di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Prevention Platform

Prevention for Applications

Prevention for Endpoints

Products

Prevent Ransomware

Prevent Zero-Day Attacks

Improve EPP Efficacy

Extend & Enhance EDR

Stop Fileless Attacks

Solutions

Deep Learning in Cybersecurity

Our Customers

+ MS Defender

VS Traditional Antivirus

Why Deep Instinct

About Deep Instinct

Newsroom

Careers

Contact Us

Company

Asset Library

Blog

Videos

Training

Resources

Request Demo

Customer Portal

Integrations and Compliance

Quick links

Events & Webinars

Leadership Team

Board of Directors

Partners

Login

content_block

Recent Blog Posts

Recent Blog Posts

posts_listing

Blog Listing Page

cve-2023-23397-blog-image.jpg

Disclaimer: This blog contains sensitive information but since this information is publicly available and at least partially public knowledge we decided not to redact any information as it would cause this post to be irrelevant. Due to the simplicity of the attack and the fact it does not require user interaction we are urging everyone to patch their systems immediately.On March 14, 2023, Microsoft released a security fix for an elevation-of-privilege vulnerability (CVE-2023-23397) in Microsoft Outlook.A specially crafted email can trigger the vulnerability automatically when it is retrieved and processed by the Outlook client. Such an email could lead to exploitation before the email is viewed in the Preview Pane, which allows an attacker to steal credential hashes by forcing the target’s devices to authenticate to an attacker-controlled server.The Computer Emergency Response Team for Ukraine (CERT-UA) reported the vulnerability to Microsoft. Based on Microsoft Threat Intelligence, a Russia-based threat actor used it in attacks to target and breach the network of several governments, military, energy, and transportation organizations in Europe between April and December 2022.MDSec already <a href="https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/" target="_blank">demonstrated</a> a POC of this attack and security researcher <a href="https://twitter.com/kevthehermit/status/1635981427400400897" target="_blank">@KevTheHermit</a> found a sample of an email attack in the wild.Deep Instinct Threat Lab found additional samples exploiting this vulnerability including the potential attack that was reported by CERT-UA.The samples can be grouped into five distinct clusters. Below is a timeline of the attacks:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt032ce0ad10df7dd6" alt="Figure 1: Timeline of attacks utilizing CVE-2023-23397" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt032ce0ad10df7dd6/6413c20811934c1085402d52/fig1-timeline-of-attacks-utilizing-cve-2023-23397.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: Timeline of attacks utilizing CVE-2023-23397</figcaption></figure><h3>Possible Attribution</h3>Microsoft attributed the attack to a Russian-based threat actor. The attacks on Romania, Poland, and Ukraine align with Russian interests, while the attacks on Jordan and Turkey might be related to a different threat actor.This attack vector, which leads to NTLM harvesting, was also <a href="https://unit42.paloaltonetworks.com/xhunt-campaign-new-watering-hole-identified-for-credential-harvesting/" target="_blank">observed</a> in 2020 by Iranian threat actors. Additionally, Russia and Iran have signed a cyber-cooperation <a href="https://www.cfr.org/blog/iran-russia-cyber-agreement-and-us-strategy-middle-east" target="_blank">agreement</a>.The Jordanian foreign ministry has been targeted in the <a href="https://therecord.media/apt34-oilrig-iran-jordan-email-campaign-malwarebytes" target="_blank">past</a> by Iranian threat actors, which might indicate the vulnerability was shared with the Iranians.NTLM harvesting could be used either to hash relay attacks or for offline password cracking, indicating that the attacker either had prior access to the attacked organization or they have knowledge of remote-authentication services that do not require multi-factor authentication.<h3>Hunting for the Vulnerability</h3>Microsoft <a href="https://microsoft.github.io/CSS-Exchange/Security/CVE-2023-23397/" target="_blank">provided</a> a PowerShell script to retroactively search for potentially malicious messages containing the vulnerability. The script looks for three types of messages – note, appointment, and task:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt46f1b647b377698d" alt="Figure 2: Microsoft’s PowerShell code that looks for three specific types of messages" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt46f1b647b377698d/6413c2080c29c7363bf3956f/fig2-microsofts-powershell-code-that-looks-for-specific-messages-from-cve-2023-23397.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 2: Microsoft’s PowerShell code that looks for three specific types of messages</figcaption></figure>This could indicate that the vulnerability can be triggered by any of those types of messages. If you are using Outlook, you might be familiar with some of them:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt298f779daa396908" alt="Figure 3: How to manually create a legitimate task or appointment" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt298f779daa396908/6413c20858d08575eae5b295/fig3-how-to-legitimately-create-manual-task-appointment-outlook.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 3: How to manually create a legitimate task or appointment</figcaption></figure>While MDSec used an “appointment” message in their POC, the attacks in the wild used a “task” message:<figure style = "margin: auto; text-align: center;width: 433px;"><img asset_uid="blt398e5bc10dee52f8" alt="Figure 4: IPM.Task property in malicious email ITW" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt398e5bc10dee52f8/6413c2084d478f2618dc953c/fig4-ipm.task-property-in-malicious-itw-cve-2023-23397.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4: IPM.Task property in malicious email ITW</figcaption></figure>Using the following query in VirusTotal we found suspected emails with the vulnerability: “content:{490050004d002e005400610073006b00} tag:outlook”If the email also contains a UNC path this means this is a malicious task using the vulnerability.However, we found extracts from emails sent to Polish targets dated in the September timeframe that are not found via the query above:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt76275f2529aacbeb" alt="Figure 5: File from September containing characteristics of CVE-2023-23397" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt76275f2529aacbeb/6413c2081605593a8b0d15d0/fig5-file-from-september-containing-characteristics-of-cve-2023-23397.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5: File from September containing characteristics of CVE-2023-23397</figcaption></figure><h3>Conclusion</h3><ul><li>While we found evidence of attacks starting in April 2022, there is a possibility that it was exploited even earlier.</li><li>Due to the fact that we used only publicly available data the actual scope of attacked targets could be much higher.</li><li>Microsoft attributed the attacks to a Russian-based threat actor; however, public evidence might suggest another threat actor exploited the vulnerability as well.</li><li>Since the attack does not require user interaction, we urge everyone using the Outlook application to patch their systems as soon as possible.</li><li>We also suggest running the PowerShell script <a href="https://microsoft.github.io/CSS-Exchange/Security/CVE-2023-23397/" target="_blank">provided</a> by Microsoft to find retroactively malicious emails in the exchange server.</li></ul><h3>IOCs</h3>24.142.165[.]2 101.255.119[.]42 113.160.234[.]229 168.205.200[.]55 181.209.99[.]204 185.132.17[.]160 213.32.252[.]221

CVE-2023-23397: Exploitations in the Wild – What You Need to Know

emotet-returns-2023-blog.jpg

Earlier this week, on Tuesday, March 7th, Emotet was observed for the first time this year sending new malspam to infect victims. This is significant because the last time Emotet was seen sending malicious spam was in <a href="/blog/emotet-vacation-is-over-no-rest-for-the-wicked" target="_self">November</a> of 2022. This current wave is different from the one in November, though, including new evasion techniques that we will detail in this blog. Deep Instinct’s Threat Research team has been tracking Emotet over the last year and has written about its periods of silence and reemergence with new tactics. We will continue to track the malware and alert the community to any changes or activity. <ul><li>November 17, 2022: <a href="/blog/emotet-vacation-is-over-no-rest-for-the-wicked" target="_self">Emotet Vacation Is Over: No Rest For The Wicked</a></li><li>June 9, 2022: <a href="/blog/emotet-malware-returns-in-2022" target="_self">Emotet Malware Returns in 2022</a></li></ul>The first to observe and tweet about Emotet’s return was <a href="https://twitter.com/ilbaroni_/status/1633087980561735680" target="_blank">@ilbaroni_</a>: <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt06f56e90c1fd7d11" alt="Figure 1: First public observation of Emotet’s return" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt06f56e90c1fd7d11/640a621ee5ffbf108e0bbf3f/fig1-first-public-observation-of-emotets-return.png" height="auto" /><figcaption style = "text-align: center;" >Figure 1: First public observation of Emotet’s return</figcaption></figure> <h3>Delivery via Thread Hijacking Emails  </h3>The delivery method that Emotet used is the same as in November, however, this time the attached zip files are not password protected. Deep Instinct’s Threat Research team observed thread-hijacked emails sent to companies around the globe, including in Japan: <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt20e3927b313134eb" alt="Figure 2: Thread-hijacked mail in Japanese" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt20e3927b313134eb/640a621e6d0cf81016ab9102/fig2-thread-hijacked-mail-in-japanese.png" height="auto" /><figcaption style = "text-align: center;" >Figure 2: Thread-hijacked mail in Japanese</figcaption></figure> <h3>Changes to Emotet Malspam </h3>In November, Emotet was sending malicious Excel files in the archives. Now Emotet is sending archives with malicious Word files. The Word files include macros that, if enabled, start the infection chain. The first page contains an image that tries to lure the receiver to enable macros: <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltf706d459b420f0d1" alt="Figure 3: Social engineering lure on first page" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf706d459b420f0d1/640a621ea7d98e0267ed3669/fig3-social-engineering-lure-on-first-page.png" height="auto" /><figcaption style = "text-align: center;" >Figure 3: Social engineering lure on first page</figcaption></figure> The second page is blank, while pages 3-7 are excerpts from the novel “<a href="https://en.wikipedia.org/wiki/Moby-Dick" target="_blank">Moby-Dick</a>” which are written in white font to make the pages appear blank. The whole document has 14,801 characters and 2,587 words; the text is added as part of an evasion technique. Many security tools will classify a Word document with just an image and a macro as malicious, which is true in most cases. Some people still use macros for legitimate reasons, despite there being little reason to do so with the advances we have made in technology in the 21st century. Adding textual context to a file with macros might fool some security tools into thinking that the file is benign: <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt9396b636b76e97a8" alt="Figure 4: Changing the font color reveals the hidden text" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9396b636b76e97a8/640a621f325d0044fe5fabb6/fig4-changing-font-color-reveals-hidden-text.png" height="auto" /><figcaption style = "text-align: center;" >Figure 4: Changing the font color reveals the hidden text</figcaption></figure> The Word document in the example contains several long and obfuscated macros which download and execute a ZIP file containing the Emotet DLL from one of several compromised websites. If that’s not enough, the most interesting change made by Emotet that it now artificially inflates the size of the Word document to over 500mb: <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt4771a740a24441f5" alt="Figure 5: Zero bytes are added to the end of the document." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4771a740a24441f5/640a621fe35cc90ebcbd3896/fig5-zero-bytes-are-added-to-end-of-document.png" height="auto" /><figcaption style = "text-align: center;" >Figure 5: Zero bytes are added to the end of the document.</figcaption></figure> This is done by simply adding zero bytes at the end of the document. Deep Instinct researchers have <a href="/blog/the-russian-spyagent-a-decade-later-and-rat-tools-remain-at-risk" target="_self">seen this technique previously</a> used to inflate the final payloads, such as executables or DLL files. The result is like the one before, and because the files are so big, many security products and sandboxes don’t scan them, which breaks the automatic analysis and IOC extraction. As mentioned earlier, the macros download a ZIP file from compromised hosts which contain a DLL file which is the Emotet loader. This DLL is also inflated with zero bytes to a file size of over 500mb. The combination of both the initial attack vector and the payload being artificially inflated might completely blind products that solely rely on static analysis. Despite these changes the behavior of the loader appears the same. In the past Emotet used to copy a local version of the certutil.exe; this time Emotet drops a specific version of renamed certutil into “&lt;AppData&gt;\Local\Temp.” The hash of the observed version is: 4224312da8c3a37b95dd78236fca5ca316021c5de6e517d0ddc753ee26932e6a Emotet is still using process injection, therefore, security products that do not rely solely on static detection have a better chance at stopping the current wave. <h3>IOC </h3>DOC: a13b394e4017c0c77faf4fab6c3aea4de3443f11610cc85a1d677249b9b2bc3a DLL: efcf59f4423df8fdacbfa8c3d23b6a3e4722bab65c31ea8a7f32daadddfa7adc For the full list of IOCs (278) visit our <a href="https://github.com/deepinstinct/Emotet-IOCs" target="_blank">GitHub page</a>.

