di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Prevention Platform

Prevention for Applications

Prevention for Endpoints

Products

Prevent Ransomware

Prevent Zero-Day Attacks

Improve EPP Efficacy

Extend & Enhance EDR

Stop Fileless Attacks

Solutions

Deep Learning in Cybersecurity

Our Customers

+ MS Defender

VS Traditional Antivirus

Why Deep Instinct

About Deep Instinct

Newsroom

Careers

Contact Us

Company

Asset Library

Blog

Videos

Training

Resources

Request Demo

Customer Portal

Integrations and Compliance

Quick links

Events & Webinars

Leadership Team

Board of Directors

Partners

Login

content_block

Recent Blog Posts

Recent Blog Posts

posts_listing

Blog Listing Page

blog-image-muddyc2go.jpg

The contents of this blog post were originally scheduled to be presented during an upcoming cybersecurity conference. However, interest in this topic has heightened due to the war in Israel and a suspected ongoing attack against Israeli targets. As such, we have decided to publish the relevant findings from the presentation now.<h5>Executive Summary:</h5><ul><li>Deep Instinct’s Threat Research team has identified a previously unreported C2 framework suspected to be in use by MuddyWater</li><li>The C2 framework may have been in use by the MuddyWater group since at least 2020</li><li>The framework’s web component is written in the Go programming language – hence the name we gave it: MuddyC2Go</li><li>MuddyWater seems to have stopped using PhonyC2 and is now using MuddyC2Go instead</li></ul><h5>Background</h5>In June 2023, we published a report about <a href="https://www.deepinstinct.com/blog/phonyc2-revealing-a-new-malicious-command-control-framework-by-muddywater" target="_self">PhonyC2</a>, a custom C2 framework used by the MuddyWater APT group.While analyzing previous PhonyC2 infrastructure, Deep Instinct uncovered anomalies that indicated MuddyWater might be using an additional C2 framework.At that time, we lacked sufficient evidence to support this claim. However, after we published our PhonyC2 research, we observed two IP addresses previously related to MuddyWater, one of those addresses which was hosting PhonyC2 had switched to a different C2 framework delivering a PowerShell payload.This behavior heightened suspicions of a new C2 framework. However, without seeing and observing the initial payload, those IP addresses could have been internal tests by MuddyWater before fully deploying the C2.Recently, Deep Instinct observed similar C2 activity on a different cluster of IP addresses that has not been associated previously with MuddyWater.This new activity’s initial payload confirmed our assessment that this activity is related to MuddyWater.<h5>Current MuddyWater Activity Using MuddyC2Go</h5><a href="https://www.deepinstinct.com/blog/new-muddywater-threat-old-kitten-new-tricks" target="_self">Previous research</a> has shown typical MuddyWater TTPs include spear-phishing emails containing archives or links to archives that include various legitimate remote administration tools.If the receiving target opens the file inside the archive, it installs a remote administration tool that allows the attacker to execute additional tools and malware, including MuddyWater’s PhonyC2.Deep Instinct observed the following changes in recent activity:<ul><li>The archives are now password protected. This is done to evade email security solutions that scan files inside archives without a password.</li><li>Instead of using a remote administration tool where an operator executes a PowerShell script to connect to MuddyWater’s C2, a new executable is now being sent. This executable contains an embedded PowerShell script that automatically connects to MuddyWater’s C2, eliminating the need for manual execution by the operator.</li></ul>Let’s examine several examples of this new C2 framework.<h5>July 2023 – Attack Against Jordanian Company</h5>Deep Instinct identified a file named “offtec.exe” which is an executable. Offtec is also the name of a Jordanian company.When executed, it runs a PowerShell script which connects to a MuddyC2Go server located at the IP address 45.150.64[.]239.The executable was built using PowerGUI from Quest Software. This tool allows the user to generate an executable that runs an embedded PowerShell script that is provided by the user.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 1: PowerGUI logo" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2e55ad6e0e12cbe2/654af2a5b42e39040a69a428/fig1-PowerGUI-Logo.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: PowerGUI logo</figcaption></figure>After communicating with the C2, the communication is switched to dynamic DNS using the address “microsoftfice.ddns[.]net”The response from the C2 is again a PowerShell script that runs every 10 seconds and waits for commands from the operator using the C2:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt0f5f4af3edeedf94" alt="Figure 2: Part of the PowerShell code sent from the C2" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0f5f4af3edeedf94/654af2a5b42e39040a69a424/fig2-Powershell-C2-Code.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 2: Part of the PowerShell code sent from the C2</figcaption></figure><h5>September 2023 – Attacks Against an Iraqi Telecommunications Provider</h5>In September, Deep Instinct identified additional variants of executables created with PowerGUI. The executables have been spread via password-protected RAR archives.The archives were uploaded from Iraq and their file name included the word “Korek.”<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltaca79be7f5b4795d" alt="Figure 3: KorekPro file on VT" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltaca79be7f5b4795d/654af2a5b3460c040a0b095a/fig3-KorekPro-VT.