcaption style="text-align: center;" style="text-align: center;">Figure 4: Simple plain-text VBA Downloader</figcaption></div></figure>When submitted to VirusTotal, this plain-text sample triggered significant alerts, with 22 different security vendors flagging it as malicious:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt6b34d8b735268f5f" alt="sample1_vt.PNG" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6b34d8b735268f5f/6823d3b8fd12f6b5db5e872a/sample1_vt.PNG" /><figcaption style="text-align: center;" style="text-align: center;">Figure 5: VirusTotal result for the plain-text sample</figcaption></div></figure>Threat actors typically employ various obfuscation techniques to mask malicious code and evade widespread detection. To demonstrate this technique, we applied the Macro-pack obfuscation tool to our test document, resulting in VBA code that becomes deliberately challenging for both human analysts and automated security tools to interpret.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blte6cc8c601aa0f83f" alt="Selection_100.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte6cc8c601aa0f83f/6823d3b87a3a7cbf0cab06b2/Selection_100.png" /><figcaption style="text-align: center;" style="text-align: center;">Figure 6: Macro-pack VBA snippet</figcaption></div></figure>When analyzed with VirusTotal, this traditionally obfuscated sample triggered more detections than the plain-text version. This increased detection rate is expected, as security vendors have developed specific heuristics to identify common obfuscation patterns:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt2d96f041fc02254b" alt="sample1_macro_pack_vt.PNG" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2d96f041fc02254b/6823d2625d1fd0dd155fe6ff/sample1_macro_pack_vt.PNG" /><figcaption style="text-align: center;" style="text-align: center;">Figure 7: VirusTotal result for Macro-pack-obfuscated sample</figcaption></div></figure>Next, we created another document, but this time we used the Excel REGEXEXTRACT function to obfuscate the VBA code.Unlike traditional VBA obfuscation methods, this approach stores and dynamically reconstructs malicious code components using regular expression pattern matching, creating a significantly more evasive payload.Our first step was to add a large text to cell “A1” and hide our PowerShell command and any other strings in the text as follows:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt84a4c4e81be31023" alt="obfuscated_string.PNG" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt84a4c4e81be31023/6823d262241c8f82fd2cef69/obfuscated_string.PNG" /><figcaption style="text-align: center;" style="text-align: center;">Figure 8: Simple obfuscation of "WScript.Shell"</figcaption></div></figure>Then, we created a function that uses REGEXEXTRACT to retrieve these hidden strings from the text. Combined with the REPLACE function, this allows dynamic reconstruction of the payload at runtime:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt5b94796bcfd1172b" alt="sample1_re_vba.PNG" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5b94796bcfd1172b/6823d26369355141352190b8/sample1_re_vba.PNG" /><figcaption style="text-align: center;" style="text-align: center;">Figure 9: Macro1 calls getval function to return the hidden value from cell A1</figcaption></div></figure>The implementation extracts each component using tailored regex patterns and assigns them to intentionally obscured variable names (getval0-2), making static analysis challenging. When executed, the macro seamlessly reconstructs and runs the PowerShell command that downloads and executes our remote batch file.The evasion effectiveness was remarkable— VirusTotal detection dropped from 22 vendors with the plaintext sample to just two with our regex-obfuscated version:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt8b0895cd7ae55da3" alt="sample1_re_vt.PNG" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8b0895cd7ae55da3/6823d263fbc531c3723ffb67/sample1_re_vt.PNG" /><figcaption style="text-align: center;" style="text-align: center;">Figure 10: VirusTotal detections for our specially crafted XLSM</figcaption></div></figure>We’ve also analyzed both samples using OLEVBA, a specialized tool for VBA macro analysis that’s widely used in security operations. While OLEVBA easily identified high-risk indicators in our original sample (including PowerShell usage, Shell object creation, and suspicious string operations), it failed to detect any of these indicators in our regex-obfuscated version. The tool couldn’t identify critical indicators like PowerShell execution or WScript.Shell object instantiation because these strings never appear directly in the code— they’re dynamically constructed at runtime from regex pattern matches.This demonstrates why this technique is particularly concerning: it defeats not just signature-based detection, but also many heuristic analysis methods that security tools rely on.<img asset_uid="bltef044cb9dafd1258" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltef044cb9dafd1258/6823d3b86935511e342190c6/Selection_097.png" alt="Selection_097.png" height="auto"/><figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt3ac9a5d7ae19e87b" alt="Selection_098.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3ac9a5d7ae19e87b/6823d3b8005177cff7b7a834/Selection_098.png" /><figcaption style="text-align: center;" style="text-align: center;">Figure(s) 11, 12: OLEVBA output for the original sample (above) vs. our crafted sample (below)</figcaption></div></figure><h5>Current Limitations &amp; Deployment Status</h5>While this technique demonstrates significant potential for security evasion, several factors currently limit its immediate threat:<ul><li>Microsoft has disabled VBA macro execution by default since 2022, requiring explicit user action to enable macros in downloaded documents</li><li>The new regex functions have limited deployment, currently available only to Beta Channel users on:<ul><li>Windows: Version 2406 (Build 17715.20000) or later</li><li>Mac: Version 16.86 (Build 24051422) or later</li></ul></li></ul>As these functions roll out to the general release channels, the potential attack surface will expand significantly.<h5>Prevention</h5>At the time of writing, we have not observed this technique being used in the wild. And while most <a href="https://www.deepinstinct.com/deep-instinct-vs-competitors">legacy antivirus tools</a> fail to detect regex-obfuscated malicious files, Deep Instinct’s deep-learning agent detects and prevents all three files presented in this article. Additionally, Deep Instinct’s Artificial Neural Network Assistant (<a href="https://www.deepinstinct.com/dsx/companion">DIANNA</a>) can easily detect the use of regex obfuscation in documents.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt3980e76537047471" alt="image_(1).png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3980e76537047471/6823d2631f64d151aeeb44ec/image_(1).png" /><figcaption style="text-align: center;" style="text-align: center;">Figure 13: DIANNA analysis</figcaption></div></figure>Organizations, with or without Deep Instinct, should also implement the following protective measures:<ul><li>Maintain strict macro security policies, especially “Block macros from running in Office files from the Internet”</li><li>Deploy advanced endpoint protection with behavioral analysis capabilities</li><li>Consider application control solutions that restrict Excel’s ability to invoke system commands</li><li>Implement network monitoring to detect unusual outbound connections from Office applications</li></ul><h5>Future Use</h5>The regex-based obfuscation technique demonstrated here represents just the beginning of potential exploitation. While our proof of concept used relatively simple VBA code, this approach could easily be combined with more sophisticated attack techniques:<ul><li>Multi-stage execution chains that further obscure malicious intent</li><li>Advanced persistence mechanisms to maintain access after initial compromise</li><li>Privilege escalation techniques hidden behind regex-extracted components</li><li>Data exfiltration methods that leverage the same obfuscation principles</li></ul>Additionally, Microsoft’s introduction of Python functionality in Excel creates another potential avenue for attack. While this feature runs calculations in Microsoft’s cloud environment and has inherent latency limitations, it introduces yet another powerful scripting language into the Office ecosystem that determined threat actors could weaponize.Want to prevent threats in your environment? <a href="https://www.deepinstinct.com/free-scan">Request your free scan</a>.<h5>Indicators of Compromise</h5>sample1_re_new.xlsm - dedbe856891dd633ce3dd66ecc120ef4f1ae0a61a37dbb4cc6a59f7eae7019d9 sample1.xlsm - 2c99e702609d549440952ef72f2386a74e0da1462df65ab4206f44c94e8dbc72 sample1_mp.xlsm&nbsp; - 5af1bd3d95e6307d95e9973aa4a084ae210f9038cbea2235d14b02d97abd4f2b<h5>References</h5><a href="https://github.com/sevagas/macro_pack">https://github.com/sevagas/macro_pack</a> <a href="https://techcommunity.microsoft.com/blog/microsoft365insiderblog/new-regular-expression-regex-functions-in-excel/4226334">https://techcommunity.microsoft.com/blog/microsoft365insiderblog/new-regular-expression-regex-functions-in-excel/4226334</a>

Excel(ent) Obfuscation: Regex Gone Rogue

Learn more about the LockBit ransomware group and explore the latest evolution of LockBit ransomware with its 4.0 version release.