Emotet Again! The First Malspam Wave of 2023

ducktail-blog.jpg

DUCKTAIL: Threat Operation Re-emerges with New LNK, PowerShell, and Other Custom Tactics to Avoid Detection

gartner-mq-2022-pr.jpg

We’re thrilled to announce our inclusion in the 2022 Gartner Magic Quadrant for Endpoint Protection Platforms (EPP).As the only new vendor recognized in the Magic Quadrant for EPP last year, we believe our inclusion reinforces our position that the EPP status quo is ripe for disruption in a market that has over-rotated towards a reactive detection and response approach.Deep Instinct’s innovative deep learning approach is filling a gap in the market to prevent unknown threats missed by other solutions. Our mission is to prevent-first and <a href="/endpoint-detection-response" target="_self">augment EDR solutions</a> to reduce the overall events that need investigation, lower risk, and improve the lives of SOC teams everywhere.With the continued climb in breaches, zero-days, and successful ransomware attacks, we believe EPP solutions must adopt a prevention-first mindset with proactive AI to turn the tides on bad actors.<h3>The start of a revolution: Prevention-first</h3>Deep Instinct takes a different approach to EPP: preventing unknown malware before it can get inside your environment, with the only native deep learning-based solution.To underscore the need for a more proactive approach to cybersecurity you don’t have to look further than the <a href="https://www.ibm.com/reports/data-breach?utm_content=SRCWW&p1=Search&p4=43700072379268622&p5=p&gclid=Cj0KCQjw--2aBhD5ARIsALiRlwBFTwvdWGfzwBjj8K8QEHBkVMKg1cgkvQ7rXxggqVcYyDKshixt7ZAaAk5DEALw_wcB&gclsrc=aw.ds" target="_blank">IBM 2022 Cost of Data Breach Report</a><ul><li>The average cost of data breaches is now $4.35 million globally – up 2.6% from the previous year.</li><li>The United States incurred the highest costs, with an average total of $9.44 million.</li><li>60% of businesses had to the increase in cost of their products in response.</li></ul><h3>The Unknowns and Assume Breach challenges</h3>The industry is seeing ransomware and other threats continuing to increase is great part because today’s solutions are built to detect, not prevent, and are therefore too reactionary.The focus over the last decade has been mainly focused on assume breach/detection-first and has not stopped attacks from succeeding. There are a few reasons to point to as an explanation:<ul><li>Attackers are learning new ways to evade the controls meant to stop them.</li><li>Ransomware and zero-day attacks are being missed.</li><li>Overworked and understaffed security teams have too many alerts to handle and triage.</li><li>A high rate of false positives impacts a solution’s effectiveness.</li><li>It takes too long to detect a threat and time is not on our side.</li></ul>Case in point is the more recent XDR movement. While XDR has the amiable goal of a more integrated ecosystem, with more telemetry there will also be more data to sift through post detection, delaying decisions. This post-execution analysis will prove to be a challenge especially in a large enterprise. XDR will be useful for remediation and response, but not where the biggest problem lies – preventing the attack from getting inside in the first place.The market is calling for greater protection and needs true prevention capabilities. Deep Instinct expects to see a shift in priorities as SOC organizations realize they can truly prevent more events to minimize business disruption and lighten their workload by reducing the need to chase alerts and react to false positives.<h3>How Deep Instinct is changing outcomes with prevention-first</h3>Deep Instinct is the only EPP vendor that is laser-focused on a prevention-first approach and the only vendor to natively develop a deep learning framework dedicated to cybersecurity. We believe our unique approach is the key to changing the game against attackers and providing dramatically different outcomes.Deep Instinct is helping our customers combat these challenges:<ul><li>Prevent threats before they can fully execute and land inside your environment</li><li>Prevent ransomware, zero day, and other unknown threats in &lt;20ms</li><li>Increase SOC efficiency by reducing false positives to &lt;0.1%<ul><li>Improve SOC effectiveness with fewer events to react to</li><li>Provide time to focus on what really matters to the organization</li><li>Lower the volume of telemetry threat hunters must parse to string together related events</li></ul></li><li>Improve efficacy without relying on cloud checks for threat intelligence</li><li>Lower total cost of ownership with reduced remediation efforts and minimal maintenance</li></ul><h3>Prevention-first outcomes</h3><a href="/pdf/unit-221b-deep-instinct-product-assessment" target="_self">Unit 221B, a cybersecurity consultancy, tested and evaluated Deep Instinct’s claims</a>. This team of ex-hackers and self-described skeptics put Deep Instinct through the wringer and came away with proof of the efficacy of the solution. Unit 221B validated Deep Instinct by several methods, including creating its own unique malware to bypass our prevention. The results speak for themselves.<blockquote class="ml-3 pl-3 border-l">“Deep Instinct was able to showcase why deep learning is a revolutionary technology for fighting and predicting the attacks of tomorrow, while maturing your security posture today.” - Lance James, CEO, Unit 221B</blockquote><a href="/pdf/unit-221b-deep-instinct-product-assessment" target="_self">Unit 221B Key findings</a> include the following:<ul><li>99.78% Accuracy - Deep Instinct exhibited a combined 99.78% accuracy rate for detection and prevention across unknown and custom attacks. Unit 221B tested Deep Instinct with a recommended configuration suitable for a mature customer’s hardened environment.</li><li>100% of Unknown Attacks - Deep Instinct successfully prevented 100% of unknown attacks and 96.4% of Unit 221B’s customized attacks.</li><li>60% Reduction - In events/alerts recorded to SIEM/EDR solutions with Deep Instinct installed compared to <a href="/vs-microsoft-defender" target="_self">Microsoft Defender alone</a>. This results in less strain on staffing and lowering of alert fatigue levels, allowing staff to be more focused on strategic and critical tasks such as patching and system hardening.</li></ul><h3>It’s time for a change.</h3>Deep Instinct set out to drive better outcomes and improve security for organizations of all sizes as an agent on the endpoint or deployed with our REST API to protect file uploads.The status quo reactionary approach is taking a toll on <a href="/voice-of-secops-reports" target="_self">cybersecurity leaders and their staff with many thinking of leaving the industry</a> altogether at a time when staffing shortages are growing worse. We must think differently about the problem if we expect different outcomes. Taking a prevention-first approach to stopping more attacks, earlier and faster, is possible due to Deep Instinct’s innovation steeped in deep learning.To learn more: <a href="https://info.deepinstinct.com/gartner-mq-2022" target="_blank">https://info.deepinstinct.com/gartner-mq-2022</a>Gartner, Magic Quadrant for Endpoint Protection Platforms, Peter Firstbrook, Chris Silva, 31 December 2022.GARTNER is a registered trademark and service mark, and Magic Quadrant and PEER INSIGHTS are registered trademarks of Gartner, Inc. and/or its affiliates in the U.S. and internationally and are used herein with permission. All rights reserved.Disclaimer: Gartner does not endorse any vendor, product, or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.Gartner Peer Insights content consists of the opinions of individual end users based on their own experiences with the vendors listed on the platform, should not be construed as statements of fact, nor do they represent the views of Gartner or its affiliates. Gartner does not endorse any vendor, product or service depicted in this content nor makes any warranties, expressed or implied, with respect to this content, about its accuracy or completeness, including any warranties of merchantability or fitness for a particular purpose.