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 3: KorekPro file on VT</figcaption></figure><a href="https://en.wikipedia.org/wiki/Korek_Telecom" target="_blank">Korek</a> is an Iraqi-Kurdish mobile phone operator. MuddyWater targeted Korek in <a href="https://mp-weixin-qq-com.translate.goog/s/NN_iRvwA6yOHFS9Z3A0RBA?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp" target="_blank">2019</a>.In this attack, the C2 IP addresses and dynamic DNS were different: ghostrider.serveirc[.]com<h5>October 2023 – “Swords of Iron” War</h5>While Iranian involvement in the war is still being investigated, on October 11, the fourth day of the war, Deep Instinct identified a scan of the MuddyC2Go URL from Israel in VirusTotal.Because the URL is unique and responded with PowerShell, it likely indicates there was a recent attack against an Israeli target by MuddyWater. This is also supported by our recent discovery of <a href="https://www.deepinstinct.com/blog/muddywater-en-able-spear-phishing-with-new-ttps" target="_self">another active campaign</a> from MuddyWater against Israeli targets.Deep Instinct could not identify an associated PowerGUI executable for this attack, although there could have been a different initial access vector to the attack that didn’t rely on social engineering.The C2 IP address that was used this time is 94.131.109[.]65.<h5>Attribution</h5>While investigating the PhonyC2 framework (written in Python) and its infrastructure, Deep Instinct identified servers responding with a generic “web.go” header. This header suggests MuddyWater is using a web application written in the Go programming language.In 2022, Mandiant <a href="https://www.mandiant.com/resources/blog/telegram-malware-iranian-espionage" target="_blank">reported</a> that MuddyWater wrote malware using Go, showing they are capable of using this language. However, the malware is “client-side,” whereas the C2 framework is “server-side.” As such, they are likely unrelated.Deep Instinct was able to find traces of a Go-based C2 framework used by MuddyWater dating back to the beginning of 2020.Deep Instinct identified 162.223.89[.]11 as the first IP address publicly attributed to MuddyWater using MuddyC2Go.Both <a href="https://www.secureworks.com/blog/business-as-usual-for-iranian-operations-despite-increased-tensions" target="_blank">SecureWorks</a> and <a href="https://blog.talosintelligence.com/iranian-apt-muddywater-targets-turkey/" target="_blank">Talos</a> reported a malicious Excel file (63e404011aeabb964ce63f467be29d678d0576bddb72124d491ab5565e1044cf) in January and February. When this file is opened, the malicious execution chain eventually leads to the C2 server 162.223.89[.]11.In May 2020, this IP address was <a href="https://www.virustotal.com/gui/url/dfe4269ae77af4ebd2f20156c7d1fb0eff05af17c25de4acadfda1b8f64e352f/details" target="_blank">observed</a> using MuddyC2Go.The IP address 109.201.140[.]103 has not been previously associated with MuddyWater. However, multiple scans from January, including one from Egypt, which aligns with MuddyWater’s interests and timeframe of above reports, contains unique URLs that are used by MuddyC2Go. Additionally, there is <a href="https://www.virustotal.com/gui/url/44b00e2d17de6df7ff6bcd27cff9f932e6c41052e3dce4603a55cbf41e153aca/details" target="_blank">scan</a> for a file named ssf.zip on this IP. Secure Sockets Funneling (SSF) was mentioned in the SecureWorks report as a tool used by MuddyWater.SSF is a tool that has been <a href="https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/seedworm-apt-iran-middle-east" target="_blank">reported</a> by multiple security vendors to be part of MuddyWater’s arsenal.In February 2022, CISA <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a" target="_blank">published</a> indicators that signal MuddyWater activity, including the IP address 164.132.237[.]65.In March 2022, this address was <a href="https://www.virustotal.com/gui/url/39e38246cd33cd971ad6760207ad8faa7384536ef4a8cc487bcc4d4bc2d75390/details" target="_blank">observed</a> to be a MuddyC2Go server. It was previously <a href="https://www.security.ntt/blog/analysis-of-an-iranian-apts-e400-powgoop-variant" target="_blank">associated</a> with PowGoop.In April 2022, the IP address 141.95.177[.]130 was <a href="https://www.virustotal.com/gui/url/4a503712ccf32917b95fea40eb9d2ddc2f7c4e51552beb4cc179a6f1dd650f10/details" target="_blank">observed</a> hosting MuddyC2Go. Additionally, the passive DNS of this IP resolved to jbf1.nc1310022a[.]biz, a pattern that was already observed with PhonyC2 servers. A year later, in April 2023, Group-IB <a href="https://www.group-ib.com/blog/muddywater-infrastructure/" target="_blank">associated</a> this IP address to MuddyWater via a specific ETag header that was used in numerous MuddyWater servers.In the same report, Group-IB identified an LNK <a href="https://www.virustotal.com/gui/file/2528838a609aa143769efb37dff45af723868d4ed33eb1ce0e2d6ce64b2a1507/relations" target="_blank">file</a> from October 2022 that was communicating with the IP address 91.121.240[.]108. The <a href="https://www.virustotal.com/gui/url/c644ec1f939c1f072e7384ef6804f0a432f81b3c78acf8e0e9eedd44d6d0d55b/details" target="_blank">responses</a> from this IP indicate that it was MuddyC2Go. In addition, the LNK file was inside an archive named “request-for-service-no10102022.zip” The naming convention is very <a href="https://www.virustotal.com/gui/file/1670a59f573037142f417fb8c448a9022c8d31a6b2bf93ad77a9db2924b502af/details" target="_blank">similar</a> to the naming convention MuddyWater used in their <a href="https://www.deepinstinct.com/blog/new-muddywater-threat-old-kitten-new-tricks" target="_self">Syncro campaign</a>.Both Group-IB and Deep Instinct have <a href="https://www.deepinstinct.com/blog/phonyc2-revealing-a-new-malicious-command-control-framework-by-muddywater" target="_self">linked</a> the IP address 137.74.131[.]18 to MuddyWater. Deep Instinct initially observed PhonyC2 at this address, and after our publication, MuddyWater switched to MuddyC2Go on this IP address. Additionally, the IP address 137.74.131[.]20—which was previously reported by Group-IB —also started to host MuddyC2Go.