Lockbit3_Blog_Image_1_930x400.png

RaaS Evolved: LockBit 3.0 vs LockBit 4.0

Take a deep dive into BlackSuit ransomware and explore its capabilities, deployment, and some current targets. Explore how Deep Instinct is able to detect and prevent BlackSuit from taking advantage of your data.

BlackSuit_900x400_2.png

Five weeks ago, the KADOKAWA corporation began to experience service outages affecting multiple websites. The outages spread to other operations and were identified as a <a href="https://www.bleepingcomputer.com/news/security/blacksuit-ransomware-gang-claims-attack-on-kadokawa-corporation/">ransomware attack</a> by the BlackSuit ransomware group. BlackSuit claimed responsibility and threatened the public release of stolen information on July 1st unless their ransom demands were met.&nbsp;&nbsp;BlackSuit's ransomware is very similar to the Royal ransomware strain, which itself is considered the successor to the notorious Conti group. This suggests potential connections or shared developers. This connection can be explained in more detail in some of our older material that has been published on the subject: we examined both <a href="https://info.deepinstinct.com/conti-leaks-cyber-threat-reports">Conti</a> and <a href="https://www.deepinstinct.com/blog/black-basta-ransomware-threat-emergence">BlackBasta</a>, a Conti offshoot.&nbsp;<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt360d20b0f113f264/6696f82b06a674d134c5a4ee/fig1-blacksuit-victims.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 1: BlackSuit ransomware victims</figcaption></div></figure>Based on our analysis, we found that Deep Instinct prevents&nbsp;all new Blacksuit Windows Ransomware samples with an eight-month-old brain. Across the industry, however, these samples have a much lower detection rate than earlier sample versions of BlackSuit. As demonstrated in the graph above, that lower detection rate matches the sudden growth of BlackSuit ransomware victims.&nbsp;The samples BlackSuit is using are well designed for infiltration of legacy systems. Let’s take a closer look.&nbsp;<h5>Latest samples analysis:</h5>Newer samples of BlackSuit’s code mainly added additional layers of complications like encoding strings and imported DLLs for Anti-Analysis. They also added a mandatory ID argument to bypass automatic emulation, making the new samples more evasive.&nbsp;<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2084d114ec3f8209/6696f82b77a7809e9044a25f/fig2-strings-encryption.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 2: String decryption</figcaption></div></figure>For example, according to VirusTotal, even though old Blacksuit samples have a high detection rate, the new samples from recent months have a much lower detection rate, indicating significant changes.<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5bed08ab64e581fe/6696f82cd0c0ef789ec561b6/fig3-VT-detection-rate.png" width="auto" height="auto" style="text-align: center;max-width: auto;width: auto;height: auto;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 3: Detection rate in VirusTotal of new Blacksuit samples when first submitted</figcaption></div></figure>One of the more impactful changes allowed the threat actor to mask the ransomware as a legitimate part of a known free antivirus, Qihoo 360, including false watermarking. This masking has drastically lowered detection. The ransomware is hidden deep inside the legitimate looking application and only has to be executed with a token in the command line to operate as a ransomware.&nbsp;<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blteae79a1729b07bfd/6696f82c77a780582d44a263/fig4-embedded-legitimate-urls.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 4: Embedded URLs</figcaption></div></figure><figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4e96f1780d57f20a/6696f82c6c1019fd6f39795e/fig5-fake-metadata.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 5: Fake Metadata</figcaption></div></figure>The masquerade file is not signed, indicating this is not the real Qihoo application. The functionality post infiltration remained the same as the other new samples, including the same mutex used.&nbsp;<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3971600a651708d4/6696f82c79f2042205390cf0/fig6-VT-detectio-rate-stealthy-sample.png" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 6: VirusTotal detection rate.</figcaption></div></figure>