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

esxiargs-ransomware-blog.jpg

Targeting VMware ESXi is not new; previous ransomware attacks such as Babuk, AvosLocker, BlackCat, Hive, and others have targeted it as well. The uniqueness of ESXiArgs is that it’s only targeting ESXi and it’s exploiting a two-year-old vulnerability resulting in remote code execution (RCE).Such attacks are often performed as a blitz attack in an effort to infect several victims at once. Otherwise, other potential victims would patch or remediate the initial attack vector before it can widely spread. In just two weeks, this attack has affected a few thousand victims.<h3>Surprise Attack</h3>While everyone was following the hype around ChatGPT and debating a better alternative from Google and Microsoft, ESXiArgs took advantage of the distraction and launched a large-scale ransomware attack.Are we surprised? Nope. This is not the first time, and definitely not last, that threat actors exploited old unpatched vulnerabilities to perform a large-scale attack. A few others?<ul><li>CV-2013-0431 – A vulnerability in JRE exploited by Reveton Ransomware. The CVE is from 2013. It was exploited in 2019-2022.</li><li>CVE-2013-1493 – A flaw in Oracle Java exploited by Exxroute Ransomware.</li><li>CVE-2019-7481 – A vulnerability in SonicWall used by HelloKitty Ransomware.</li></ul>The list is long, so we summarized it using the <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" target="_blank">Known Exploited Vulnerabilities Catalog by CISA</a> by the year the CVE was published and when it was exploited in the wild.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltecfdc965cec8e5e8" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltecfdc965cec8e5e8/63ee61eebb6c4e1c079f6199/fig01-years-between-cve-published-and-found-exploited.png" alt="Figure 1: Known exploited vulnerabilities “age”" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: Known exploited vulnerabilities “age”</figcaption></figure>The above chart shouldn’t surprise anyone. Previous research shows that more than 60% of the vulnerabilities found in corporate networks were disclosed on or before 2016. Looking at the graph above, we can see that after the first spike caused by CVE publication is around ~1.5 years; the next period is between two and five years. These are the types of exploits we currently see in the “blitz” attacks by ESXiArgs.Remember <a href="/blog/log4shell-cve-2021-44228-what-you-need-to-know" target="_self">Log4J</a>? It’s still being actively exploited.Because of the complex networks of large enterprises, it generally takes more time to patch vulnerabilities. This also makes the enterprise a perfect victim for cyber threat groups as the following diagram demonstrates.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltc3c0d68a4e8b7e86" alt="Figure 2: Reasons why enterprises are often attacked using old vulnerabilities" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc3c0d68a4e8b7e86/63ee61ee723591743bc4db8f/fig02-CVE_organizationFlow.png" height="auto" /><figcaption style = "text-align: center;" >Figure 2: Reasons why enterprises are often attacked using old vulnerabilities</figcaption></figure>There are still a lot of unpatched vulnerabilities. As an example, we looked at a similar vCenter vulnerability with RCE exploit CVE-2021-21985, which according to Shodan has hundreds of potentially exposed vulnerable servers.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt2f4f79228103b952" alt="Figure 3: Exposed vCenter with potential CVE-2021-21985 (7.0.0, 6.5.0, 6.7.0)" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2f4f79228103b952/641c782b9c37a23c2e2feba2/fig03-vcenter-vuln.png" height="auto" /><figcaption style = "text-align: center;" >Figure 3: Exposed vCenter with potential CVE-2021-21985 (7.0.0, 6.5.0, 6.7.0)</figcaption></figure>If you are using ESXi, the following critical CVEs should be patched to protect your organization.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltbab0ea5ae6e2257d" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltbab0ea5ae6e2257d/63ee61ee78d9365b0e5aba26/fig04-vcenter-CVEs.png" alt="Figure 4: vCenter CVEs from CVEdetails.com" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4: vCenter CVEs from CVEdetails.com</figcaption></figure><h3>ESXiArgs Initial Vector</h3>The ESXiArgs campaign affected a lot of entities, mainly in France, according to Censys:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt7a232be6ccb38131" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7a232be6ccb38131/63ee61ee8144df106174be0b/fig05-censysVictims.png" alt="Figure 5: Affected countries by ESXiArgs according to Censys.com" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5: Affected countries by ESXiArgs according to Censys.com</figcaption></figure>As the initial vector the attackers exploited CVE-2021-21974, several POCs can be found in GitHub.The CVE itself is two years old and is part of this <a href="https://www.vmware.com/security/advisories/VMSA-2021-0002.html" target="_blank">security advisory</a>. It exploits OpenSLP in ESXi with a heap-overflow vulnerability that may result in remote code execution. A few days after disclosure approximately 6,700 potentially vulnerable and exposed to the internet vCenter servers were found via Shodan service.It’s important to note that this CVE, like many others, is relevant only if your ESXi instance is exposed to the internet (which is not best practice) or the attacker is already inside your network.In-depth analysis of the CVE-2021-21974 can be found <a href="https://straightblast.medium.com/my-poc-walkthrough-for-cve-2021-21974-a266bcad14b9" target="_blank">here</a>.<h3>Campaign Impact</h3>Analyzing the impacted machines with the same ransom note shows a similar demand: 2.01 to 2.09 BTC (~ $45k).<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt5b856292e122eafa" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5b856292e122eafa/63ee61eeebf0774eed52e0bd/fig06-ransomnote.png" alt="Figure 6: Ransom Note of ESXiArgs" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 6: Ransom Note of ESXiArgs</figcaption></figure>Out of all extracted wallets (~2,800) we have found only four (4) that received payments. As an example, a victim from London paid $44,742.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltb5c8bb8d41286aa4" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb5c8bb8d41286aa4/63ee61ee4fafdf1128473a60/fig07-payment.png" alt="Figure 7: Ransom payment" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 7: Ransom payment</figcaption></figure>Following is the message hosted on the infected server:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltfcd4917c219e0fb0" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltfcd4917c219e0fb0/63ee61eee47ca559926e5229/fig08-demadnpaid.png" alt="Figure 8: Ransom note of the above payment" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 8: Ransom note of the above payment</figcaption></figure>The payment was completed on 02.03.2023, and as of today, the server is still exposed to the internet, and at the moment of writing, appears to be unpatched.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt273ec42d2ad660aa" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt273ec42d2ad660aa/63ee61ee68b812598c76de7a/fig09-exposed-vcenter.png" alt="Figure 9: Infected ESXi server exposed" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 9: Infected ESXi server exposed</figcaption></figure><figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt1fe05bcc8b18b6eb" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1fe05bcc8b18b6eb/63ee61ee2b5f1f5b059f155b/fig10-shodanpaid.png" alt="Figure 10: Affected ESXi server unpatched according to Shodan.io" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 10: Affected ESXi server unpatched according to Shodan.io</figcaption></figure>We will not get into each payment, but there appear to only be a few out of more than 2000 victims.This small number we believe can be attributed to the best practice of ESXi backups that help companies avoid payment. Additionally, CISA published a tool to restore encrypted virtual machines.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt752516c3429ade8d" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt752516c3429ade8d/63ee61f50773755832f8a1e4/fig11-ESXiArgs-Recover-readme.png" alt="Figure 11: Recover script published by CISA" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 11: Recover script published by CISA</figcaption></figure>It is worth mentioning that shortly after the above announcement, ESXiArgs released a newer version of the ESXi ransomware changing the encryption process that makes the above script from CISA useless.<h3>Responsibility of the campaign</h3>It is not yet clear who is behind the attack, but there are a few clues pointing to different threat actors.<ol><li>LockBit – They performed similar attacks, and they announced a new ESXi Ransomware variant in January 2023. On the other hand, none of the victims is reflected in their leak site. It could be some affiliates of LockBit acting on their own.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt664b4e5ad5b51e9b" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt664b4e5ad5b51e9b/63ee61f514a7481116d535cf/fig12-LockbitLeaks.png" alt="Figure 12: LockBit leak site" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 12: LockBit leak site</figcaption></figure> And yes – “Royal Mail Group” leak was published – but that’s another story.</li><li>Babuk – Security researcher Michael Gillespie believes that it appears to be a new strain based on leaked source code from the Babuk ransomware. In the middle of 2022, there was a similar case: CheersCrypt ransomware targeting ESXi that was based on the leaked Babuk source code.</li><li>Nevada – French cloud computing provider OVHCloud backtracked on its initial findings suggesting a link to the Nevada ransomware variant.</li><li>A new threat actor using a combination of previous ESXi ransomware.</li></ol><h3>Attacker Plan</h3><figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltc0fb5962d42f35d5" alt="Figure 13: Attacker Plan" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc0fb5962d42f35d5/641c77f0f25d792241569bf4/fig13-CampaignFlowESXI.png" height="auto" /><figcaption style = "text-align: center;" >Figure 13: Attacker Plan</figcaption></figure><figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltf0eebac84a28d23d" alt="Figure 14: Encrypt.sh script " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf0eebac84a28d23d/63ee61f53b3df420b76444f6/fig14-encrypt.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 14: Encrypt.sh script</figcaption></figure><h3>Recommendation</h3><ol><li>Patch your ESXi servers or implement the workaround suggested by VMware.</li><li>Do not expose ESXi servers to the internet or whitelist specific IP addresses.</li><li>Implement best–practice vulnerability management – but do not rely only on that. A <a href="/endpoint-security" target="_self">world-class Endpoint Protection Platform (EPP)</a> is still required.</li><li>In case of infection, follow the suggested <a href="https://github.com/CERT-hr/ESXI-Ransomware-Removal-FlowChart/blob/main/ESXiFlowChart3.png" target="_blank">flowchart</a> by CERT-HR:</li></ol><figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltb2aa780769a67581" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb2aa780769a67581/63ee61f59b18a175e2431ea5/fig15-FlowChartCert.png" alt="Figure 15: Flowchart in case of infection by CERT-HR" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 15: Flowchart in case of infection by CERT-HR</figcaption></figure><h3>IOCs</h3><table><tbody><tr><td>73c66de7964b86b9fe32563b7d3195b87896a644c2bcdcaea74b81cb5da2a06b</td><td style="width: 15%;">encrypt.sh</td></tr><tr><td>773d147a031d8ef06ee8ec20b614a4fd9733668efeb2b05aa03e36baaf082878</td><td>vmtools.py</td></tr><tr><td>10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459</td><td>encrypt.sh</td></tr><tr><td>5a9448964178a7ad3e8ac509c06762e418280c864c1d3c2c4230422df2c66722</td><td>encrypt.sh</td></tr><tr><td>11b1b2375d9d840912cfd1f0d0d04d93ed0cddb0ae4ddb550a5b62cd044d6b66</td><td>encrypt</td></tr><tr><td>7f39818a30879b314ffcff70d2e196fabec60ad94551547cf0e19f6bc3055a97</td><td>CVE-2021-21974.py</td></tr><tr><td>773d147a031d8ef06ee8ec20b614a4fd9733668efeb2b05aa03e36baaf082878</td><td>local.sh</td></tr><tr><td>ee1f73140605bc1475792e4b26102caa2b2ef838590f9f73a1e4a39feda72634</td><td>Encrypt00.sh</td></tr><tr><td>e1d2d6cba7dcc0d87884e9cfdf1a5141dd7649cb8958133fb9bd0659b377ed6e</td><td>Encrypt00.sh</td></tr><tr><td>c13a5bfb4bddfb1b7ce2fa3e6ae4745566490b50b58e3ff1e57c1d1c2f696760</td><td>Encrypt1.sh</td></tr><tr><td>11b1b2375d9d840912cfd1f0d0d04d93ed0cddb0ae4ddb550a5b62cd044d6b66</td><td>Encrypt</td></tr><tr><td>7adde6d89b1e6e5eeaf3aa2e802dcb1c81dae0b3b44550a53d48d75e94a744bf</td><td>Hello (Encrypt.sh)</td></tr></tbody></table><h3>MITRE ATT&CK:</h3><table><thead class="bg-grey"><tr><th style="width: 14%;">Tactic</th><th>Technique</th><th>Description</th><th style="width: 13%;">Observable</th></tr></thead><tbody><tr><td>Execution</td><td>T1059.004 Command and Scripting Interpreter: Unix Shell</td><td>Encrypt.sh execution</td><td>encrypt.sh</td></tr><tr><td>Discovery</td><td>T1083 File and Directory Discovery</td><td>Searching for all VM files</td><td>encrypt.sh</td></tr><tr><td>Discovery</td><td>T1057 Process Discovery</td><td>Killing all processes that may cause deny of access to VM files</td><td>encrypt.sh</td></tr><tr><td>Impact</td><td>T1486 Data Encrypted for Impact</td><td>Encrypting VMs</td><td>encrypt</td></tr></tbody></table><h3>References:</h3><a href="https://github.com/n2x4/Feb2023-CVE-2021-21974-OSINT" target="_blank">https://github.com/n2x4/Feb2023-CVE-2021-21974-OSINT</a><a href="https://github.com/Shadow0ps/CVE-2021-21974" target="_blank">https://github.com/Shadow0ps/CVE-2021-21974</a><a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" target="_blank">https://www.cisa.gov/known-exploited-vulnerabilities-catalog</a><a href="https://www.vmware.com/security/advisories/VMSA-2021-0002.html" target="_blank">https://www.vmware.com/security/advisories/VMSA-2021-0002.html</a><a href="https://gist.github.com/cablej/b15edac9c45faa258e1b94bc0a454551" target="_blank">https://gist.github.com/cablej/b15edac9c45faa258e1b94bc0a454551</a><a href="https://github.com/cisagov/ESXiArgs-Recover" target="_blank">https://github.com/cisagov/ESXiArgs-Recover</a><a href="https://straightblast.medium.com/my-poc-walkthrough-for-cve-2021-21974-a266bcad14b9" target="_blank">https://straightblast.medium.com/my-poc-walkthrough-for-cve-2021-21974-a266bcad14b9</a><a href="https://www.bleepingcomputer.com/news/security/cheerscrypt-ransomware-linked-to-a-chinese-hacking-group/" target="_blank">https://www.bleepingcomputer.com/news/security/cheerscrypt-ransomware-linked-to-a-chinese-hacking-group/</a><a href="https://github.com/CERT-hr/ESXI-Ransomware-Removal-FlowChart" target="_blank">https://github.com/CERT-hr/ESXI-Ransomware-Removal-FlowChart</a><a href="https://www.cvedetails.com/vulnerability-list/vendor_id-252/product_id-20517/Vmware-Vcenter-Server.html" target="_blank">https://www.cvedetails.com/vulnerability-list/vendor_id-252/product_id-20517/Vmware-Vcenter-Server.html</a><a href="https://www.zdnet.com/article/these-old-security-vulnerabilities-are-creating-new-opportunities-for-hackers/" target="_blank">https://www.zdnet.com/article/these-old-security-vulnerabilities-are-creating-new-opportunities-for-hackers/</a>