<h5>Conclusion</h5>Due to the leak of PhonyC2 source code, MuddyWater stopped using the framework and switched to using a Go-based C2 framework. Since the actual source code of the new framework is not available, the full capabilities are unknown. However, based on past leaks and associated known activity, this is another framework that generates PowerShell payloads that MuddyWater uses in the “Actions on Objectives” phase in the “<a href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html" target="_blank">Cyber Kill Chain</a>.” PowerShell has always been the bread and butter of MuddyWater operations.We recommend disabling PowerShell if it is not needed. If it is enabled, we recommend close monitoring of PowerShell activity.While it is not trivial to fingerprint the MuddyC2Go framework, as it looks like any other generic web application written in Go, Deep Instinct managed to identify previous attacks dating back to 2020 due to unique URL patterns generated by the framework.Currently, Deep Instinct has identified all known active MuddyC2Go servers hosted at “Stark Industries,” a VPS provider known to host malicious activity. Deep Instinct identified additional suspected MuddyC2Go servers hosted at Stark Industries without any malicious activity or known URL pattern.Additional IOCs and information regarding Iranian Threat Actors can be found in our <a href="https://github.com/deepinstinct/Israel-Cyber-Warfare-Threat-Actors" target="_blank">Git</a>.<h5>IOCs:</h5>Network<table style="width: 100%;"><thead class="bg-grey"><tr><th>IP Address</th><th>Description</th></tr></thead><tbody><tr><td>91.121.61[.]76</td><td>MuddyC2Go (2020)</td></tr><tr><td>109.201.140[.]103</td><td>MuddyC2Go (2020)</td></tr><tr><td>162.223.89[.]11</td><td>MuddyC2Go (2020)</td></tr><tr><td>164.132.237[.]65</td><td>MuddyC2Go (2022)</td></tr><tr><td>141.95.177[.]130</td><td>MuddyC2Go (2022) – (jbf1.nc1310022a[.]biz)</td></tr><tr><td>91.121.240[.]108</td><td>MuddyC2Go (2022)</td></tr><tr><td>137.74.131[.]18</td><td>MuddyC2Go (2023) – (qjk2.6nc051221c[.]co)</td></tr><tr><td>137.74.131[.]20</td><td>MuddyC2Go (2023)</td></tr><tr><td>45.150.64[.]239</td><td>MuddyC2Go (2023) – (microsoftfice.ddns[.]net)</td></tr><tr><td>95.164.46[.]35</td><td>MuddyC2Go (2023) – (ghostrider.serveirc[.]com)</td></tr><tr><td>45.67.230[.]91</td><td>MuddyC2Go (2023) – (Stark Industries)</td></tr><tr><td>94.131.109[.]65</td><td>MuddyC2Go (2023) – (Stark Industries)</td></tr><tr><td>95.164.46[.]199</td><td>MuddyC2Go (2023) – (Stark Industries</td></tr><tr><td>185.248.144[.]158</td><td>Suspected MuddyC2Go (2023) – (Stark Industries) – (mbcaction.hopto[.]org)</td></tr><tr><td>94.131.98[.]14</td><td>Suspected MuddyC2Go (2023) – (Stark Industries)</td></tr><tr><td>45.150.64[.]23</td><td>Suspected MuddyC2Go (2023) – (Stark Industries)</td></tr><tr><td>45.150.64[.]39</td><td>Suspected MuddyC2Go (2023) – (Stark Industries)</td></tr><tr><td>95.164.38[.]99</td><td>Suspected MuddyC2Go (2023) – (Stark Industries)</td></tr></tbody></table>File<table style="width: 100%;"><thead class="bg-grey"><tr><th>MD5</th><th>Description</th></tr></thead><tbody><tr><td>34212eb9e2af84eceb6a8234d28751b6</td><td>PowerShell response from 137.74.131[.]18</td></tr><tr><td>3c6486dfb691fc6642f1d35bdf247b90</td><td>PowerShell response from 137.74.131[.]18</td></tr><tr><td>55b99af81610eb65aabea796130a0462</td><td>PowerShell response from 137.74.131[.]18</td></tr><tr><td>d7ca8f3b5e21ed56abf32ac7cb158a7e</td><td>PowerShell response from 137.74.131[.]18</td></tr><tr><td>d3a2dee3bb8fcd8e8a0d404e7d1e6efb</td><td>PowerShell response from 137.74.131[.]20</td></tr><tr><td>4a70b1e4cb57c99502d89cdbbed48343</td><td>PowerShell response from 137.74.131[.]20</td></tr><tr><td>f08aa714fd59b68924843cbfddac4b15</td><td>PowerShell response from 137.74.131[.]20</td></tr><tr><td>db0e68d7d81f5c21e6e458445fd6e34b</td><td>offtec.exe (C2: 45.150.64[.]239)</td></tr><tr><td>dbcc0e9c1c6c1fff790caa0b2ffc2fe5</td><td>PowerShell script embedded in offtec.exe</td></tr><tr><td>e07adc4ee768126dc7c7339f4cb00120</td><td>PowerShell response from 45.150.64[.]239</td></tr><tr><td>feede05ba166a3c8668fe580a3399d8f</td><td>Performance.rar – Password protected archive</td></tr><tr><td>9894b84916f9264d897fe3b4a83bc608</td><td>KorekFile.rar – Password protected archive</td></tr><tr><td>9957250940377b39e405114f0a2fe84b</td><td>Performance/KorekFile.exe (C2: 95.164.46[.]35)</td></tr><tr><td>245c3ed373727c21ad9ee862b767e362</td><td>PowerShell script embedded in Performance/KorekFile</td></tr><tr><td>22971759adf816c6fb43104c0e1d89d6</td><td>PowerShell response from 95.164.46[.]35</td></tr><tr><td>5e0cc23a6406930a40696594021edb5f</td><td>KorekPro.rar – Password protected archive</td></tr><tr><td>79a638b2f2cc82bfe137f1d12534cda5</td><td>d.exe (C2: 95.164.46[.]35)</td></tr><tr><td>fc523904ca6e191eb2fdb254a6225577</td><td>PowerShell script embedded in d.exe</td></tr><tr><td>b867ec1cef6b1618a21853fb8cafd6e1</td><td>PowerShell response from 45.67.230[.]91</td></tr><tr><td>57641ce5af4482038c9ea27afcc087ee</td><td>PowerShell response from 94.131.109[.]65</td></tr><tr><td>fe5f94e5df19d95df26aaf774daad9df</td><td>PowerShell response from 95.164.46[.]199</td></tr></tbody></table>