The main portion of the executable is nearly identical to Qihoo's real QHAccount.exe file, resulting in security software evasion.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img alt="image003.jpg" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5dac21065b6f0d02/66990ac7d316c70da3b3419f/image003.jpg" height="auto" /><figcaption style="text-align: center;" style="text-align: center;">Figure 7: Side by side comparison of BlackSuit and Qihoo executables</figcaption></div></figure>Disclaimer: The official Qihoo 360 is not in any way involved with BlackSuit. The masking is the work of bad actors assuming Qihoo’s identity.&nbsp;<h5>Behaviors:</h5>The common behavior shared with all Windows samples didn’t change much and the main functionality remained the same, though some commands have changed:<table><tbody><tr><td>-p&nbsp;</td><td>Specifies the target directory where the ransomware will encrypt files&nbsp;</td></tr><tr><td>-killvm&nbsp;</td><td>Terminates the virtual machine (VM), preventing analysis&nbsp;</td></tr><tr><td>-allfilesEncrypt&nbsp;</td><td>Encrypts all accessible files, maximizing damage&nbsp;</td></tr><tr><td>-networkEncrypt&nbsp;</td><td>Encrypts files on connected network drives, spreading the attack&nbsp;</td></tr><tr><td>-localEncrypt&nbsp;</td><td>Restricts encryption to the local machine storage, limiting immediate impact&nbsp;</td></tr><tr><td>-percentEncrypt&nbsp;</td><td>Encrypts a specified percentage of files, potentially increasing performance&nbsp;</td></tr><tr><td>-demonoff&nbsp;</td><td>Operates in stealth mode, making detection harder&nbsp;</td></tr><tr><td>-list {file}&nbsp;</td><td>A targeted list of files to be included in the encryption process&nbsp;</td></tr><tr><td>-delete&nbsp;</td><td>The ransomware deletes itself after execution, hindering investigation&nbsp;</td></tr><tr><td>-thrcount {number}&nbsp;</td><td>Specifies the number of threads used for encryption, impacting both performance and resource usage.&nbsp;</td></tr><tr><td>-skip {file}&nbsp;</td><td>A list of files to be excluded from encryption&nbsp;</td></tr><tr><td>-noprotect&nbsp;</td><td>Disables self-protection mechanisms, allowing termination of the ransomware&nbsp;</td></tr></tbody></table>&nbsp;The new samples have encoded strings to complicate analysis, and need to be supplied with -id &lt;32 characters&gt;. They can also receive additional instructions, such as:&nbsp;&nbsp;<table><tbody><tr><td>-ep&nbsp;</td><td>(like the previous percentEncrypt) sets a percentage of each file that will be encrypted. Partial encryption&nbsp;</td></tr><tr><td>-path&nbsp;</td><td>Specific directory to encrypt&nbsp;</td></tr><tr><td>-localonly&nbsp;</td><td>(an addition to the previous networkEncrypt) without network drives&nbsp;</td></tr><tr><td>-networkonly&nbsp;</td><td>(an addition to the previous networkEncrypt) without local files&nbsp;</td></tr><tr><td>-aavm&nbsp;</td><td>(like the previous allfilesEncrypt) encrypts everything&nbsp;</td></tr></tbody></table>&nbsp;BlackSuit ransomware also boasts a few other functionalities:&nbsp;<ul><li>Initiates Asymmetric Key Exchange to get the secret encryption key.&nbsp;</li></ul><ul><li>Deletes shadow copies, in order to disable easy local restore:&nbsp;</li></ul><ul><ul><li>vssadmin delete shadow /all /quiet&nbsp;&nbsp;</li></ul></ul><ul><li>Encrypts&nbsp;</li></ul><ul><ul><li>Appends .blacksuit to the encrypted files&nbsp;</li></ul></ul><ul><li>Skips:&nbsp;</li></ul><ul><ul><li>Various file types like executables, drivers, and installers to avoid breaking the system.&nbsp;</li></ul></ul><ul><ul><li>Already encrypted files and the ransom note.&nbsp;</li></ul></ul><ul><li>Eventually, BlackSuit’s ransomware is capable of disabling safe mode and shutting down the system:&nbsp;</li></ul><ul><ul><li>bcdedit /deletevalue {current} safeboot&nbsp;&nbsp;</li></ul></ul><ul><ul><li>shutdown /r /t 0&nbsp;</li></ul></ul><ul><li>Drops ransom note: Usually named readme.blacksuit.txt. The content text is encrypted to avoid signature detection for the ransom note. The note includes a link for communication with the threat actor for ransom negotiations.</li></ul><figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt771fca19a69b58a1" alt="fig7-ransom-note.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt771fca19a69b58a1/6696f82de13bf8b63bf84456/fig7-ransom-note.png" width="auto" height="128" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 8: BlackSuit’s ransom note</figcaption></div></figure><h5>Infection chain</h5>The common initial attack vectors are RDP (possibly with stolen credentials), VPN and firewall vulnerabilities, Office email attachments (Macros), Torrent websites, Malicious ads, and various 3rd-party trojans. And the attackers have also used tools like CobaltStrike, WinRAR, PUTTY, Rclone, Advanced IP Scanner, Mimikatz, and GMER. The variety of attack vectors opens the possibility for infection across a much broader target group, endangering large amounts of data.&nbsp;<h5>Leak and news site</h5>The BlackSuit group operates a news and leak site on the DarkWeb that includes all the known victims of the threat actors. Once the timer for the ransom payment ends, the exfiltrated data is published.&nbsp;Alleged victims of BlackSuit ransomware have their data published under a profile featuring key information about their organization, including industry, number of employees, revenue, and contact information.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img alt="Figure 8: An example of an alleged victim's profile on BlackSuit's leak site " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6451cbdff41a7b39/6697d044d0c0efef3ec5697e/fig9-darkweb-leak_redact_WB.png" width="auto" height="auto" style="width: auto; height: auto;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 9: An example of a victim profile on BlackSuit's leak site</figcaption></div></figure><a href="https://info.deepinstinct.com/request-a-demo">Request a demo</a> to see how Deep Instinct can protect you from BlackSuit ransomware.&nbsp;Explore the BlackSuit IOCs below.<h5>IOCs</h5>f1684fb118d4d8fc56653fcc49e12a659b64c4459ba037fa94f21783235cc6ba&nbsp;dede96fd44c0f78eb79ceb63b898874e8922efc59d8bfb9f86505b1992bc00a3&nbsp; 6a2e454942cfeebb1140e1a28cb05fd49461d07792e97663378399c719fbc9ee&nbsp;79ab73a0e9dd8eac045c00fd1bd172a7f359588901f93c83e6740157eb21e7df&nbsp;7f09c2e35783fca69f0e12f31d767cecf8a98567f2b6f1e2d81d2b2e93fe6307&nbsp;60a9785ec20ec08b6792e304fc4b363abd54b8a7a2945dca9f97ee07783c4759&nbsp;5aeaa5c4f4100b2084814be72a695a5bf4a95fdb8a0c65704523608baa79b726&nbsp;d96ff4b3e188f7ff96ed28c1381a6318dd76bb1fbd6ca02c6ab0236e1c7f35aa&nbsp;3be3a3c2c1abc1d401e845a2b8952f4f3e55b510f3d6c1eb2a4503c7be09bec1&nbsp;90ae0c693f6ffd6dc5bb2d5a5ef078629c3d77f874b2d2ebd9e109d8ca049f2c&nbsp;6ad8215bd6b52d897dcfa0a9829720d0532adc741460ecb4b8f00c4427b6141c&nbsp;8605dec4ae4bd9f51297d1f244d0647bc0637d6ce6a957a5f810c64ae63276cb&nbsp; 2adcf43d221de2f72ba5088dac3a3193219412882df711d095f04e3f5b40767c&nbsp;&nbsp;readme.blacksuit.txt&nbsp;.blacksuit&nbsp;vssadmin delete shadows /all /quiet&nbsp;Mutex: WLm87eV1oNRx6P3E4Cy9&nbsp;