No Surprise! ESXiArgs Ransomware Attacks Exploit 2-Year-Old Vulnerability

file-upload-security-blog.jpg

While most cybersecurity strategies are focused on the endpoint there is an overlooked risk that needs attention: your application file uploads.Applications are the backbone of modern business, with thousands (if not millions) of files uploaded and downloaded every day. If those files contain malware they pose a significant risk as they traverse through an organization’s IT infrastructure and end up stored in local or cloud repositories.Most organizations have challenges addressing these risks, such as:<ul><li>Files not being scanned at all</li><li>Files scanned with legacy tools that cannot keep up with the changing threat landscape</li><li>Security that slows down or interrupts business processes</li><li>Scanning tools that can’t scale up to enterprise volumes (up to 10s of millions of files daily)</li></ul>If a malicious file is downloaded and allowed to run, the attack begins, and it's a race to stop it before a breach. The struggle is that traditional security approaches are ineffective and unknown malware is easily passing through. Waiting until it ends up in storage and hits the endpoint is far too late.Read the full report: <a href="https://info.deepinstinct.com/file-upload-security" target="_blank">File Upload Security: The Missing Category for a Comprehensive Security Posture</a><h3>File Uploads in the Enterprise: A Business Risk</h3>Organizations must accept files through their web applications to run their business. But files uploaded by customers or end users could contain malware. In fact, <a href="https://www.morphisec.com/hubfs/2020%20State%20of%20Endpoint%20Security%20Final.pdf" target="_blank">80% of successful breaches</a> come from <a href="/zero-day-attacks" target="_self">new or unknown zero-day attacks</a>. These attacks most often come from the exploitation of undisclosed vulnerabilities or evolved malware variants that infiltrate a system unrecognized. Gartner states in their report on file upload security:<blockquote class="ml-3 pl-3 border-l">“…if the application provides access to a large number of external users, security leaders should require an application design that protects against the abuse of the channel for uploading malware.”</blockquote>File upload security is an ever-increasing necessity in today’s business environment. There are several traditional approaches that exist, but each has its individual drawbacks.<h3>How Traditional Security Approaches Fall Short</h3>There are four common approaches to preventing malicious file uploads: Traditional anti-virus (AV), multi-AV, file sandboxing, and content disarm & reconstruction (CDR). Each solution approaches the problem uniquely, but all fall short of providing complete protection.In a nutshell, single AV won’t catch new malware variants, multi-AV suffers the same problem, sandboxing causes delays that are not acceptable to the business, and CDR (while effective) often manipulates and destroys content and requires numerous business exceptions creating an administrative nightmare.Further drawbacks of AV, Sandbox, and CDR solutions include the following:<ul><li>Business disruption</li><li>Scalability issues</li><li>Low unknown malware catch rate coupled with high false positive rate</li><li>Limited number of file types scanned</li><li>Vast CPU and infrastructure resource requirements</li></ul>For a more in-depth analysis, check out the blog post: <a href="/blog/top-3-drawbacks-of-content-disarm-reconstruction-cdr-for-malware-prevention" target="_self">Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention</a>.<h3>A New Approach: The Requirements</h3>To meet the demands of today’s enterprise and cloud-first organizations, a better solution is needed. The solution needs to quickly scan files and return a verdict without an impact on business operations or SOC team productivity.The most advanced AI, Deep Learning, is a core requirement to create a solution that autonomously prevents unknown malware. A solution natively architected with Deep Learning can achieve the following:<ul><li>Scan tens of millions of files per day with &lt;0.1% false positives</li><li>Prevent &gt;99% of unknown malware, whether offline or online</li><li>Deliver decisions without a reliance on cloud threat intelligence feeds</li><li>Protect data privacy and file integrity</li><li>Scale to meet throughput needs of the largest enterprises</li></ul>Align to business requirements with minimal friction by providing:<ul><li>Flexible, deploy-anywhere model via a Docker container cluster</li><li>Reduced TCO by lowering CPU usage and infrastructure requirements</li><li>REST API or ICAP integration for DevOps to easily connect applications to scan files</li><li>Low AI model maintenance with only 2-3 updates needed per year</li></ul><h3>Enter Deep Instinct Prevention for Applications</h3><a href="/prevention-for-applications" target="_self">Deep Instinct Prevention for Applications</a> is an agentless, antimalware file scanning solution that was architected with deep learning at its core. Deployed in a container cluster and integrated via API or ICAP, Deep Instinct provides the flexibility and scale that meets the demands of the largest enterprises.Deep Instinct Prevention for Applications is already scanning tens of millions of files per day for some of the largest organizations in the world. Our customers are experiencing scan speeds of &lt;20ms per file and false positive rates well under &gt;0.1%. In addition, they are finding &gt;99% of unknown malware is stopped before it enters their environment, better protecting themselves and their customers.For a more in-depth discussion of file upload security and how traditional approaches are not enough, check out our <a href="https://info.deepinstinct.com/file-upload-security" target="_blank">File Upload Security: The Missing Category for a Comprehensive Security Posture</a> report.For more reading about threats lurking in file uploads:<ul><li><a href="/blog/emotet-vacation-is-over-no-rest-for-the-wicked" target="_self">Emotet is back</a></li><li><a href="/blog/no-macro-no-worries-vsto-being-weaponized-by-threat-actors" target="_self">VSTO takes over where macros left off</a></li><li><a href="/blog/top-3-drawbacks-of-content-disarm-reconstruction-cdr-for-malware-prevention" target="_self">CDR drawbacks</a></li></ul><h3>RESOURCES</h3><ul><li><a href="https://www.morphisec.com/hubfs/2020%20State%20of%20Endpoint%20Security%20Final.pdf" target="_blank">The Third Annual Study on the State of Endpoint Security Risk</a></li><li><a href="https://www.invicti.com/web-vulnerability-scanner/vulnerabilities/cross-site-scripting-via-file-upload" target="_blank">Cross-site Scripting Via File Upload</a></li><li><a href="https://dataprot.net/statistics/malware-statistics" target="_blank">A Not So Common Cold: Malware Statistics in 2022</a></li><li><a href="https://www.apriorit.com/dev-blog/545-sandbox-evading-malware" target="_blank">Malware Sandbox Evasion: Techniques, Principles & Solutions</a></li><li><a href="https://www.infusedinnovations.com/blog/secure-intelligent-workplace/what-is-content-disarm-and-reconstruction-cdr" target="_blank">What is Content Disarm and Reconstruction (CDR)?</a></li></ul>