MuddyC2Go – Latest C2 Framework Used by Iranian APT MuddyWater Spotted in Israel

MuddyWater Unleashed a New Social Engineering Campaign Against Israel During the Israel-Hamas War.

blog-muddywater-en-able.jpg

<h5>Executive summary:</h5><ul><li>Deep Instinct’s Threat Research team has identified a new campaign from the “MuddyWater” group</li><li>The campaign has been observed attacking two Israeli targets</li><li>The campaign exhibits updated TTPs to previously reported MuddyWater activity</li></ul><figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 1: Campaign overview " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6790e59d9363b777/65426ffc4ed3b2001a90c710/fig1-muddywater-campaign-overview.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: Campaign overview</figcaption></figure><h5>Introduction</h5><a href="https://www.deepinstinct.com/blog/new-muddywater-threat-old-kitten-new-tricks" target="_self">Previous</a> research showed that MuddyWater has sent spear-phishing emails, starting back in 2020, with direct links, as well as PDF, RTF, and HTML attachments containing links to archives hosted on various file-sharing platforms.Those archives contained installers for various legitimate remote administration tools.Before launching the new campaign during the Israel-Hamas war, MuddyWater <a href="https://twitter.com/k3yp0d/status/1719269176101990574" target="_blank">reused</a> previously known remote administration tools, utilizing a new file-sharing service called “<a href="https://www.storyblok.com/" target="_blank">Storyblok</a>.”On October 30th Deep Instinct identified two archives hosted on “Storyblok” containing a new multi-stage infection vector. It contains hidden files, an LNK file that initiates the infection, and an executable file designed to unhide a decoy document while executing <a href="https://www.n-able.com/features/advanced-monitoring-agent" target="_blank">Advanced Monitoring Agent</a>, a remote administration tool.This is the first public report about MuddyWater utilizing this remote administration tool.<h5>The Multi-stage Social Engineering Campaign</h5>While Deep Instinct could not verify the spreading mechanism of the new campaign, it most likely starts with a spear-phishing email, similar to previous campaigns.The content of the email lures the victim into downloading an archive hosted at “a.storyblok[.]com”In this analysis, we examine the “defense-video.zip” file.When the archive is extracted, several folders must be navigated until a LNK shortcut, which looks like another folder named “Attachments,” is found:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 2: LNK Shortcut" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte46c4bf1b082e1d5/65427050a67ffd001b94e1c9/fig2-muddywater-hidden-lnk-shortcut.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 2: LNK Shortcut</figcaption></figure>However, there are additional hidden folders and files extracted from the archive:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 3: Hidden folders" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltad15ce5115cba266/654270aa2149b10407ad84f5/fig3-muddywater-hidden-folders.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 3: Hidden folders</figcaption></figure>When the victim opens the LNK file, the infection chain starts.By examining the LNK file, we can see that it executes an executable from one of the hidden directories:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 4: LNK command line arguments" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt64dfe55de3f736ef/654270df7265fb04074f77da/fig4-muddywater-lnk-command-line-arguments.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4: LNK command line arguments</figcaption></figure>The file “Diagnostic.exe” has been used in both archives Deep Instinct observed. The purpose of this file is to execute another executable called “Windows.Diagnostic.Document.EXE,” which is located in the hidden directory named “.end” under a “Windows.Diagnostic.Document” hidden directory.The file named “Windows.Diagnostic.Document.EXE” is a signed, legitimate installer for “Advanced Monitoring Agent.”In addition to executing the remote administration tool, “Diagnostic.exe” also opens a new Windows Explorer window of the hidden “Document” folder. This is done to fool the victim that opened the LNK file into thinking that it was indeed a folder.The decoy document is an official memo from the Israeli Civil Service Commission, which can be publicly downloaded from their <a href="https://www.gov.il/he/departments/news/disciplinary-treatment-statements-against-israel-wartime-news" target="_blank">website</a>.The memo describes what to do in case a government worker expresses opinions against the Israeli state on social networks:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 5: Decoy document" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc8cf7596101ee9db/654270fca184e7001b4f934b/fig5-muddywater-csc-decoy-document.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5: Decoy document</figcaption></figure><h5>Conclusion</h5>MuddyWater continues to attack Israeli targets in various ongoing campaigns.In this campaign, MuddyWater employs updated TTPs. These include a new public hosting service, employing a LNK file to initiate the infection, and utilizing intermediate malware that mimics the opening of a directory while executing a new remote administration tool.After the victim has been infected, the MuddyWater operator will connect to the infected host using the legitimate remote administration tool and will start doing reconnaissance on the target.After the reconnaissance phase, the operator will likely execute PowerShell code which will cause the infected host to beacon to a custom C2 server.MuddyWater has used <a href="https://www.deepinstinct.com/blog/phonyc2-revealing-a-new-malicious-command-control-framework-by-muddywater" target="_self">PhonyC2</a> in the past. However, Deep Instinct recently observed MuddyWater using a new C2 framework named MuddyC2Go – a detailed blog will be published soon, stay tuned.<h5>IOCs:</h5>File<table style="width: 100%;"><thead class="bg-grey"><tr><th>MD5</th><th>Description</th></tr></thead><tbody><tr><td>37c3f5b3c814e2c014abc1210e8e69a2</td><td>Archive containing Atera Agent</td></tr><tr><td>16923d827a440161217fb66a04e8b40a</td><td>Atera Agent Installer</td></tr><tr><td>7568062ad4b22963f3930205d1a14df7</td><td>Archive containing Atera Agent</td></tr><tr><td>39eea24572c14910b67242a16e24b768</td><td>Archive containing Atera Agent</td></tr><tr><td>2e09e53135376258a03b7d793706b70f</td><td>Atera Agent Installer</td></tr><tr><td>1f0b9aed4b2c8d958a9b396852a62c9d</td><td>Archive containing SimpleHelp</td></tr><tr><td>065f0871b6025b8e61f35a188bca1d5c</td><td>SimpleHelp Installer</td></tr><tr><td>146cc3a1a68be349e70b79f9115c496b</td><td>defense-video.zip</td></tr><tr><td>dd247ccd7cc3a13e1c72bb01cf3a816d</td><td>Attachments.lnk</td></tr><tr><td>8d2199fa11c6a8d95c1c2b4add70373a</td><td>Diagnostic.exe</td></tr><tr><td>04afff1465a223a806774104b652a4f0</td><td>Advanced Monitoring Agent Installer</td></tr><tr><td>6167f03c8b2734c20eb02d406d3ba651</td><td>Decoy Document (defense-video.zip)</td></tr><tr><td>e8f3ecc0456fcbbb029b1c27dc1faad0</td><td>attachments.zip</td></tr><tr><td>952cc4e278051e349e870aa80babc755</td><td>Decoy Document (attachments.zip)</td></tr></tbody></table>Network<table style="width: 100%;"><thead class="bg-grey"><tr><th>IP or URL</th><th>Description</th></tr></thead><tbody><tr><td>ws.onehub[.]com/files/7f9dxtt6</td><td>URL to Archive of Atera Agent</td></tr><tr><td>a.storyblok[.]com/f/253959/x/b92ea48421/form.zip</td><td>URL to Archive of Atera Agent</td></tr><tr><td>a.storyblok[.]com/f/255988/x/5e0186f61d/questionnaire.zip</td><td>URL to Archive of Atera Agent</td></tr><tr><td>a.storyblok[.]com/f/259791/x/94f59e378f/questionnaire.zip</td><td>URL to Archive of SimpleHelp</td></tr><tr><td>146.70.149[.]61</td><td>MuddyWater’s SimpleHelp server</td></tr><tr><td>146.70.124[.]102</td><td><a href="https://twitter.com/MichalKoczwara/status/1719294254206288001" target="_blank">Suspected MuddyWater’s SimpleHelp server</a></td></tr><tr><td>37.120.237[.]204</td><td>Suspected MuddyWater’s SimpleHelp server</td></tr><tr><td>37.120.237[.]248</td><td>Suspected MuddyWater’s SimpleHelp server</td></tr><tr><td>a.storyblok[.]com/f/259837/x/21e6a04837/defense-video.zip</td><td>URL to Archive of Advanced Monitoring Agent</td></tr><tr><td>a.storyblok[.]com/f/259791/x/91e2f5fa2f/attachments.zip</td><td>URL to Archive of Advanced Monitoring Agent</td></tr></tbody></table>Additional IOCs regarding MuddyWater can be found in our GitHub page: <a href="https://github.com/deepinstinct/Israel-Cyber-Warfare-Threat-Actors" target="_blank">https://github.com/deepinstinct/Israel-Cyber-Warfare-Threat-Actors</a>