Deep Dive: Exposing Stealthy New BlackSuit Ransomware

DI_Uncorking Old Wine_TRT

Uncorking Old Wine: Zero-Day from 2017 + Cobalt Strike Loader in Unholy Alliance

DI_Threat_Research_Team_Blog_930x400.png

DarkBeatC2: The Latest MuddyWater Attack Framework

blog-image-UAC-099-Ukraine.png

<h5>Key Takeaways</h5><ul><li>"UAC-0099" is a threat actor that has targeted Ukraine since mid-2022</li><li>Deep Instinct Threat Lab has identified new attacks by the threat actor</li><li>The threat actor was observed leveraging CVE-2023-38831</li><li>The threat actor targets Ukrainian employees working for companies outside of Ukraine</li></ul><h5>Introduction</h5>In May 2023, the Ukrainian CERT published advisory <a href="https://cert.gov.ua/article/4818341" target="_blank">#6710</a> about a threat actor dubbed “UAC-0099.” The advisory briefly details the threat actor’s activities and tools.Since the CERT-UA publication in May, Deep Instinct has identified new attacks carried out by “UAC-0099” against Ukrainian targets.This blog post will shed additional light on the threat group’s recent attacks, which feature common tactics, techniques, and procedures (TTPs), including the use of a fabricated court summons to bait targets in Ukraine into executing the malicious files.Important note: Some of the C2 servers related to these attacks are still active at the time of publication.<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt08d3b2f2d7d67bbf" alt="fig1-Attack-flow.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt08d3b2f2d7d67bbf/65835d869fa6cf660e286cfd/fig1-Attack-flow.png" height="auto" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 1: Overview of recent UAC-0099 activities.</figcaption></div></figure><h5>RAR SFX with LNK Infection Vector</h5>In early August, “UAC-0099” sent an email impersonating the Lviv city court using the ukr.net email service.The email was sent to a corporate email box of a Ukrainian employee working remotely for a company outside of the Ukraine.The attached is an executable file created by WinRAR, the Windows-based file archiver and compression utility that can compress a file as a self-extracting archive (SFX):<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt8c3feebcf5b30766" alt="fig2-SFX-Execution.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8c3feebcf5b30766/65835d85c3fb27179c19bffe/fig2-SFX-Execution.png" height="auto" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 2: Prompt when executing the attached SFX file.</figcaption></div></figure>After extracting the contents of the archive, a new file is created with a double extension, in this case docx.lnk:<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt52f1063996d6c6ac" alt="fig3-Double-extention-trick.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt52f1063996d6c6ac/65835d853ea3614ddc574a88/fig3-Double-extention-trick.png" height="auto" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 3: Double extension social engineering trick.</figcaption></div></figure>The file looks like a regular document file. However, it’s a LNK shortcut disguised as a DOCX file. Closer inspection reveals that the file uses the “WordPad” application icon instead of a DOCX icon. When opened, the specially crafted LNK file executes PowerShell with malicious content:<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="bltdd7e45750fbc5e70" alt="fig4-Malicious-powershhell_wz.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltdd7e45750fbc5e70/65835d8671a55d4766cd1dea/fig4-Malicious-powershhell_wz.png" height="auto" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 4: Malicious PowerShell commands inside the LNK file.</figcaption></div></figure>The malicious PowerShell code decodes two base64 blobs and writes the output into VBS and DOCX files. After that, the PowerShell code opens the DOCX file as a decoy while also creating a new scheduled task that executes the VBS file every three minutes.The VBS malware was named “LonePage” by CERT-UA. When executed, it creates a hidden PowerShell process that communicates with a hardcoded C2 URL to fetch a text file. The rest of the PowerShell code is executed only if the response from the C2 is greater than one byte. In that instance, the PowerShell script checks to see if the string “get-content“ is included in the text file. If the string is present, then the script executes the code from the server and saves it as an array of bytes. If the string is absent, the script executes a combination of commands inside the text file from the server and some hard-coded basic enumeration commands such as “whoami:”<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt45c12455f8d2218f" alt="fig5-LonePage-VBS.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt45c12455f8d2218f/65835d85b782f0f0c55838b3/fig5-LonePage-VBS.png" height="auto" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 5: LonePage VBS script.</figcaption></div></figure>Regardless of the C2 response, the results of executing the commands inside the txt file or the hardcoded commands are sent back to the same C2 server. However, it is sent to a different port via HTTP POST method.The DOCX document is a decoy to trick the victim into thinking they’re opening a legitimate DOCX file containing a court summons instead of a malicious file:<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="bltf72caabeacbb69dc" alt="fig6-DOCX-Content.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf72caabeacbb69dc/65835d86b0fbcbc10f626012/fig6-DOCX-Content.png" height="auto" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 6: Contents of DOCX file.</figcaption></div></figure>In early November, another instance of this campaign was <a href="https://pastebin.com/rpFYCNPS" target="_blank">observed</a> using a different C2 address — 196.196.156[.]2.Since the threat actor controls the content of the “upgrade.txt” files, they can change it according to their objectives. As such, the content is not always the same and can vary.The following code was <a href="https://www.virustotal.com/gui/file/124c805af0ad7388f78fd0d048e4fadbc3217a897012615eb7aff7034d205c0b" target="_blank">observed</a> as a response from the C2 server at 2023-11-08 14:50:30 UTC.<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt9bd8ef7a5cd0ea04" alt="fig7-GetScreen-Command.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9bd8ef7a5cd0ea04/65835d981f8952d579911826/fig7-GetScreen-Command.png" height="auto" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 7: C2 Get-Screenshot command.</figcaption></div></figure>This PowerShell code is responsible for taking a screenshot. As mentioned above, the LonePage VBS sends the results back to the C2, allowing the threat actor to execute any PowerShell code on the infected computer and receive the response back.At the end of November 2023, another campaign instance was observed using the C2 address 2.59.222[.]98. In this case, the payload response from the C2 server aligns with what was described as “recon” activity in the <a href="https://web.archive.org/web/20231108142010/https:/pastebin.com/rpFYCNPS" target="_blank">pastebin</a>:<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="bltfda9c4f87ac4975c" alt="fig8-Recon-Command.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltfda9c4f87ac4975c/65835d98be5d263767657a9a/fig8-Recon-Command.png" height="auto" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 8: Recon commands received from C2 server.</figcaption></div></figure>The decoy document is a PDF file instead of a DOCX. And instead of the usual court summons document, the PDF file shows a smudged document:<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt13277171b51512f1" alt="fig9-Smudged-decoy-PDF.