Don’t Let Application File Uploads Become Malware Downloads

VSTO-blog.png

<h3>Introduction</h3>Office Visual Basic for Applications (VBA) macros have been a <a href="/blog/types-of-dropper-malware-in-microsoft-office" target="_self">core tool</a> in most threat actors’ arsenals for decades.Their capabilities have enabled clever — and just <a href="https://www.trustedsec.com/blog/malicious-macros-for-script-kiddies/" target="_blank">clever-enough</a> — threat actors to deliver a dizzying array of malware to countless devices around the world. During that time, they have served as what is quite possibly the most commonplace attack vector to infect and compromise Windows PCs. They also acted as a significant component of the first link in a malicious kill-chain that resulted in network compromises, data breaches, and ransomware incidents.This threat landscape prominence has recently been stifled by Microsoft’s long-awaited decision to <a href="https://learn.microsoft.com/en-us/deployoffice/security/internet-macros-blocked" target="_blank">block-by-default</a> any VBA macro in Office files bearing the mark-of-the-web (indicating that the file did not originate from the local machine). This significantly reduced this attack surface and forced threat actors to adapt and explore alternative attack vectors.One of these, which is gaining popularity, is the usage of .LNK (shortcut) files. An example of this can be seen in one of our <a href="/blog/the-dark-side-of-bumblebee-malware-loader" target="_self">recent reports</a>.Another such example is Visual Studio Tools for Office (VSTO). Below we explore some “in-the-wild” examples of how VSTO can become a significant attack vector.<h3>What is VSTO?</h3>A software development toolset, VSTO is available in Microsoft’s Visual Studio IDE. It enables Office Add-In’s (a type of Office application extension) to be developed in .NET and also allows for Office documents to be created that will deliver and execute these Add-In’s.Additionally, VSTO Add-In’s can be associated with the specific Office application they were developed for (Word, Excel, etc.) and will execute every time that application is booted, offering up an interesting persistence option on top of the code-execution ability.VSTO Add-In’s can be packaged alongside Office documents (Local VSTO), or, alternatively, fetched from a remote location when a VSTO-Bearing Office document is opened (Remote VSTO). This, however, may require bypass of trust-related security mechanisms.<h3>VSTO as a Threat Vector</h3>In the current threat landscape’s observed state, VSTO is still an uncommon vector (despite being initially <a href="https://bohops.com/2018/01/31/vsto-the-payload-installer-that-probably-defeats-your-application-whitelisting-rules/" target="_blank">discussed</a> quite <a href="https://twitter.com/gN3mes1s/status/939146796605018113" target="_blank">some time ago</a>). But as is often the case when an esoteric attack vector is involved, it also goes largely undetected by most security vendors, which may lead to it increasing in popularity in the near-term future.VSTO-bearing Office files contain several indicators which differentiate them from non-VSTO Office files, the primary of which is a contained “custom.xml” XML which contains “_AssemblyLocation” and “_AssemblyName” properties used by the Office application to locate the Add-In and install it.<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="bltae692c45fce8c9be" alt="Figure 1 - Example of a " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltae692c45fce8c9be/63da8c54df2bf910c80316e8/fig01-custom-xml-referring-local-vsto-add-in.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1 - Example of a "custom.xml" XML referring to a local VSTO Add-In.</figcaption></figure><h3>Local VSTO</h3>When VSTO is employed in its local “flavor” the .NET compiled .DLL “Add-In” and its dependencies are stored alongside the Office document created to execute it, commonly in a “container” such as an .ISO file.In the example detailed below, which targets Portuguese-speaking users, we can see a malicious .ISO file which contains a malicious Word document and a hidden VSTO “Add-In” and its dependencies:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt54d82b8f46d9881c" alt="Figure 2 - Malicious .ISO, Hidden files not shown, as would appear to most users." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt54d82b8f46d9881c/63da8c54c8540a111ada8b4b/fig02-malicious-iso-hidden-files-not-shown.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 2 - Malicious .ISO, Hidden files not shown, as would appear to most users.</figcaption></figure><figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blta83b367d030dd885" alt="Figure 3 - Malicious .ISO, hidden files shown, mostly dependencies, highlighted - Word document and VSTO " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta83b367d030dd885/63da8c545b2c1e6188c56ec2/fig03-malicious-iso-hidden-files-shown.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 3 - Malicious .ISO, hidden files shown, mostly dependencies, highlighted - Word document and VSTO "Add-In" payload.</figcaption></figure>Once the victim opens the malicious Word document, they are encouraged to install the “Add-In” in a very similar fashion to the way victims were encouraged to click the “Enable Content” button and allow a malicious VBA macro to execute.<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt41d8d794383d1aa8" alt="Figure 4 - Word document (“Eventos_CDG_1Maio.docx”) prompts the user to allow " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt41d8d794383d1aa8/63da8c540cf395166a6e22fb/fig04-word-doc-prompts-user-to-allow-add-in.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4 - Word document (“Eventos_CDG_1Maio.docx”) prompts the user to allow "Add-In" installation.</figcaption></figure><figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt1785537237489441" alt="Figure 5 - Malicious " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1785537237489441/63da8c54e480c910d1acbbb7/fig05-malicious-custom-xml-contained-by-eventos-referring-to-hidden-add-in.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5 - Malicious "custom.xml" contained by “Eventos_CDG_1Maio.docx” referring to the hidden “Add-In” present locally on the .ISO file.</figcaption></figure>Once allowed by the user, the malicious “Add-In” will be executed.<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="bltfd8952f6b1cd8776" alt="Figure 6 - VSTO installation prompt." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltfd8952f6b1cd8776/63da8c542d94ad4c89edc84d/fig06-vsto-installation-prompt.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 6 - VSTO installation prompt.</figcaption></figure>Examining the “Add-In” payload reveals it serves to execute an encoded and compressed PowerShell snippet:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="bltff7e2e81ed5f2a4f" alt="Figure 7 - " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltff7e2e81ed5f2a4f/63da8c544ad09d10da61ae0b/fig07-eventos_cdg_1maio.dll-payload-core.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 7 - "Eventos_CDG_1Maio.dll” payload “core”.</figcaption></figure>An interesting point of note is that the above code’s parent .NET namespace is “schell_test.” This appears to be a reference to a <a href="https://medium.com/@airlockdigital/make-phishing-great-again-vsto-office-files-are-the-new-macro-nightmare-e09fcadef010" target="_blank">post by Daniel Schell</a>, which predates the appearance of this sample by approximately two weeks.Decoding and decompressing from the above, the snippet is intended to deliver and execute additional PowerShell code from a Command & Control server:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt2deb8b0052b3ec77" alt="Figure 8 - Decoded and decompressed PowerShell snippet." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2deb8b0052b3ec77/63da8c543d28dd4dde642bc5/fig08-decoded-and-decompressed-powershell-snippet.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 8 - Decoded and decompressed PowerShell snippet.</figcaption></figure>Unfortunately, we were unable to obtain this additional 2nd-stage code as it had gone offline prior to our investigation of this sample.<h3>Remote VSTO</h3>VSTO can also be employed in remote fashion, i.e., the Add-In can be stored separately of the Office document created to deliver and execute it. This can make an attack employing VSTO even more challenging to detect or prevent. However, it can also be more complex for an attacker to execute because it requires bypassing various trust-related security mechanisms using a trusted publisher certificate, for example.In the example below, we can see a reference to a remotely stored VSTO “Add-In” taken from a malicious Word document:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="bltf4e068fa4bdd09dc" alt="Figure 9 - Remote VSTO " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf4e068fa4bdd09dc/63da8c545ca8a710cf4b7226/fig09-remote-vsto-custom-xml.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 9 - Remote VSTO "custom.xml" XML.</figcaption></figure>Examining the “Add-In” .DLL payload, which was obtained by cross-referencing threat intelligence data, we can see the following contained code which is intended to download a password protected .ZIP archive, extract it in the user’s %\AppData\Local\ folder, and execute a contained “conhost.exe” file.<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt29d36f5d1f3a9676" alt="Figure 10 - “3rd stage” payload delivery and execution code." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt29d36f5d1f3a9676/63da8c54e4e29e75dc5df0ee/fig10-3rd-stage-payload-delivery-and-execution-code.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 10 - “3rd stage” payload delivery and execution code.</figcaption></figure>Unfortunately, we were unable to obtain the 3rd-stage archive and its contained payload (“conhost.exe”) as it had gone offline prior to our investigation of this sample.<h3>POC of VTSO Attack Scenarios</h3>Partly as an academic exercise, and partly because the final payloads related to the above-described samples were unavailable, we decided to put together a proof of concept (POC) of how VSTO can be used in multiple types of attack scenarios.

In the above video, you can see a demonstration of our proof of concept delivering and executing a Meterpreter payload as well as establishing persistence on the victim’s machine.The POC code can be found in our public <a href="https://github.com/deepinstinct/VSTO-POC" target="_blank">GitHub repository</a>Please note that we used a simple, highly detectable, Meterpreter payload. This required us to disable <a href="/vs-microsoft-defender" target="_self">Microsoft Windows Defender</a> to film the above video. However, the rest of the POC components went completely undetected.<h3>Conclusion</h3>While VSTO Add-In's are relatively uncommon in the threat landscape due to the capabilities offered both in terms of execution (in theory – an entire fully-featured malware strain can be written and developed in .NET as a VSTO Add-In) and in terms of persistence, we expect more threat actors to adopt and employ them soon. This is particularly true of nation-state and other “high caliber” actors who are more likely to gain the ability to bypass the trust mechanisms present in the Windows environment by means such as a stolen (or otherwise obtained) trusted certificate.<h3>IOCs</h3>5530F5D20016E3F0E6BBC7FAD83EEC56F118179D4C5D89FC26863C37482F8930 E74DD27FF0BA050BBC006FD579B8022E07B570804588F0E861CC4B1321A3EC48 0526F63486DE882CCF33374DCA4B093219A8FD93014BABE794715F04FF49B151 B3282DC58AD961911D94B712CEA11F649B0BA785D7FF74D7ED9946E1260DD521 40C9D3D58CE5DB0C6D18184E5813C980CD7B72EFC7505C53CD13E60860EF8157 78D6A2C0B52E9E5AF8007BC824EFD5846585A3056B3A0E6EFDFA7E60EED48C8C hxxps://34.241.171.114/ hxxp://classicfonts.live/<h3>MITRE Mapping</h3><table><thead class="bg-grey"><tr><th style="width: 15%;">Tactic</th><th>Technique</th><th>Description</th><th>Observable</th></tr></thead><tbody><tr><td>Execution</td><td>T1204.002User Execution: Malicious File</td><td>User must open a malicious document</td><td>E74DD27FF0BA050BBC006FD579B8022E07B570804588F0E861CC4B1321A3EC48</td></tr><tr><td>Execution</td><td>T1059.001Command and Scripting Interpreter: PowerShell</td><td>PowerShell code is executed</td><td>0526F63486DE882CCF33374DCA4B093219A8FD93014BABE794715F04FF49B151</td></tr><tr><td>Defense Evasion</td><td>T1553.005Subvert Trust Controls: Mark-of-the-Web Bypass</td><td>.ISO container file used</td><td>5530F5D20016E3F0E6BBC7FAD83EEC56F118179D4C5D89FC26863C37482F8930</td></tr><tr><td>Defense Evasion</td><td>T1027Obfuscated Files or Information</td><td>Obfuscation used; Password protected file used.</td><td>0526F63486DE882CCF33374DCA4B093219A8FD93014BABE794715F04FF49B151, 78D6A2C0B52E9E5AF8007BC824EFD5846585A3056B3A0E6EFDFA7E60EED48C8C</td></tr><tr><td>Persistence</td><td>T1137.006Office Application Startup: Add-ins</td><td>VSTO Add-In's may be used for persistence</td><td>E62E05D9DE5DAAB900FC32941727870C018D7CFD46E2BAC43EF360B80B3A0B31</td></tr></tbody></table>