MuddyWater eN-Able spear-phishing with new TTPs

How we’re protecting organizations’ most valuable asset 

DI_DPS_Blog.jpg

As artificial intelligence (AI) transforms nearly every industry, it’s also changing how cybercriminals approach their work.Threats have steadily become more sophisticated and commonplace, and fresh avenues for attacks are becoming more accessible for organized cybercrime. AI is arming hackers, nation-state actors, and fraudsters with means to carry out complex and calculated attacks faster, more efficiently, and more easily than ever before.All of this is occurring with more data than ever before. The average large enterprise has between seven and 17 petabytes of data stored in hybrid, cloud, or on-prem databases. With more data available – and vulnerable – and with AI-enabled tools that help cybercriminals create malware and malicious code, it’s more critical than ever for organizations to protect stored data.Breaches can cost millions of dollars to remediate, erode corporate reputation, send share prices tumbling, and anger customers. For enterprises to effectively safeguard critical data, preventing malicious files from landing in their storage is imperative. In an ever-evolving, AI-driven digital landscape, Deep Instinct can protect organizations and the integrity of their data.<h5>Introducing Deep Instinct Prevention for Storage</h5>Traditional storage solutions – whether in cloud environments or through network attached storage (NAS) vendors – focus on storage, not protection. While these solutions are successful at housing data, they lack the adequate protection necessary to protect in an increasingly sophisticated threat landscape. The legacy tools many organizations implement to supplement this lack of protection react to threats only once they’re in the environment, or interrupt workflows by sanitizing essential files into flat copies. And the tools that claim to be AI or machine learning (ML)-driven only detect <a href="https://info.deepinstinct.com/deep-learning-vs-machine-learning-in-cybersecurity" target="_blank">60 percent</a> of unknown attacks post-execution, allowing a zero-day threat or new malware variant time to execute and exhibit known bad behaviors before being caught. They also require human tuning and more time investment from security and IT teams. Organizations that take data protection seriously must leverage tools that actually protect their data. Deep learning (DL) is the solution.<a href="https://www.deepinstinct.com/prevention-for-storage" target="_self">Deep Instinct Prevention for Storage</a> (DPS) – part of our Deep Instinct Prevention Platform – applies a prevention-first approach to storage protection, stopping ransomware, known and unknown threats, and malware from reaching data and executing within the environment, wherever data is stored. Powered by Deep Instinct’s unique DL framework, DPS seamlessly integrates into NAS, hybrid, or public cloud environments while delivering unparalleled efficacy, accuracy, and enterprise-grade scalability. DPS provides proactive prevention that is scalable, saves time, offers ongoing security to comply with regulations, and quickly thwarts cyberthreats before they impact companies’ bottom line.With DPS, organizations can achieve the following:<ul><li>Improve SOC operations and lower TCO: DPS enables teams to reliably and quickly scan millions of documents per day, taking &lt;20 milliseconds per file – 750x faster than the fastest known ransomware can encrypt. It also helps teams confidently assess potential threats with a false positive rate of &lt;0.1% and &gt;99% efficacy in preventing unknown threats.</li><li>Manage solutions and maintain compliance: DPS natively integrates with storage infrastructure, including Dell CAVA and NetApp Vscan, and integration with SIEM and SOAR.</li><li>Streamline threat analysis: DPS automatically logs all file scans and generates detailed events for each malicious file, which are sent directly to the management console. Teams can control and manage remediation actions within storage, including quarantine or deletion of malicious files, as well as restore from quarantine, if needed. It also offers security status at-a-glance with single console management across all Deep Instinct products.</li><li>Ensure data privacy: Data never leaves an organization’s environment. They stay compliant with ensured data privacy and logs from every file scanned.</li></ul>As attacks increase in volume and velocity and emerging technologies like AI expand the threat landscape, a reactive or incomplete approach to data security is no longer sufficient. Organizations must continually scan data to account for the most advanced phishing, malware, and ransomware attacks. Only DL can offer that.You can learn more about this innovative new solution in the following ways:<ul><li>Read the new eBook, <a href="https://info.deepinstinct.com/ai-driven-cyberstorage" target="_blank">AI-driven Cyberstorage: Protecting Organizations’ Most Valuable Asset</a></li><li>Watch our webinar from Wednesday, November 1st, below:</li></ul>