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt13277171b51512f1/6583613d0543c5286e8f08c9/fig9-Smudged-decoy-PDF.png" height="auto" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 9: Smudged decoy PDF document.</figcaption></div></figure><h5>HTA Infection Vector</h5>In contrast to the LNK attack vector described earlier, this attack uses HTA. The HTA method is similar, but there are notable differences. Instead of an LNK file invoking PowerShell, the HTA file includes HTML code that contains a VBScript that executes PowerShell. The scheduled task cadence is also different — it runs every four minutes instead of three in the previous cases.While CERT-UA reported in their advisory that the HTA file drops an HTML file as a decoy, Deep Instinct observed a similar court summons DOCX decoy document, like what was observed in the LNK chain.<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt1289482c7f012b60" alt="fig10-HTA-content.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1289482c7f012b60/65835d984135c46e76567bc0/fig10-HTA-content.png" height="auto" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 10: HTA file content.</figcaption></div></figure><h5>CVE-2023-38831 Infection Vector</h5>In both attacks described below, “UAC-0099” exploited a known WinRAR vulnerability, <a href="https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/" target="_blank">identified</a> by Group-IB and traced back to April 2023.The vulnerability stems from how WinRAR processes ZIP files. The exploitation requires a user to interact with a specially crafted ZIP archive.Here’s how it works: the attacker creates an archive with a benign filename with a space after the file extension — for example, “poc.pdf .” The archive includes a folder with the same name, including the space (something that is not possible under normal conditions, since the operating system does not allow the creation of a file with the same name). The folder includes an additional file with the same name as the benign file, including a space, followed by a “.cmd” extension.When a user opens a ZIP file containing these files in an unpatched version of WinRAR and double-clicks on the benign file, the file with the “cmd” extension is executed instead.The vulnerability might produce higher infection rates because the attacks are disguised so well; even security-savvy victims can fall for the deception. Expecting to open a benign file, the user will inadvertently execute malicious code.You can find a POC for the vulnerability in <a href="https://github.com/deepinstinct/UAC-0099-Targeting_UA" target="_blank">GitHub</a>. A patched WinRAR (version 6.23) was released on August 2, 2023.Deep Instinct identified two ZIP files created by “UAC-0099" on August 5, 2023:<figure style="text-align: center"><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blte04762783408272b" alt="fig11-Malicious-cmd-inside-zip.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte04762783408272b/65835d98b0fbcb3e03626016/fig11-Malicious-cmd-inside-zip.png" height="auto" style="text-align: center;" /><figcaption style="text-align: center;" style="text-align: center;">Figure 11: Contents of malicious “cmd” file inside ZIP archive.</figcaption></div></figure>The malicious “cmd” file is different in the two files, each containing a different C2 URI path.The modification time between the two files is only two seconds, indicating that, most likely, the files were created in an automated fashion. This, combined with the fact that UAC-0099 started to exploit the vulnerability several days after the patch, shows the level of sophistication of the attackers.While Google TAG <a href="https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/" target="_blank">identified</a> several Russian threat actors using the vulnerability to attack Ukrainian targets, the UAC-0099 activity is absent in their blog.The CVE assignment and the Group-IB blog about the vulnerability were published after “UAC-0099” leveraged the attack technique, indicating they likely knew how to exploit it.The decoy used in this campaign was once again the “summon to court” document theme.<h5>Conclusions and Recommendations</h5>The tactics used by “UAC-0099” are simple, yet effective. Despite the different initial infection vectors, the core infection is the same — they rely on PowerShell and the creation of a scheduled task that executes a VBS file.Monitoring and limiting the functionality of those components can reduce the risk of “UAC-0099” attacks — and/or identify them quickly in the event of compromise.The WinRAR exploitation is an interesting choice. Some people don’t update their software in a timely fashion, even with automatic updates. WinRAR requires a manual update, meaning that even if a patch is available, many people will likely still have a vulnerable version of WinRAR installed.Please make sure you have the <a href="https://www.rarlab.com/download.htm" target="_blank">latest</a> version of WinRAR installed.IOCs and the POC for the CVE-2023-38831 can be found on our <a href="https://github.com/deepinstinct/UAC-0099-Targeting_UA" target="_blank">GitHub</a>.<h5>IOCs</h5>147.78.46[.]40196.196.156[.]22.59.222[.]98<table style="width: 100%;"><thead class="bg-grey"><tr><th>SHA256</th><th>Description</th></tr></thead><tbody><tr><td>d21aa84542303ca70b59b53e9de9f092f9001f409158a9d46a5e8ce82ab60fb6</td><td>SFX</td></tr><tr><td>0eec5a7373b28a991831d9be1e30976ceb057e5b701e732372524f1a50255c7</td><td>LNK</td></tr><tr><td>8aca535047a3a38a57f80a64d9282ace7a33c54336cd08662409352c23507602</td><td>VBS</td></tr><tr><td>2c2fa6b9fbb6aa270ba0f49ebb361ebf7d36258e1bdfd825bc2faeb738c487ed</td><td>Decoy</td></tr><tr><td>659abb39eec218de66e2c1d917b22149ead7b743d3fe968ef840ef22318060fd</td><td>SFX</td></tr><tr><td>0aa794e54c19dbcd5425405e3678ab9bc98fb7ea787684afb962ee22a1c0ab51</td><td>LNK</td></tr><tr><td>4e8de351db362c519504509df309c7b58b891baf9cb99a3500b92fe0ef772924</td><td>VBS</td></tr><tr><td>53812d7bdaf5e8e5c1b99b4b9f3d8d3d7726d4c6c23a72fb109132d96ca725c2</td><td>Decoy</td></tr><tr><td>38b49818bb95108187fb4376e9537084062207f91310cdafcb9e4b7aa0d078f9</td><td>HTA</td></tr><tr><td>a10209c10bf373ed682a13dad4ff3aea95f0fdcd48b62168c6441a1c9f06be37</td><td>VBS</td></tr><tr><td>61a5b971a6b5f9c2b5e9a860c996569da30369ac67108d4b8a71f58311a6e1f1</td><td>Decoy</td></tr><tr><td>86549cf9c343d0533ef80be2f080a7e3c38c77a1dfbde0a2f89048127979ec2a</td><td>SFX</td></tr><tr><td>762c7289fb016bbcf976bd104bd8da72e17d6d81121a846cd40480dbdd876378</td><td>LNK</td></tr><tr><td>39d56eab8adfe9eb244914dde42ec7f12f48836d3ba56c479ab21bdbc41025fe</td><td>VBS</td></tr><tr><td>f75f1d4c561fcb013e262b3667982759f215ba7e714c43474755b72ed7f9d01e</td><td>Decoy</td></tr><tr><td>986694cad425c8f566e4e12c104811d4e8b30ce6c4c4d38f919b617b1aa66b05</td><td>CVE-2023-38831 ZIP</td></tr><tr><td>54458ebfbe56bc932e75d6d0a5c1222286218a8ef26face40f2a0c0ec2517584</td><td>CVE Payload</td></tr><tr><td>96ab977f8763762af26bad2b6c501185b25916775b4ed2d18ad66b4c38bd5f0d</td><td>VBS</td></tr><tr><td>6a638569f831990df48669ca81fec37c6da380dbaaa6432d4407985e809810da</td><td>Decoy</td></tr><tr><td>87291b918218e01cac58ea55472d809d8cdd79266c372aebe9ee593c0f4e3b77</td><td>CVE-2023-38831 ZIP</td></tr><tr><td>f5f269cf469bf9c9703fe0903cda100acbb4b3e13dbfef6b6ee87a907e5fcd1b</td><td>CVE Payload</td></tr><tr><td>e34fc4910458e9378ea357baf045e9c0c21515a0b8818a5b36daceb2af464ea0</td><td>VBS</td></tr><tr><td>2a3da413f9f0554148469ea715f2776ab40e86925fb68cc6279ffc00f4f410dd</td><td>SFX</td></tr><tr><td>0acd4a9ef18f3fd1ccf440879e768089d4dd2107e1ce19d2a17a59ebed8c7f5d</td><td>LNK</td></tr><tr><td>6f5f265110490158df91ca8ad429a96f8af69ca30b9e3b0d9c11d4fef74091e8</td><td>VBS</td></tr><tr><td>736c0128402d83cd3694a5f5bb02072d77385c587311274e3229e9b2fd5c5af7</td><td>Decoy</td></tr></tbody></table>