No Macro? No Worries. VSTO Being Weaponized by Threat Actors

cdr-blog.png

Application file uploads from external, internal, or third parties are an emerging threat vector.While traditional approaches like AV and Sandbox have been used by many organizations in an attempt to catch malicious content, they have severe drawbacks when it comes to speed, efficacy, and scale. CDR was created to address these concerns.On paper, Content Disarm and Reconstruction (CDR) looks quite promising to prevent malicious file uploads. However, it falls short in production.Below we discuss the history of CDR, its pros and cons, and a better alternative to malware prevention that will significantly reduce risk without friction for the business.We also detail other alternative file upload security solutions here: <a href="https://info.deepinstinct.com/file-upload-security" target="_blank">File Upload Security: The Missing Category for a Comprehensive Security Posture</a>.<h3>Content Disarm & Reconstruction (CDR)</h3>CDR arrived on the scene as a new way of preventing malicious files from entering an environment. Instead of scanning, inspecting, or fully analyzing every file, CDR targets active content within files, such as macros and VBAs, that could be potentially exploited or have malicious intent. The benefit of this technology is that it can work very quickly to inoculate potentially malicious files, so it avoids the delays introduced by file sandboxing.<figure style = "margin: auto; text-align: center;width: autopx;"><img alt="Source: SaniTOX - Content Disarm & Reconstruction(CDR) Service*" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4834b6dbec9d696e/63d156275c5c9c52a32ec073/cdr-workflow-process.png" /><figcaption style = "text-align: center;" style="text-align: center;">Source: SaniTOX - Content Disarm & Reconstruction(CDR) Service*</figcaption></figure><h3>Types of CDR</h3>There are three basic approaches to CDR:<ol><li>Flat-file conversion: Takes any new file with active content and creates a flat copy of it in PDF form. While quick and effective at minimizing the attack surface, this method erases legitimate content such as macros, form fields, and hyperlinks, due to its inability to distinguish between malicious and benign files.</li><li>Content stripping: Strips out active content and embedded objects and reconstructs the file in its original format to maintain some usability for the end user. The downside is that, once again, since CDR is unable to distinguish between malicious and benign files, legitimate content is destroyed, and admin interaction is frequently required to retrieve original files.</li><li>Positive selection: Attempts to address the shortcomings of the previous two methods by rebuilding files based on templates which serves to maintain full functionality of the file after reconstruction. It does this by copying only known-good (positively selected) components to the reconstructed file. While this method cuts down on the amount of legitimate content that is removed or destroyed, it is most often inaccurate due to the lack of malware identification capabilities.</li></ol><h3>Top-3 Drawbacks of CDR for Malware Prevention</h3>In a 2021 report, Gartner states that, “done well, CDR removes all threats from uploaded files without adding significant latency. &lt;sic&gt; The main disadvantage of CDR lies in the fact that it changes the files’ contents.”Because CDR modifies a file in transit, it has a relatively high probability of delivering a file that <a href="https://www.infusedinnovations.com/blog/secure-intelligent-workplace/what-is-content-disarm-and-reconstruction-cdr" target="_blank">cannot be edited</a> or has had significant changes to content such as text and images (see Figure 1). Common issues with CDR-manipulated files include compatibility and font issues that render documents that can no longer be edited, as well as images that are not properly reconstructed or lose their high resolution.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 1: CDR can lead to loss of functionality in documents (Source: Infused Innovations†)" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt11051332963c5aa4/63d157e9b369f5745550b605/fig1-cdr-can-lead-to-loss-functionality-in-documents.png" height="auto" /><figcaption style = "text-align: center;" >Figure 1: CDR can lead to loss of functionality in documents (Source: Infused Innovations†)</figcaption></figure>CDR introduces additional work for the IT team in the following ways:<ul><li>Since the technology cannot distinguish between legitimate and malicious active content, the CDR tool must examine every file in detail.</li><li>Users who are expecting to receive a spreadsheet with macros from a trusted source will instead receive a flat file with the important functions disabled.</li><li>This in turn necessitates an interaction with a help desk to request the original file.</li><li>In some cases, the original file may not be available by the time the user requests it.</li></ul>CDR raises some very important business concerns:<ul><li>Often, IT must grant exceptions for certain files (or groups) or executive team members who cannot tolerate a delay or a chance that their document will not remain intact.</li><li>In addition, users who know this technology is in place have been known to avoid it and receive their files by different methods, such as a personal email account.</li><li>This negates any benefits the technology may have provided.</li></ul>CDR only provides protection for a limited amount of file types:<ul><li>CDR cannot sanitize portable executable files, such as EXE and DLL, and most image files.</li><li>This creates a wide security gap that must be addressed with a different solution and can also lead to a false sense of security.</li></ul><h3>A Better Approach: Malware Prevention</h3>As malicious file uploads grow in concern, organizations need a frictionless solution that can prevent malware at a speed and scale that meets the needs of the business. While CDR has some advantages over the traditional methods, we believe the disadvantages far outweigh the benefits.<a href="/prevention-for-applications" target="_self">Deep Instinct Prevention for Applications</a> is a unique malware prevention solution that is implemented without an agent via REST API or ICAP. With the same industry-leading static anti-malware engine that has been proven to prevent threats before they are allowed to execute on the endpoint, Deep Instinct meets the file scanning security requirements for all enterprises with the following:Fastest Speed<ul><li>Makes a malicious vs benign verdict in &lt;20ms for unknown malware</li><li>Delivers decisions autonomously, without a reliance on threat intelligence feeds</li></ul>Immense Scale<ul><li>Scans millions of files per day without latency</li><li>Improves SOC efficiency by reducing false positives to &lt;0.1%</li></ul>Highest Unknown Threat Efficacy<ul><li>Prevents infected Office files and PDFs missed by other solutions</li><li>Stops ransomware before it can open and infect an environment</li></ul>Utmost Privacy<ul><li>Protects data privacy with no data ever leaving a customer’s environment</li></ul>Stopping unknown and zero-day threats from file uploads is paramount to reducing risk. If you are concerned about file uploads in your environment, it’s time to look at a modern prevention approach to stop the threats before they land inside. To learn more check out the white paper: <a href="https://info.deepinstinct.com/file-upload-security" target="_blank">File Upload Security: The Missing Category for a Comprehensive Security Posture</a>.<a href="/prevention-for-applications" target="_self">Deep Instinct Prevention for Applications</a> was designed specifically to address the need for file upload security, and it does so with unmatched speed (&lt;20ms verdict), efficacy (&gt;99% catch rate), and accuracy (&lt;0.1% false positive ratio), all while maintaining the content and integrity of original files.To learn more about how you can protect yourself from malicious files anywhere they surface, <a href="/contact-us" target="_self">contact Deep Instinct today</a>.<h3>Resources</h3><ul><li><a href="/blog/malicious-office-files-20-years-of-microsoft-office-exploits" target="_self">Malicious Office files: 20+ Years of Microsoft Office Exploits</a></li><li><a href="/blog/pdf-as-a-weapon-of-choice-on-the-cybersecurity-battlefield " target="_self">PDF as a Weapon of Choice on the Cybersecurity Battlefield</a></li><li><a href="/blog/five-advantages-of-deep-learning-for-preventing-cybersecurity-threats" target="_self">5 Advantages of Deep Learning in Cybersecurity</a></li></ul><h3>Sources</h3>* <a href="https://sanitox.jiransecurity.com/scan/" target="_blank">https://sanitox.jiransecurity.com/scan/</a>† <a href="https://www.infusedinnovations.com/blog/secure-intelligent-workplace/what-is-content-disarm-and-reconstruction-cdr" target="_blank">https://www.infusedinnovations.com/blog/secure-intelligent-workplace/what-is-content-disarm-and-reconstruction-cdr</a>