Introducing Deep Instinct Prevention for Storage

DPA-Launch-PR.jpg

It’s officially Cybersecurity Awareness Month, a month-long collaborative effort led by the <a href="https://www.dhs.gov/CISA" target="_blank">Cybersecurity and Infrastructure Security Agency</a> and the <a href="https://staysafeonline.org/" target="_blank">National Cybersecurity Alliance</a> to raise awareness on how to stay secure online. This year, Deep Instinct is proud to be named an official Champion of Cybersecurity Awareness Month, a cause that further supports our mission of predicting and preventing known and unknown cyber threats.This Cybersecurity Awareness Month is unlike previous years due to the sudden rise of cyber attacks leveraging generative AI. Want proof? Our recent <a href="https://www.deepinstinct.com/voice-of-secops-reports">Voice of SecOps Report</a> found that 75% of security professionals witnessed an increase in attacks over the past 12 months, with 85% attributing this rise to bad actors using generative AI. This is a massive red flag for the C-suite and employees at large.<h5>Combatting AI Threats with Deep Learning</h5>Now, more than ever, attackers are leveraging AI to create new malware variants at an alarming pace. The issue is that current security mechanisms rooted in machine learning (ML) are ineffective against never-before-seen, unknown malware; they will only break down in the face of AI-powered threats.&nbsp;The only way enterprises can truly protect themselves against AI-generated threats is with a more advanced form of AI – specifically, Deep Learning. Any ML-based, legacy security solution is too reactive and latent to adequately fight back – especially legacy AV tools including Symantec, McAfee, BitDefender, TrendMicro, and Kaspersky. Learn more about why you should <a href="https://www.deepinstinct.com/deep-instinct-vs-competitors">get rid of your legacy and next-generation anti-virus (NGAV) tools</a>.What’s missing is a layer of Deep Learning-powered data security, sitting in front of your existing security controls, to predict and prevent threats before they cause damage. This is where Deep Instinct comes in – and the industry is taking note.<h5>An Award-Winning Predictive Prevention Approach to Security</h5>As a testament to our ability to predict and prevent cyber attacks before they happen, Deep Instinct has been honored with several industry awards over the past year. From product recognition to leadership honors, we are proud of our people, our technology, and our commitment to bolstering cybersecurity worldwide, through initiatives like Cybersecurity Awareness Month.Here are just a few notable 2023 recognitions for Deep Instinct:<ul><li>Deep Instinct was named the “<a href="https://aibreakthroughawards.com/2023-winners/" target="_blank">Best Deep Learning Company</a>” for the second consecutive year in the AI Breakthrough Awards, an award program that recognizes the top companies, technologies, and products in today’s global AI market.</li></ul><ul><li>Of the 18 vendors in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms (EPP) report, Deep Instinct was the <a href="https://www.deepinstinct.com/news/deep-instinct-included-in-the-2022-gartner-magic-quadrant-for-endpoint-protection-platforms-epp">only new vendor added</a> for its ability to execute and completeness of vision.</li><li>Deep Instinct was listed as <a href="https://www.crn.com/news/security/the-20-coolest-endpoint-and-managed-security-companies-of-2023-the-security-100/6?itc=refresh" target="_blank">one of the 20 coolest</a> endpoints and managed security companies of 2023 in CRN’s The Security 100.</li><li>The team was named a finalist in the <a href="https://cybersecurity-excellence-awards.com/2023-cybersecurity-company-awards-winners/" target="_blank">Most Innovative Cybersecurity Company in North America</a> and the top <a href="https://cybersecurity-excellence-awards.com/candidates/deep-instinct-prevention-platform/" target="_blank">Cybersecurity Product/Solution in Ransomware Protection</a> in the 2023 Cybersecurity Excellence Awards.</li><li>Deep Instinct was also recognized by the 2023 Global Cybersecurity Excellence Awards, winning gold and achieving the highest ranking for <a href="https://cybersecurity-excellence-awards.com/2023-cybersecurity-industry-solution-awards-winners/" target="_blank">The Cybersecurity Industry Solution Awards</a> for its Deep Instinct Prevention for Applications Platform in the software category for North America.</li><li>The company was <a href="https://www.prweb.com/releases/2023/5/prweb19362068.htm" target="_blank">recognized as a finalist</a> and earned an honorary mention in the 2023 Fortress Cyber Security Awards alongside the world’s leading companies and products working to keep the world’s data and electronic assets safe from growing threats and attack vectors.</li></ul>In this new era of AI, it’s critical that you prevent cyber attacks, not just detect and respond to them after the fact like EDR. That’s not nearly enough in this AI-driven threat landscape. That’s why it’s time to dump the “assume breach” status quo and demand more. Learn why <a href="https://www.deepinstinct.com/endpoint-detection-response">EDR is NOT enough</a>.We’re proud to be a leader in raising awareness of this issue, while helping to bolster organizations’ cybersecurity posture during a time when it’s needed most. For more information about Cybersecurity Awareness Month, please click <a href="http://staysafeonline.org/cybersecurity-awareness-month/" target="_blank">here</a>. To learn how Deep Instinct can help your organization combat AI threats, <a href="https://info.deepinstinct.com/request-a-demo">request a demo</a>.

Deep Instinct Champions Cybersecurity Awareness Month 2023

blog-image-mitre-2023.jpg

The results are in! In this blog post we’ll outline the results of the 2023 MITRE Engenuity ATT&amp;CK Evaluations for Enterprise and cover the following:<ul><li>What the ATT&amp;CK Evaluations are and what it means for enterprises</li><li>The tactics, techniques, and procedures (TTPs) employed by Turla to perform an attack</li><li>How Deep Instinct’s platform prevents Turla attacks and protects your organization</li></ul>