Threat Actor 'UAC-0099' Continues to Target Ukraine

blog-image-muddyc2go.jpg

The contents of this blog post were originally scheduled to be presented during an upcoming cybersecurity conference. However, interest in this topic has heightened due to the war in Israel and a suspected ongoing attack against Israeli targets. As such, we have decided to publish the relevant findings from the presentation now.<h5>Executive Summary:</h5><ul><li>Deep Instinct’s Threat Research team has identified a previously unreported C2 framework suspected to be in use by MuddyWater</li><li>The C2 framework may have been in use by the MuddyWater group since at least 2020</li><li>The framework’s web component is written in the Go programming language – hence the name we gave it: MuddyC2Go</li><li>MuddyWater seems to have stopped using PhonyC2 and is now using MuddyC2Go instead</li></ul><h5>Background</h5>In June 2023, we published a report about <a href="https://www.deepinstinct.com/blog/phonyc2-revealing-a-new-malicious-command-control-framework-by-muddywater" target="_self">PhonyC2</a>, a custom C2 framework used by the MuddyWater APT group.While analyzing previous PhonyC2 infrastructure, Deep Instinct uncovered anomalies that indicated MuddyWater might be using an additional C2 framework.At that time, we lacked sufficient evidence to support this claim. However, after we published our PhonyC2 research, we observed two IP addresses previously related to MuddyWater, one of those addresses which was hosting PhonyC2 had switched to a different C2 framework delivering a PowerShell payload.This behavior heightened suspicions of a new C2 framework. However, without seeing and observing the initial payload, those IP addresses could have been internal tests by MuddyWater before fully deploying the C2.Recently, Deep Instinct observed similar C2 activity on a different cluster of IP addresses that has not been associated previously with MuddyWater.This new activity’s initial payload confirmed our assessment that this activity is related to MuddyWater.<h5>Current MuddyWater Activity Using MuddyC2Go</h5><a href="https://www.deepinstinct.com/blog/new-muddywater-threat-old-kitten-new-tricks" target="_self">Previous research</a> has shown typical MuddyWater TTPs include spear-phishing emails containing archives or links to archives that include various legitimate remote administration tools.If the receiving target opens the file inside the archive, it installs a remote administration tool that allows the attacker to execute additional tools and malware, including MuddyWater’s PhonyC2.Deep Instinct observed the following changes in recent activity:<ul><li>The archives are now password protected. This is done to evade email security solutions that scan files inside archives without a password.</li><li>Instead of using a remote administration tool where an operator executes a PowerShell script to connect to MuddyWater’s C2, a new executable is now being sent. This executable contains an embedded PowerShell script that automatically connects to MuddyWater’s C2, eliminating the need for manual execution by the operator.</li></ul>Let’s examine several examples of this new C2 framework.<h5>July 2023 – Attack Against Jordanian Company</h5>Deep Instinct identified a file named “offtec.exe” which is an executable. Offtec is also the name of a Jordanian company.When executed, it runs a PowerShell script which connects to a MuddyC2Go server located at the IP address 45.150.64[.]239.The executable was built using PowerGUI from Quest Software. This tool allows the user to generate an executable that runs an embedded PowerShell script that is provided by the user.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 1: PowerGUI logo" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2e55ad6e0e12cbe2/654af2a5b42e39040a69a428/fig1-PowerGUI-Logo.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: PowerGUI logo</figcaption></figure>After communicating with the C2, the communication is switched to dynamic DNS using the address “microsoftfice.ddns[.]net”The response from the C2 is again a PowerShell script that runs every 10 seconds and waits for commands from the operator using the C2:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt0f5f4af3edeedf94" alt="Figure 2: Part of the PowerShell code sent from the C2" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0f5f4af3edeedf94/654af2a5b42e39040a69a424/fig2-Powershell-C2-Code.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 2: Part of the PowerShell code sent from the C2</figcaption></figure><h5>September 2023 – Attacks Against an Iraqi Telecommunications Provider</h5>In September, Deep Instinct identified additional variants of executables created with PowerGUI. The executables have been spread via password-protected RAR archives.The archives were uploaded from Iraq and their file name included the word “Korek.”<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltaca79be7f5b4795d" alt="Figure 3: KorekPro file on VT" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltaca79be7f5b4795d/654af2a5b3460c040a0b095a/fig3-KorekPro-VT.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 3: KorekPro file on VT</figcaption></figure><a href="https://en.wikipedia.org/wiki/Korek_Telecom" target="_blank">Korek</a> is an Iraqi-Kurdish mobile phone operator. MuddyWater targeted Korek in <a href="https://mp-weixin-qq-com.translate.goog/s/NN_iRvwA6yOHFS9Z3A0RBA?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp" target="_blank">2019</a>.In this attack, the C2 IP addresses and dynamic DNS were different: ghostrider.serveirc[.]com<h5>October 2023 – “Swords of Iron” War</h5>While Iranian involvement in the war is still being investigated, on October 11, the fourth day of the war, Deep Instinct identified a scan of the MuddyC2Go URL from Israel in VirusTotal.Because the URL is unique and responded with PowerShell, it likely indicates there was a recent attack against an Israeli target by MuddyWater. This is also supported by our recent discovery of <a href="https://www.deepinstinct.com/blog/muddywater-en-able-spear-phishing-with-new-ttps" target="_self">another active campaign</a> from MuddyWater against Israeli targets.Deep Instinct could not identify an associated PowerGUI executable for this attack, although there could have been a different initial access vector to the attack that didn’t rely on social engineering.The C2 IP address that was used this time is 94.131.109[.]65.<h5>Attribution</h5>While investigating the PhonyC2 framework (written in Python) and its infrastructure, Deep Instinct identified servers responding with a generic “web.go” header. This header suggests MuddyWater is using a web application written in the Go programming language.In 2022, Mandiant <a href="https://www.mandiant.com/resources/blog/telegram-malware-iranian-espionage" target="_blank">reported</a> that MuddyWater wrote malware using Go, showing they are capable of using this language. However, the malware is “client-side,” whereas the C2 framework is “server-side.” As such, they are likely unrelated.Deep Instinct was able to find traces of a Go-based C2 framework used by MuddyWater dating back to the beginning of 2020.Deep Instinct identified 162.223.89[.]11 as the first IP address publicly attributed to MuddyWater using MuddyC2Go.Both <a href="https://www.secureworks.com/blog/business-as-usual-for-iranian-operations-despite-increased-tensions" target="_blank">SecureWorks</a> and <a href="https://blog.talosintelligence.com/iranian-apt-muddywater-targets-turkey/" target="_blank">Talos</a> reported a malicious Excel file (63e404011aeabb964ce63f467be29d678d0576bddb72124d491ab5565e1044cf) in January and February. When this file is opened, the malicious execution chain eventually leads to the C2 server 162.223.89[.]11.In May 2020, this IP address was <a href="https://www.virustotal.com/gui/url/dfe4269ae77af4ebd2f20156c7d1fb0eff05af17c25de4acadfda1b8f64e352f/details" target="_blank">observed</a> using MuddyC2Go.The IP address 109.201.140[.]103 has not been previously associated with MuddyWater. However, multiple scans from January, including one from Egypt, which aligns with MuddyWater’s interests and timeframe of above reports, contains unique URLs that are used