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

chatgpt-malicious-wishes-blog.png

Since its release in November 2022, ChatGPT has been gaining popularity, being asked everything from how to explain quantum computing to writing a birthday poem. The big question on everyone’s mind in the cybersecurity industry: Will ChatGPT become a tool for attackers to create and accelerate more sophisticated attacks? Our research below demonstrates how dangerous ChatGPT can be in the wrong hands. There is also the potential for researchers to use this tool to thwart attacks and for software developers to improve their code. However, we did find the AI is better at creating malware than providing ways to detect it. As with most technological advances, malware authors have found ways to abuse ChatGPT to spread malware. Examples of malicious content created by the AI tool, such as phishing messages, information stealers, and encryption software, have all been shared online. OpenAI has taken several measures to prevent misuse of their new tool and implemented mechanisms that can help their software recognize when a user asks it to create malicious content/code. For example, if a person asked ChatGPT to write ransomware, the software checks for flagged words such as ‘steal’ and ‘ransom,’ and refuses to comply. However, as we demonstrate below, there is a way to get past these controls. It comes down to how you ask the question. <h3>It's All About Phrasing </h3>ChatGPT attempts to avoid providing malicious code. In the below image, you can see the reply I got when I asked the software to provide a Go keylogger: <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltf04bbd046f350972" alt="Figure 1: ChatGPT’s refusal to provide a keylogger" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf04bbd046f350972/63c8427ae6cd4a7779d9f929/fig01-chatgpt-refused-to-provide-keylogger.png" height="auto" /><figcaption style = "text-align: center;" >Figure 1: ChatGPT’s refusal to provide a keylogger</figcaption></figure> However, when I rephrased my request and described what the program should do, without using the word ‘keylogger,’ my request was fulfilled. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt198cc2bb388f3945" alt=" Figure 2: Successfully getting a Go keylogger" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt198cc2bb388f3945/63c8427a1864e26d0032af7d/fig02-chatgpt-successfully-creating-go-keylogger.png" height="auto" /><figcaption style = "text-align: center;" > Figure 2: Successfully getting a Go keylogger</figcaption></figure><h3>Go Eddie the AV Evader </h3>To see what other tricks this new puppy could do, and how well the anti-malware solution dealt with them, I decided to ask the AI for a more destructive malware — ransomware. For obvious reasons, I couldn’t just ask for ransomware outright and instead needed to beat around the bush a little in my request, as can be seen below. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltd641b177c5591cf9" alt="Figure 3: Successfully getting a Go ransomware" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltd641b177c5591cf9/63c8427a3431f93ff7f79ecc/fig03-chatgpt-successfully-creating-go-ransomware.png" height="auto" /><figcaption style = "text-align: center;" >Figure 3: Successfully getting a Go ransomware</figcaption></figure> The above reply was accompanied by a Go script which did everything that had been requested. All I needed to do was add two missing imports, change the default AES key, as well as the default string ChatGPT used as the dropped text files’ content, and I got a working piece of ransomware. I also removed the bot’s comments to make the program more difficult to detect. Then I compiled the scripts into PE32 and PE64 files, made sure they ran without any issues, and uploaded them to VirusTotal to check how well the anti-malware solutions dealt with them. The results were alarming. Only 4 out of 69 engines detected the PE32, and only 2 out of 71 caught the PE64 version. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt41a233c745211f9b" alt="Figure 4: The PE32 variant’s detection rate on VirusTotal" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt41a233c745211f9b/63c8427a83026010f1038cae/fig04-pe32-variant-detection-rate-on-virustotal.png" height="auto" /><figcaption style = "text-align: center;" >Figure 4: The PE32 variant’s detection rate on VirusTotal</figcaption></figure> <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt1230d55deef0ef1d" alt="Figure 5: The PE64 variant’s detection rate on VirusTotal" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1230d55deef0ef1d/63c8427a08b84c3d9e4c9a63/fig05-pe64-variant-detection-rate-virustotal.png" height="auto" /><figcaption style = "text-align: center;" >Figure 5: The PE64 variant’s detection rate on VirusTotal</figcaption></figure> The files may have been missed because the script that was compiled to create them was written in Go — an uncommon language that was chosen for this research precisely for this reason. Another possibility is that the simplicity of the ransomware, which uses a symmetric encryption algorithm (AES), doesn’t upload any files to a remote IP, like most modern ransomware does, and doesn’t avoid encrypting specific filetypes. In any case, this is still ransomware, and the inability of most anti-malware solutions to detect it, at least statically, demonstrates clearly how dangerous ChatGPT can be when in the wrong hands. <h3>Bug by Design </h3>As previously stated, I had to add imports to the Go ransomware to make it work. A similar thing happened when I asked ChatGPT to create the keylogger — it left the implementation of one of the functions to me, as can be seen in the image below. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt747488b5780f7d87" alt="Figure 6: Omitted file transfer implementation" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt747488b5780f7d87/63c8427ae97936109ef2be6d/fig06-omitted-file-transfer-implementation.png" height="auto" /><figcaption style = "text-align: center;" >Figure 6: Omitted file transfer implementation</figcaption></figure> I had suspected that this might not be a bug, but a way for the AI solution to avoid delivering functioning malware. The message below, which I received from the bot, just made me more confident in my assumption. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt1ac3ef584c795933" alt="Figure 7: Information about message content" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1ac3ef584c795933/63c8427ab2a32b3f99e44c16/fig07-information-about-message-content.png" height="auto" /><figcaption style = "text-align: center;" >Figure 7: Information about message content</figcaption></figure> As you can see, ChatGPT was aware that the provided ransomware code could not be executed, and even knew which libraries were needed to make it run. This, combined with the answer I received after asking the AI why it hadn’t imported these libraries itself, strengthened my belief that the bot provided inexecutable code by design. <h3>Jekyll vs Hyde </h3>Even though ChatGPT can be used to create malware, it can also be used to help security researchers defend against malware. For example, by writing YARA rules to detect different attack techniques. In the below image, you can see an example of a YARA rule which was created to detect MITRE ATT&CK sub-technique T1055.002 (process injection). <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt9aff6f0361088df1" alt="Figure 8: YARA rule to detect process injection, prone to false positives" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9aff6f0361088df1/63c8427a1327af10d8774158/fig08-yara-rule-to-detect-process-injection-prone-to-false-positives.png" height="auto" /><figcaption style = "text-align: center;" >Figure 8: YARA rule to detect process injection, prone to false positives</figcaption></figure> This rule was too general and would likely generate a lot of false positives, so I asked the AI for a more specific rule and got the below reply. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blte277265c707d0169" alt="Figure 9: YARA rule to detect process injection, prone to false negatives" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte277265c707d0169/63c8427a7dbd6a1641ea2d84/fig09-make-above-yara-rule-less-prone-to-false-positives.png" height="auto" /><figcaption style = "text-align: center;" >Figure 9: YARA rule to detect process injection, prone to false negatives</figcaption></figure> This may generate less false positives, but it will also have more false negatives, meaning it will miss more malware that performs process injection. In any case, I wanted to check if the bot would write code that bypassed its own rule, and as can be seen below, even though it had some reservations, it did. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt96a5835ed986ed03" alt=" Figure 10: ChatGPT’s agreement to write malware that bypasses its own YARA rule" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt96a5835ed986ed03/63c8427aca4ee4418bab9b69/fig10-chatgpt-agreement-to-write-malware-that-bypasses-its-own-yara-rule.png" height="auto" /><figcaption style = "text-align: center;" > Figure 10: ChatGPT’s agreement to write malware that bypasses its own YARA rule</figcaption></figure>Apparently, ChatGPT did such a good job at writing the malware that it failed to write a YARA rule that could detect its own work and provided a rule that was prone to false positives instead. All in all, it seems that the AI solution is better at creating malware than providing ways to detect it. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt7f1475512190800e" alt="Figure 11: ChatGPT’s inability to write a YARA rule to detect its own work" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7f1475512190800e/63c842845156964aea434e3c/fig11-chatgpts-inability-to-write-yara-rule-to-detect-its-own-work.png" height="auto" /><figcaption style = "text-align: center;" >Figure 11: ChatGPT’s inability to write a YARA rule to detect its own work</figcaption></figure><h3>ChatGPT as a Research and Analysis Tool </h3>Like many modern tools, ChatGPT has an API that allows third-party applications to query the AI and receive replies using a script instead of the online user interface. Some individuals have already used this API to create impressive open-source analysis tools that can make cybersecurity researcher's jobs a lot easier. Notable examples of such tools are <a href="https://github.com/JusticeRage/Gepetto" target="_blank">Gepetto</a> and <a href="https://github.com/moyix/gpt-wpre" target="_blank">GPT-WPRE</a>, which add meaningful comments to code decompiled using IDA and Ghidra, respectively. Another helpful tool is <a href="https://github.com/fr0gger/IATelligence" target="_blank">IATelligence</a>, a script that extracts the content of the Import Address Table (IAT) from PE files and adds information about MITRE ATT&CK techniques that can be implemented using the imported libraries. These are mere examples of the potential ChatGPT has as an analysis tool, and with some thought and effort this AI might even be able to integrate into SIEM systems and do much of the work currently done by tier-1 analysts. <h3>A Tangled Future </h3>While ChatGPT will not build malicious code for the everyday person who has no knowledge of how to execute malware, it does have the potential to accelerate attacks for those who do. I believe ChatGPT will continue to develop measures to prevent this, but as shown, there will be ways to ask the questions to get the results you are looking for. With the advances in AI-based solutions in general, and the capabilities ChatGPT has demonstrated, it seems that the future of malware creation and detection will be tangled with the advances in the AI field, and their availability to the public. Our opinion is that threat actors will continue to find ways to utilize these tools to their own advantage, and cybersecurity professionals, who from our research benefit less from these tools (at least as for now), will have to find new ways to defend against malware created with them. <h3>Hashes of Generated Ransomware </h3>894853e4422fcc697ec25dc4a6132cda800f66cd77994c0d4918bb7dec33bad3 eddie4-32.exe bedcf4cf0e16da111220f5239b55960847d3893f13a6db6aa7f97ca01150fc77 eddie4-54.exe