Register Now

Peeling Back the Layers on MITRE Engenuity’s Latest Evaluations for Enterprise

About_Hero.png

<h5>Background: MITRE Engenuity ATT&amp;CK Evaluations</h5>The MITRE ATT&amp;CK Framework is an excellent tool for organizations to plan and understand their defense-in-depth strategy. Mapping the <a href="https://attack.mitre.org/tactics/enterprise/" target="_blank">tactics</a>, <a href="https://attack.mitre.org/techniques/enterprise/" target="_blank">techniques</a>, and procedures (TTPs) coverage to understand where your gaps lie is important to protecting your organization against cyber threats.<h5>MITRE Engenuity’s ATT&amp;CK Evaluation Results Released</h5>Earlier today MITRE Engenuity released the results from their latest round of <a href="https://attackevals.mitre-engenuity.org/enterprise/turla/" target="_blank">ATT&amp;CK Evaluations for Enterprise</a> that focused on complex, multi-stage, impact-focused attacks carried out by <a href="https://attack.mitre.org/groups/G0010/" target="_blank">Turla</a>, a sophisticated Russian-based threat group that has infected victims in over 45 countries. The group is known to target government agencies, diplomatic missions, military groups, and research and media organizations. Without the right tools and capabilities, defending against Turla is like wrestling a bear. That’s because Turla adopts novel and sophisticated techniques to maintain operational security, including the use of a distinctive command-and-control network in concert with their repertoire of open-source and in-house tools.In the past, MITRE Engenuity ATT&amp;CK Evaluations had been more focused on evaluating detection and response, post infection. This approach was tied closely with the reactive, “assume breach” mindset of the past decade which looks for anomalous behaviors to stop a breach after an attack has executed on the endpoint. Beginning in 2020, MITRE Engenuity added a protection portion to the test which aims to evaluate a solution’s ability to prevent attacks and not just provide breach details and rollback.This is fundamentally the difference between Deep Instinct’s predictive prevention, which keeps threats out, vs EDRs who are only enabling detection and response after a breach has occurred. Learn more here about why <a href="https://www.deepinstinct.com/endpoint-detection-response" target="_self">you need Deep Instinct even if you have an EDR</a>.In this most recent round of testing, which took place in Q2/Q3 of 2023, the results of the protection segment of the test validated the strength and robustness of Deep Instinct’s multi-layered, proactive predictive prevention and highlighted the value our customers are seeing every day. Deep Instinct also achieved exemplary detection coverage across various execution, persistence, and impact techniques emulated. These are exactly the results we would expect as a proactive prevention solution.4 Key Takeaways from Deep Instinct’s MITRE Engenuity participation:<ol><li>Deep Instinct provided excellent prevention, detection, and visibility into all 18 attack steps tested.</li><li>Deep Instinct’s prevention and detection engines achieved excellent detection coverage and visibility on all techniques included in the test including execution, persistence, privilege escalation, lateral movement, and more.</li><li>Deep Instinct’s detection engine improved tremendously compared to the 2022 MITRE evaluation with 90% detection (up from 70%).</li><li>The tests that were prevented by the D-brain static analysis (Deep Instinct’s patented deep learning technology engine) didn’t succeed in writing the file to the disk, which emphasizes our superior prevention capabilities based on AI.</li></ol><h5>The Importance of Prevention</h5>Prevention has an extremely positive impact on your overall security posture by filling the gaps that exist in your coverage while reducing reliance on the downstream impacts of detection and response. Defense-in-Depth is needed; with greater prevention you can lower security costs, improve efficiency, and reduce your overall risk. That way security teams can spend more time focusing on alerts that matter and less time chasing false positives. MITRE recognized this reality when they added protection testing.<blockquote>Michael Suby, IDC Research VP, Security &amp; Trust, states “There will be a rebirth in endpoint protection as organizations seek a better balance with detection and response capabilities and gravitate to vendor offerings that contain innovative leaps in endpoint protection efficacy.”</blockquote>MITRE Engenuity testing is important, but sometimes a customer evaluation can say it all.<blockquote>"I am now a believer of the capabilities of Deep Instinct as I had conducted my own pre-purchase trial where I tested some of the top vendors' engines and pitted them all against Deep Instinct (the competitors all lost badly in the detection phase of my testing). Deep Instinct handled many near zero-day threats that had been in the wild a much shorter time than Deep Instinct's detection engine's release date. It simply didn't matter to Deep Instinct. It found them all and stopped them at pre-execution. Since pre-execution was my strategic goal with a zero-defect mentality driving that concept — Deep Instinct rocketed to the top of my wish list. Other products I tested allowed some damage to occur or didn't detect a zero-day threat at all while they wreaked havoc in a sandboxed environment.” *</blockquote><h5>Conclusion</h5>Deep Instinct excels at proactively preventing unknown, never-before-seen threats. Our innovative approach allows organizations to proactively prevent &gt;99% of ransomware, zero-days, and other known and unknown malware. Deep Instinct also lowers false positives to &lt;0.1%, reducing the burden on your security team and improving your ability to detect the most advanced threats. And proactive prevention can lower downstream costs, improve the efficiency of your SOC, and lower your overall risk.We found significant value in participating in the MITRE Engenuity testing, but in reality, we do it every day. Our customers are our real proof points as they benefit from a true prevention-first approach with Deep Instinct, lowering the resource requirements of their security professionals by reducing false positives and improving investigation and remediation. When the next unknown threat hits, you need the best preventative solution to keep the attackers out and ensure you can automate responses with your EDR. This approach delivers the best of both worlds.We invite you to <a href="https://info.deepinstinct.com/request-a-demo" target="_self">request a demo</a> and test us out to see the positive impact a prevention-first approach will have on your organization’s security posture.For further reading please see our <a href="https://info.deepinstinct.com/8-reasons-why-edr-is-not-enough" target="_self">EDR is Not Enough eBook</a> and Deep Instinct’s latest <a href="https://www.deepinstinct.com/voice-of-secops-reports" target="_self">Voice of SecOps Report</a>.*Gartner Peer Insights reviews constitute the subjective opinions of individual end users based on their own experiences and do not represent the views of Gartner or its affiliates.<h5>Learn More</h5><a href="https://www.brighttalk.com/webcast/16681/595246" target="_self">Register</a> for our webinar, Peeling Back the Layers on MITRE Engenuity’s Lates Evaluations for Enterprise, on Wednesday, October 4th at 2 PM ET / 11 AM PT to hear members of our Research &amp; Development Teams review what the MITRE ATT&amp;CK Evaluations truly are and walk through the best ways to interpret the results, including details about how the tests are performed.<h5>About MITRE Engenuity ATT&amp;CK® Evaluations</h5>ATT&amp;CK® Evaluations is built on the backbone of MITRE’s objective insight and conflict-free perspective. Cybersecurity providers turn to the Evaluations program to improve their offerings and to provide defenders with insights into their product’s capabilities and performance. Evaluations enable defenders to make better informed decisions on how to leverage the products that secure their networks. The program follows a rigorous, transparent methodology using a collaborative, threat-informed, purple-teaming approach that brings together providers and MITRE experts to evaluate solutions within the context of ATT&amp;CK. In line with MITRE Engenuity’s commitment to serve the public good, Evaluations results and threat emulation plans are freely accessible.<h5>About MITRE Engenuity</h5>MITRE Engenuity, a subsidiary of MITRE, is a tech foundation for public good. MITRE’s mission-driven teams are dedicated to solving problems for a safer world. Through our public-private partnerships and federally funded R&amp;D centers, we work across government and in partnership with industry to tackle challenges to the safety, stability, and well-being of our nation.MITRE Engenuity brings MITRE’s deep technical know-how and systems thinking to the private sector to solve complex challenges that government alone cannot solve. MITRE Engenuity catalyzes the collective R&amp;D strength of the broader U.S. federal government, academia, and private sector to tackle national and global challenges, such as protecting critical infrastructure, creating a resilient semiconductor ecosystem, investing in pandemic preparedness, accelerating use case innovation in 5G, and democratizing threat-informed cyber defense. <a href="https://mitre-engenuity.org/" target="_blank">https://mitre-engenuity.org</a>.