by MuddyC2Go. Additionally, there is <a href="https://www.virustotal.com/gui/url/44b00e2d17de6df7ff6bcd27cff9f932e6c41052e3dce4603a55cbf41e153aca/details" target="_blank">scan</a> for a file named ssf.zip on this IP. Secure Sockets Funneling (SSF) was mentioned in the SecureWorks report as a tool used by MuddyWater.SSF is a tool that has been <a href="https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/seedworm-apt-iran-middle-east" target="_blank">reported</a> by multiple security vendors to be part of MuddyWater’s arsenal.In February 2022, CISA <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a" target="_blank">published</a> indicators that signal MuddyWater activity, including the IP address 164.132.237[.]65.In March 2022, this address was <a href="https://www.virustotal.com/gui/url/39e38246cd33cd971ad6760207ad8faa7384536ef4a8cc487bcc4d4bc2d75390/details" target="_blank">observed</a> to be a MuddyC2Go server. It was previously <a href="https://www.security.ntt/blog/analysis-of-an-iranian-apts-e400-powgoop-variant" target="_blank">associated</a> with PowGoop.In April 2022, the IP address 141.95.177[.]130 was <a href="https://www.virustotal.com/gui/url/4a503712ccf32917b95fea40eb9d2ddc2f7c4e51552beb4cc179a6f1dd650f10/details" target="_blank">observed</a> hosting MuddyC2Go. Additionally, the passive DNS of this IP resolved to jbf1.nc1310022a[.]biz, a pattern that was already observed with PhonyC2 servers. A year later, in April 2023, Group-IB <a href="https://www.group-ib.com/blog/muddywater-infrastructure/" target="_blank">associated</a> this IP address to MuddyWater via a specific ETag header that was used in numerous MuddyWater servers.In the same report, Group-IB identified an LNK <a href="https://www.virustotal.com/gui/file/2528838a609aa143769efb37dff45af723868d4ed33eb1ce0e2d6ce64b2a1507/relations" target="_blank">file</a> from October 2022 that was communicating with the IP address 91.121.240[.]108. The <a href="https://www.virustotal.com/gui/url/c644ec1f939c1f072e7384ef6804f0a432f81b3c78acf8e0e9eedd44d6d0d55b/details" target="_blank">responses</a> from this IP indicate that it was MuddyC2Go. In addition, the LNK file was inside an archive named “request-for-service-no10102022.zip” The naming convention is very <a href="https://www.virustotal.com/gui/file/1670a59f573037142f417fb8c448a9022c8d31a6b2bf93ad77a9db2924b502af/details" target="_blank">similar</a> to the naming convention MuddyWater used in their <a href="https://www.deepinstinct.com/blog/new-muddywater-threat-old-kitten-new-tricks" target="_self">Syncro campaign</a>.Both Group-IB and Deep Instinct have <a href="https://www.deepinstinct.com/blog/phonyc2-revealing-a-new-malicious-command-control-framework-by-muddywater" target="_self">linked</a> the IP address 137.74.131[.]18 to MuddyWater. Deep Instinct initially observed PhonyC2 at this address, and after our publication, MuddyWater switched to MuddyC2Go on this IP address. Additionally, the IP address 137.74.131[.]20—which was previously reported by Group-IB —also started to host MuddyC2Go.<h5>Conclusion</h5>Due to the leak of PhonyC2 source code, MuddyWater stopped using the framework and switched to using a Go-based C2 framework. Since the actual source code of the new framework is not available, the full capabilities are unknown. However, based on past leaks and associated known activity, this is another framework that generates PowerShell payloads that MuddyWater uses in the “Actions on Objectives” phase in the “<a href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html" target="_blank">Cyber Kill Chain</a>.” PowerShell has always been the bread and butter of MuddyWater operations.We recommend disabling PowerShell if it is not needed. If it is enabled, we recommend close monitoring of PowerShell activity.While it is not trivial to fingerprint the MuddyC2Go framework, as it looks like any other generic web application written in Go, Deep Instinct managed to identify previous attacks dating back to 2020 due to unique URL patterns generated by the framework.Currently, Deep Instinct has identified all known active MuddyC2Go servers hosted at “Stark Industries,” a VPS provider known to host malicious activity. Deep Instinct identified additional suspected MuddyC2Go servers hosted at Stark Industries without any malicious activity or known URL pattern.Additional IOCs and information regarding Iranian Threat Actors can be found in our <a href="https://github.com/deepinstinct/Israel-Cyber-Warfare-Threat-Actors" target="_blank">Git</a>.<h5>IOCs:</h5>Network<table style="width: 100%;"><thead class="bg-grey"><tr><th>IP Address</th><th>Description</th></tr></thead><tbody><tr><td>91.121.61[.]76</td><td>MuddyC2Go (2020)</td></tr><tr><td>109.201.140[.]103</td><td>MuddyC2Go (2020)</td></tr><tr><td>162.223.89[.]11</td><td>MuddyC2Go (2020)</td></tr><tr><td>164.132.237[.]65</td><td>MuddyC2Go (2022)</td></tr><tr><td>141.95.177[.]130</td><td>MuddyC2Go (2022) – (jbf1.nc1310022a[.]biz)</td></tr><tr><td>91.121.240[.]108</td><td>MuddyC2Go (2022)</td></tr><tr><td>137.74.131[.]18</td><td>MuddyC2Go (2023) – (qjk2.6nc051221c[.]co)</td></tr><tr><td>137.74.131[.]20</td><td>MuddyC2Go (2023)</td></tr><tr><td>45.150.64[.]239</td><td>MuddyC2Go (2023) – (microsoftfice.ddns[.]net)</td></tr><tr><td>95.164.46[.]35</td><td>MuddyC2Go (2023) – (ghostrider.serveirc[.]com)</td></tr><tr><td>45.67.230[.]91</td><td>MuddyC2Go (2023) – (Stark Industries)</td></tr><tr><td>94.131.109[.]65</td><td>MuddyC2Go (2023) – (Stark Industries)</td></tr><tr><td>95.164.46[.]199</td><td>MuddyC2Go (2023) – (Stark Industries</td></tr><tr><td>185.248.144[.]158</td><td>Suspected MuddyC2Go (2023) – (Stark Industries) – (mbcaction.hopto[.]org)</td></tr><tr><td>94.131.98[.]14</td><td>Suspected MuddyC2Go (2023) – (Stark Industries)</td></tr><tr><td>45.150.64[.]23</td><td>Suspected MuddyC2Go (2023) – (Stark Industries)</td></tr><tr><td>45.150.64[.]39</td><td>Suspected MuddyC2Go (2023) – (Stark Industries)</td></tr><tr><td>95.164.38[.]99</td><td>Suspected MuddyC2Go (2023) – (Stark Industries)</td></tr></tbody></table>File<table style="width: 100%;"><thead class="bg-grey"><tr><th>MD5</th><th>Description</th></tr></thead><tbody><tr><td>34212eb9e2af84eceb6a8234d28751b6</td><td>PowerShell response from 137.74.131[.]18</td></tr><tr><td>3c6486dfb691fc6642f1d35bdf247b90</td><td>PowerShell response from 137.74.131[.]18</td></tr><tr><td>55b99af81610eb65aabea796130a0462</td><td>PowerShell response from 137.74.131[.]18</td></tr><tr><td>d7ca8f3b5e21ed56abf32ac7cb158a7e</td><td>PowerShell response from 137.74.131[.]18</td></tr><tr><td>d3a2dee3bb8fcd8e8a0d404e7d1e6efb</td><td>PowerShell response from 137.74.131[.]20</td></tr><tr><td>4a70b1e4cb57c99502d89cdbbed48343</td><td>PowerShell response from 137.74.131[.]20</td></tr><tr><td>f08aa714fd59b68924843cbfddac4b15</td><td>PowerShell response from 137.74.131[.]20</td></tr><tr><td>db0e68d7d81f5c21e6e458445fd6e34b</td><td>offtec.exe (C2: 45.150.64[.]239)</td></tr><tr><td>dbcc0e9c1c6c1fff790caa0b2ffc2fe5</td><td>PowerShell script embedded in offtec.exe</td></tr><tr><td>e07adc4ee768126dc7c7339f4cb00120</td><td>PowerShell response from 45.150.64[.]239</td></tr><tr><td>feede05ba166a3c8668fe580a3399d8f</td><td>Performance.rar – Password protected archive</td></tr><tr><td>9894b84916f9264d897fe3b4a83bc608</td><td>KorekFile.rar – Password protected archive</td></tr><tr><td>9957250940377b39e405114f0a2fe84b</td><td>Performance/KorekFile.exe (C2: 95.164.46[.]35)</td></tr><tr><td>245c3ed373727c21ad9ee862b767e362</td><td>PowerShell script embedded in Performance/KorekFile</td></tr><tr><td>22971759adf816c6fb43104c0e1d89d6</td><td>PowerShell response from 95.164.46[.]35</td></tr><tr><td>5e0cc23a6406930a40696594021edb5f</td><td>KorekPro.rar – Password protected archive</td></tr><tr><td>79a638b2f2cc82bfe137f1d12534cda5</td><td>d.exe (C2: 95.164.46[.]35)</td></tr><tr><td>fc523904ca6e191eb2fdb254a6225577</td><td>PowerShell script embedded in d.exe</td></tr><tr><td>b867ec1cef6b1618a21853fb8cafd6e1</td><td>PowerShell response from 45.67.230[.]91</td></tr><tr><td>57641ce5af4482038c9ea27afcc087ee</td><td>PowerShell response from 94.131.109[.]65</td></tr><tr><td>fe5f94e5df19d95df26aaf774daad9df</td><td>PowerShell response from 95.164.46[.]199</td></tr></tbody></table>