ChatGPT and Malware: Making Your Malicious Wishes Come True

malicious-JARs-blog.png

Throughout 2022, Deep Instinct observed various combinations of <a href="https://en.wikipedia.org/wiki/Polyglot_(computing)" target="_blank">polyglot</a> files with malicious JARs.The initial technique dates to around 2018 when it used signed MSI files to bypass Microsoft code signing verification. A year later, in 2019, <a href="https://blog.virustotal.com/2019/01/distribution-of-malicious-jar-appended.html" target="_blank">Virus Total</a> wrote about the MSI+JAR polyglot technique. Microsoft decided not to fix the issue at that time. Then in <a href="https://www.securityinbits.com/malware-analysis/interesting-tactic-by-ratty-adwind-distribution-of-jar-appended-to-signed-msi" target="_blank">2020</a>, this technique was again abused in malicious campaigns and Microsoft assigned <a href="https://medium.com/@TalBeerySec/glueball-the-story-of-cve-2020-1464-50091a1f98bd" target="_blank">CVE-2020-1464</a> to address the issue.Despite being fixed, Deep Instinct observed in 2022 that the technique was still in use and included new types of polyglots which do not necessarily exploit the CVE; rather, attackers now use the polyglot technique to confuse security solutions that don’t properly validate the JAR file format.<h3>What is polyglot?</h3>A polyglot file is created by combining two or more file formats together in such a way that each format can be interpreted individually without an error.This is a little tricky as you can’t make polyglots from any arbitrary combination of file formats, although there are quite a few <a href="https://github.com/Polydet/polyglot-database" target="_blank">options</a> to choose from.<h3>Why JAR?</h3><a href="https://en.wikipedia.org/wiki/JAR_(file_format)" target="_blank">JAR</a> files are essentially ZIP archives. What’s special about ZIP files is that they’re identified by the presence of an end-of-central directory record which is located at the end of the archive. This means that any “junk” we append in the beginning of the file will be ignored and the archive is still valid.Other file formats have a special magic header at the beginning of the file, and they should be read from the start, unlike JAR. One of these formats is MSI.If those two are combined, we receive a file that is both a valid MSI and a valid JAR.<h3>The 2022 Campaigns</h3>Throughout 2022, Deep Instinct observed <a href="https://www.jaiminton.com/reverse-engineering/strrat" target="_blank">StrRAT</a> and <a href="https://www.youtube.com/watch?v=YJ8PZ6elyLE" target="_blank">Ratty</a> samples being distributed as polyglots or as JAR files with junk appended in the beginning.Both RATs are known threats. For StrRAT, there is a configuration extractor. For Ratty, we wrote a config extractor of our own, which we shared with the community in GitHub: <a href="https://github.com/deepinstinct/RattyConfigExtractor" target="_blank">https://github.com/deepinstinct/RattyConfigExtractor</a>While we couldn’t determine whether the files belong to a single threat actor or to several threat actors, the usage of the Bulgarian hosting “BelCloud LTD” has been observed in many of the samples.Additionally, we found a few Ratty and StrRAT samples that shared the same C2 server.For simplicity we will categorize the files by what is appended to them.<h3>#1 MSI:</h3>Sample 5e288df18d5f3797079c4962a447509fd4a60e9b76041d0b888bcf32f8197991If we inspect the file with the Linux file command, we see it’s an MSI file:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt2e9f9f745ae627ca" alt="Figure 1: Linux file identifies sample as MSI file" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2e9f9f745ae627ca/63bee84a47588310a1913f9b/fig1-linux-file-indentifies-sample-as-msi-file.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: Linux file identifies sample as MSI file</figcaption></figure>However, the file contains a valid JAR as well. Our Ratty configuration extractor was able to successfully extract the C2 server information.This sample has been observed being sent using <a href="https://sendgrid.com/" target="_blank">Sendgrid</a>. While this is not unique, some of the StrRAT samples that were MSI+JAR polyglots have been sent via Sendgrid as well.Some of the StrRAT samples using the MSI+JAR polyglot have been observed spreading with URL shortening services such as cutt.ly and rebrand.ly. In some cases, the samples were hosted on Discord.<h3>#2 CAB:</h3><a href="https://www.file-recovery.com/cab-signature-format.htm" target="_blank">CAB</a> files have a unique magic header and are interpreted from the beginning to the end, which makes them a perfect candidate for a polyglot with JAR files.We have observed both Ratty and StrRAT samples using CAB+JAR polyglots.In particular, we found the Ratty sample f620c4f59db31c7f63e8fde3016a33b3bfb3934c17874dcfae52ca01e23f14de and the StrRAT sample 2f4c6eb0a307657fb46f4a8f6850842d75c1535a0ed807cd3da6b6678102e571 both using the CAB+JAR polyglot and using the same C2 server, donutz.ddns[.]net<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltfb077af360e7081e" alt="Figure 2: StrRAT and Ratty (CAB+JAR) linked to the same C2 server donutz.ddns[.]net" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltfb077af360e7081e/63bee84a7a6762171d821d17/fig2-strRAT-and-Ratty-linked-to-the-same-c2-server.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 2: StrRAT and Ratty (CAB+JAR) linked to the same C2 server donutz.ddns[.]net</figcaption></figure><h3>#3 HEX Trash / Fake PE:</h3>We are not sure if the files were made by mistake or on purpose by the threat actor, but those JAR files have HEX values appended to them:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt05d5b955bdf7dc33" alt="Figure 3: Sample 19154b831614211de667c2aedd6a4b5b89d4bfc1e129eb402a6300ad2e156dcf with HEX values appended." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt05d5b955bdf7dc33/63bee84a98b11c3ccecf6af5/fig3-sample-with-hex-values-appended.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 3: Sample 19154b831614211de667c2aedd6a4b5b89d4bfc1e129eb402a6300ad2e156dcf with HEX values appended.</figcaption></figure>The appended textual hex value is of an executable file. While those files are not polyglots because the appended hex is just “junk” text, the Linux “file” command would return “data” such as the file type.In this way attackers can confuse and bypass security solutions that would simply check the type of file using the Linux “file” command.<h3>#4 Binary Junk:</h3><figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt8585c56be6e04e2b" alt="Figure 4: Sample 8d801f58d10dbcd52739fa35aa862286c3fe9606411f0e5f7b8b3fd71f678cad with appended binary data." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8585c56be6e04e2b/63bee84ad7b1d54534245dfa/fig4-sample-with-appended-binary-data.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4: Sample 8d801f58d10dbcd52739fa35aa862286c3fe9606411f0e5f7b8b3fd71f678cad with appended binary data.</figcaption></figure>This variation is once again not truly a polyglot, and it is not clear if this is a mistake or if it was done on purpose. The appended content seems to be a part of some binary, but the appended data appears to be missing the beginning of the appended file.The result is the same: a valid JAR file that is detected as “data” by checking the file type.<h3>Is this effective? (YES!)</h3>While Ratty and StrRAT are well known threats, some of those appended JAR files receive very low detections in VirusTotal:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt14594c18eb515964" alt="Figure 5: Low detection rate for CAB+JAR polyglot" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt14594c18eb515964/63bee84aab6fbb46e5b71f9c/fig5-low-detection-rate-for-cab-jar-polyglot.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5: Low detection rate for CAB+JAR polyglot</figcaption></figure>The VirusTotal detection rate doesn’t tell the true capabilities of specific vendors as some products behave differently when files are executed dynamically.That said, we can clearly see that JAR files with appended content can stay undetected, at least until executed, even for known threats.<h3>Can this be any worse? Yes, my friends, it can...</h3>Let’s think about this from a detection engineering perspective. If we failed to identify a JAR file because we relied on the simple file type check, like Linux “file” command, the easy solution would be just to “scan” every file with the JAR extension. If you want to, you can even throw a validation that the file is a valid JAR by checking the presence of the end of a central directory record at the end of the file.However, this is still not sufficient. JAVA does not care about the file extension and will happily execute a valid JAR file with any extension. The only downfall in renaming the “.jar” extension is that the JAR needs to be executed from the command line instead of simply clicking on it to execute.We have created an HTML+JAR polyglot to demonstrate this:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt234fc58952190333" alt="Figure 6: HTML+JAR polyglot with html extension properly rendered in the browser and properly executed by JRE" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt234fc58952190333/63bee84a438f80612c397515/fig6-html-jar-polyglot-with-html-extension-properly-rendered-in-the-browser-and-properly-executed-by-jre.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 6: HTML+JAR polyglot with html extension properly rendered in the browser and properly executed by JRE</figcaption></figure>This file is also available in our <a href="https://github.com/deepinstinct/JAR-Polyglot-POC" target="_blank">GitHub</a> along with the <a href="https://github.com/deepinstinct/RattyConfigExtractor" target="_blank">Ratty</a> malware configuration extractor.<h3>Conclusion</h3>The proper detection for JAR files should be both static and dynamic. It’s inefficient to scan every file for the presence of an end of central directory record at the end of the file.Defenders should monitor both “java” and “javaw” processes. If such a process has “-jar” as an argument the filename passed as an argument should be treated as a JAR file regardless of the file extension or the output of the Linux “file” command. Incident responders and the cyber community are welcome to use the Ratty malware configuration parser provided from Deep Instinct in case of infection to get to the IOC fast and quickly move on to remediation steps.<h3>MITRE ATT&CK:</h3><table><thead class="bg-grey"><tr><th style="width: 15%;">Tactic</th><th>Technique</th><th>Description</th><th>Observable</th></tr></thead><tbody><tr><td>Initial Access</td><td>T1566.002 Phishing: Spearphishing Link</td><td>Attackers use URL shortening services that leads to the payload.</td><td>Rebrand[.]ly/afjlfvp</td></tr><tr><td>Defense Evasion</td><td>T1036.001 Masquerading: Invalid Code Signature</td><td>Attackers append a signed MSI file.</td><td>85d8949119dad6215ae0a21261b037af</td></tr><tr><td>Defense Evasion</td><td>T1027.001 Obfuscated Files or Information: Binary Padding</td><td>Attackers append junk data at the beginning of the file causing “file” command to return a different file type.</td><td>cb17f27671c01cd27a6828faaac08239</td></tr><tr><td>Command and Control</td><td>T1102 Web Service</td><td>Attackers used Discord's content delivery network (CDN) to deliver malware.</td><td>https://cdn[.]discordapp[.]com/attachments/938795529683480586/941658014962823208/Package_info[.]jar</td></tr></tbody></table>&nbsp;<h3>IOC:</h3>d51d269b62e55d4af8a4bd72dcf3c5115ad27fe5466640041c658c0325194451534a4b0e17723755dd8cbdcdec309004ef59c3dfacb87fac86da4548780d2f1b08921a6b0b2903b9c991acb869930c7cab3cbaf11e002be9c88400af48c3fa2159a02230a78b87c97eebbf7cdba40ea17c7d9411d706fd255c2a6a025584fd9fa9ac4ae704da346a0f3d2960b084d8f314c0fd60a934116e3c75647c713314b647fc7fc1658acfa2f7a0b388bea6b52787f186bf8297ce189a575d547dfbd8e0a80add76ff8ad0e1c3bdab9459546fd724e1f4034248d1542aec1264c02d3857f0e57c84ba1958cabf24cfec4a0d50be6b7bc0e45c639d08a53097494373ae9ee7812ff64dbe51584d3090e008b464510dbb87ac860c68d89e224621755021f941ef2dfa736e9a24a1a29a373357ac249dad99f86f1cc0283ddd4765fa14e54a8d801f58d10dbcd52739fa35aa862286c3fe9606411f0e5f7b8b3fd71f678cadf79ba296aeab13be409ee3ef435f47a8888f7186a062fa481603ec32f3d6b678262e6824f0c4c765e73a7041362d7a3a8d63dab1be91ecf5e80623ac6e2f389eb6a0dcd8c9bc11794837e8f9350e2816ae7a60d148f3e6f436c2645f450feeabf620c4f59db31c7f63e8fde3016a33b3bfb3934c17874dcfae52ca01e23f14de54814775c2f266cafe3d4ddc58bc400360aad8cea95e0d3ee74ceceb927cb3b82f4c6eb0a307657fb46f4a8f6850842d75c1535a0ed807cd3da6b6678102e57174c8d5e01e2bb52c6f5cd7863168085ff81bea970b5309ec180c2e1a299096dff2b36a7df3d0b4d63bbbc529b7a27282e5626300e1353d2596866e4a82165f644f00914f63181c0afbfff41a95f5f1364c61d78ffb250ec8ef3102b3d3bd7003a989289cd6df1b1c38dbda84eb3b286bb8fb7a2af9beb1e55b029dbf861bac83521a2e7ee2558d83e29bceb68a8c4ea0ecce4bddcb05cc0d3b0365522f126d1f19154b831614211de667c2aedd6a4b5b89d4bfc1e129eb402a6300ad2e156dcfe3be7066e6922d7460dea80ca5b7fef8f4abc7b1f056d8f329c03b306e8ca9b0788f1abb67d6f21cf299e2f67a2b414d169e8ab16cc8a61bf698e5c7f14829995e288df18d5f3797079c4962a447509fd4a60e9b76041d0b888bcf32f81979910c14d804efe1db9377bfe3d5e06ba37a4817cc4bd0f6404ed7d705219295e8151056554bca75450d07fcc5df7c1ca4686a2fefbe76cc9fb60343364678ca8744f2d7e93978c0991e376466810adf18262e4a7fb2864c7a87f22e3fa71adb6519496251bb063e4ee3769139a34ccfbdd81ba52b004836da7aaabd5e5e67f87478d00d85589908ba95536822dea356afb5a9148628a7e2207c6e850024c0ba434d928551a303110983871266af840df71bf7427dcff242688c105f04d4aa87806be2d67077cbcab70d47a95b8da25a2a35fe1f1099ed71d8b06f8e78dd741fc2b7d0703f8f70aff6e3975f3b7c8d037b5a0d3d1b8e4a91b2a6c65227c7932dded59e0468a7249fd6bc2b911434b0c7afa2a9d92473e2402a1a3ad357119c579d63fe72f76f147bce32338a4b0b88c3d59dd3e85406ab1b3b273aab7cb7227fae52964eceee84de3d0b8b3565100c1e45dab1b4b5ff7c61f03a198a56714c03ca32d8c04d3a6e6e5058c10a56890a9dcf41ac5e47a22dc1002e89415ee0f37c7f05

Malicious JARs and Polyglot files: “Who do you think you JAR?”

Deep Instinct Included in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms (EPP)