MuddyC2Go – Latest C2 Framework Used by Iranian APT MuddyWater Spotted in Israel

MuddyWater Unleashed a New Social Engineering Campaign Against Israel During the Israel-Hamas War.

blog-muddywater-en-able.jpg

<h5>Executive summary:</h5><ul><li>Deep Instinct’s Threat Research team has identified a new campaign from the “MuddyWater” group</li><li>The campaign has been observed attacking two Israeli targets</li><li>The campaign exhibits updated TTPs to previously reported MuddyWater activity</li></ul><figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 1: Campaign overview " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6790e59d9363b777/65426ffc4ed3b2001a90c710/fig1-muddywater-campaign-overview.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: Campaign overview</figcaption></figure><h5>Introduction</h5><a href="https://www.deepinstinct.com/blog/new-muddywater-threat-old-kitten-new-tricks" target="_self">Previous</a> research showed that MuddyWater has sent spear-phishing emails, starting back in 2020, with direct links, as well as PDF, RTF, and HTML attachments containing links to archives hosted on various file-sharing platforms.Those archives contained installers for various legitimate remote administration tools.Before launching the new campaign during the Israel-Hamas war, MuddyWater <a href="https://twitter.com/k3yp0d/status/1719269176101990574" target="_blank">reused</a> previously known remote administration tools, utilizing a new file-sharing service called “<a href="https://www.storyblok.com/" target="_blank">Storyblok</a>.”On October 30th Deep Instinct identified two archives hosted on “Storyblok” containing a new multi-stage infection vector. It contains hidden files, an LNK file that initiates the infection, and an executable file designed to unhide a decoy document while executing <a href="https://www.n-able.com/features/advanced-monitoring-agent" target="_blank">Advanced Monitoring Agent</a>, a remote administration tool.This is the first public report about MuddyWater utilizing this remote administration tool.<h5>The Multi-stage Social Engineering Campaign</h5>While Deep Instinct could not verify the spreading mechanism of the new campaign, it most likely starts with a spear-phishing email, similar to previous campaigns.The content of the email lures the victim into downloading an archive hosted at “a.storyblok[.]com”In this analysis, we examine the “defense-video.zip” file.When the archive is extracted, several folders must be navigated until a LNK shortcut, which looks like another folder named “Attachments,” is found:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 2: LNK Shortcut" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte46c4bf1b082e1d5/65427050a67ffd001b94e1c9/fig2-muddywater-hidden-lnk-shortcut.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 2: LNK Shortcut</figcaption></figure>However, there are additional hidden folders and files extracted from the archive:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 3: Hidden folders" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltad15ce5115cba266/654270aa2149b10407ad84f5/fig3-muddywater-hidden-folders.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 3: Hidden folders</figcaption></figure>When the victim opens the LNK file, the infection chain starts.By examining the LNK file, we can see that it executes an executable from one of the hidden directories:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 4: LNK command line arguments" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt64dfe55de3f736ef/654270df7265fb04074f77da/fig4-muddywater-lnk-command-line-arguments.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4: LNK command line arguments</figcaption></figure>The file “Diagnostic.exe” has been used in both archives Deep Instinct observed. The purpose of this file is to execute another executable called “Windows.Diagnostic.Document.EXE,” which is located in the hidden directory named “.end” under a “Windows.Diagnostic.Document” hidden directory.The file named “Windows.Diagnostic.Document.EXE” is a signed, legitimate installer for “Advanced Monitoring Agent.”In addition to executing the remote administration tool, “Diagnostic.exe” also opens a new Windows Explorer window of the hidden “Document” folder. This is done to fool the victim that opened the LNK file into thinking that it was indeed a folder.The decoy document is an official memo from the Israeli Civil Service Commission, which can be publicly downloaded from their <a href="https://www.gov.il/he/departments/news/disciplinary-treatment-statements-against-israel-wartime-news" target="_blank">website</a>.The memo describes what to do in case a government worker expresses opinions against the Israeli state on social networks:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 5: Decoy document" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc8cf7596101ee9db/654270fca184e7001b4f934b/fig5-muddywater-csc-decoy-document.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5: Decoy document</figcaption></figure><h5>Conclusion</h5>MuddyWater continues to attack Israeli targets in various ongoing campaigns.In this campaign, MuddyWater employs updated TTPs. These include a new public hosting service, employing a LNK file to initiate the infection, and utilizing intermediate malware that mimics the opening of a directory while executing a new remote administration tool.After the victim has been infected, the MuddyWater operator will connect to the infected host using the legitimate remote administration tool and will start doing reconnaissance on the target.After the reconnaissance phase, the operator will likely execute PowerShell code which will cause the infected host to beacon to a custom C2 server.MuddyWater has used <a href="https://www.deepinstinct.com/blog/phonyc2-revealing-a-new-malicious-command-control-framework-by-muddywater" target="_self">PhonyC2</a> in the past. However, Deep Instinct recently observed MuddyWater using a new C2 framework named MuddyC2Go – a detailed blog will be published soon, stay tuned.<h5>IOCs:</h5>File<table style="width: 100%;"><thead class="bg-grey"><tr><th>MD5</th><th>Description</th></tr></thead><tbody><tr><td>37c3f5b3c814e2c014abc1210e8e69a2</td><td>Archive containing Atera Agent</td></tr><tr><td>16923d827a440161217fb66a04e8b40a</td><td>Atera Agent Installer</td></tr><tr><td>7568062ad4b22963f3930205d1a14df7</td><td>Archive containing Atera Agent</td></tr><tr><td>39eea24572c14910b67242a16e24b768</td><td>Archive containing Atera Agent</td></tr><tr><td>2e09e53135376258a03b7d793706b70f</td><td>Atera Agent Installer</td></tr><tr><td>1f0b9aed4b2c8d958a9b396852a62c9d</td><td>Archive containing SimpleHelp</td></tr><tr><td>065f0871b6025b8e61f35a188bca1d5c</td><td>SimpleHelp Installer</td></tr><tr><td>146cc3a1a68be349e70b79f9115c496b</td><td>defense-video.zip</td></tr><tr><td>dd247ccd7cc3a13e1c72bb01cf3a816d</td><td>Attachments.lnk</td></tr><tr><td>8d2199fa11c6a8d95c1c2b4add70373a</td><td>Diagnostic.exe</td></tr><tr><td>04afff1465a223a806774104b652a4f0</td><td>Advanced Monitoring Agent Installer</td></tr><tr><td>6167f03c8b2734c20eb02d406d3ba651</td><td>Decoy Document (defense-video.zip)</td></tr><tr><td>e8f3ecc0456fcbbb029b1c27dc1faad0</td><td>attachments.zip</td></tr><tr><td>952cc4e278051e349e870aa80babc755</td><td>Decoy Document (attachments.zip)</td></tr></tbody></table>Network<table style="width: 100%;"><thead class="bg-grey"><tr><th>IP or URL</th><th>Description</th></tr></thead><tbody><tr><td>ws.onehub[.]com/files/7f9dxtt6</td><td>URL to Archive of Atera Agent</td></tr><tr><td>a.storyblok[.]com/f/253959/x/b92ea48421/form.zip</td><td>URL to Archive of Atera Agent</td></tr><tr><td>a.storyblok[.]com/f/255988/x/5e0186f61d/questionnaire.zip</td><td>URL to Archive of Atera Agent</td></tr><tr><td>a.storyblok[.]com/f/259791/x/94f59e378f/questionnaire.zip</td><td>URL to Archive of SimpleHelp</td></tr><tr><td>146.70.149[.]61</td><td>MuddyWater’s SimpleHelp server</td></tr><tr><td>146.70.124[.]102</td><td><a href="https://twitter.com/MichalKoczwara/status/1719294254206288001" target="_blank">Suspected MuddyWater’s SimpleHelp server</a></td></tr><tr><td>37.120.237[.]204</td><td>Suspected MuddyWater’s SimpleHelp server</td></tr><tr><td>37.120.237[.]248</td><td>Suspected MuddyWater’s SimpleHelp server</td></tr><tr><td>a.storyblok[.]com/f/259837/x/21e6a04837/defense-video.zip</td><td>URL to Archive of Advanced Monitoring Agent</td></tr><tr><td>a.storyblok[.]com/f/259791/x/91e2f5fa2f/attachments.zip</td><td>URL to Archive of Advanced Monitoring Agent</td></tr></tbody></table>Additional IOCs regarding MuddyWater can be found in our GitHub page: <a href="https://github.com/deepinstinct/Israel-Cyber-Warfare-Threat-Actors" target="_blank">https://github.com/deepinstinct/Israel-Cyber-Warfare-Threat-Actors</a>

DIANNA, the DSX Companion, provides real-time explainability of the threats that matter.

Deep Instinct Threat Lab

From Deep Instinct Threat Lab.