Deep Insight Results: 2023 MITRE Engenuity ATT&CK Evaluations for Enterprise

blog-image-rusty-flag.jpg

Key takeaways:<ul><li>The Deep Instinct Threat Lab has discovered a new operation against Azerbaijanian targets</li><li>The operation has at least two different initial access vectors</li><li>The operation is not associated with a known threat actor; the operation was instead named because of their novel malware written in the Rust programming language</li><li>One of the lures used in the operation is a modified document that was used by the Storm-0978 group. This could be a deliberate “false flag”</li></ul><figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 1: Attack Flow" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc500e8e577b407b5/65028d348606a8f21cc873d7/fig1-AttackFlowRusty.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: Attack Flow</figcaption></figure><h5>LNK Vector:</h5>Deep Instinct Threat Lab observed a malicious LNK file with low detections named “1.KARABAKH.jpg.lnk.”The file has a double extension to lure the victim to click an image that is related to a military incident in <a href="https://en.wikipedia.org/wiki/Nagorno-Karabakh" target="_blank">Nagorno-Karabakh</a>.The LNK downloads and executes an MSI installer hosted by DropBox:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Fig 2: LNK arguments" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt72f719f046aed339/65028d5ef41335980a8918e4/fig2-LNK-Arguments.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Fig 2: LNK arguments</figcaption></figure><figure style = "margin: auto; text-align: center;width: auto;"><img alt="Fig 3: OSINT information about MSI uploader from Dropbox" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltcdb6b050e52030ad/65028d8d7960981affb2dee1/fig3-osint-about-MSI-uploader-Dropbox.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Fig 3: OSINT information about MSI uploader from Dropbox</figcaption></figure>The MSI file drops an implant written in Rust, an xml file for a scheduled task to execute the implant, and a decoy image file:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 4: Decoy image file" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6930cc293aa4cf67/65028dc568d8e111ac604833/fig4-decoy-image.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4: Decoy image file</figcaption></figure>The image file includes watermarks of the <a href="https://mod.gov.az/en" target="_blank">symbol</a> of the Azerbaijanian MOD.<h5>Office False Flag Vector:</h5>Once we identified the LNK campaign the Deep Instinct Threat Lab attempted to identify additional, related files.Deep Instinct Threat Lab quickly found another MSI file hosted on DropBox that drops a different variant of the same Rust implant; however, the identification of the initial access vector for this campaign was trickier.The DropBox URL was masked with a URL shortener (hxxps://t[.]]ly/8CYQW) and the evidence showed that this URL was invoked via exploitation of Microsoft Equation Editor CVE-2017-11882.Deep Instinct Threat Lab identified a file named “Overview_of_UWCs_UkraineInNATO_campaign.docx” that was invoking the request to this shortened URL; however, this filename and its content are known to be associated with a <a href="https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/" target="_blank">Storm-0978</a> campaign utilizing CVE-2023-36884.The identified file even had a comment on VirusTotal that it is related to the Storm-0978 campaign:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 5: VT comment" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte13eea8de10129de/65028e2f9e7ba645b2cabbf9/fig5-VT_comments.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5: VT comment</figcaption></figure>After further investigation it was revealed that this is a different file, not related to the Storm-0978 campaign. The embedded “afchunk.rtf” file has been replaced and CVE-2023-36884 is not used. Instead, CVE-2017-11882 is used to download and install the MSI file.This action looks like a deliberate false flag attempt to pin this attack on Storm-0978.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Fig 6: OSINT information about MSI uploader for Office vector" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0ad88745f4ac3c5a/65028e6ba26337c73b96b6af/fig6-osint-information-msi-uploaderd.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Fig 6: OSINT information about MSI uploader for Office vector</figcaption></figure>Even though the initial lure is an Office file, the delivered MSI file also open a decoy file, this time a PDF invoice:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Fig 7: PDF decoy dropped by Office vector" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltfb1f227360da24a9/6502909f1c72d8a20e8b120c/fig7-PDF-decoy-droppedPDF.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Fig 7: PDF decoy dropped by Office vector</figcaption></figure><h5>MSI Analysis:</h5>While the initial vectors are different, the execution is the same and it is done by invoking msiexec with URL to DropBox.Using a Linux file command or msitools it seems that the MSI files were created by “MSI Wrapper” <a href="https://www.exemsi.com/" target="_blank">https://www.exemsi.com/</a>, which is often used by threat actors to drop malicious files.The MSI installers are dropping and executing the Rust implant along with a decoy file and xml file for scheduled task.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 8: MSI Metadata" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9a1c244f60882ab6/650291e21709f57bfebf53c1/fig8-msi-metadata.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 8: MSI Metadata</figcaption></figure><h5>Rust Implant Analysis:</h5>Each attack had its unique file names and metadata. One of the file Rust Implants named “WinDefenderHealth.exe” is written in Rust. It is expected to gather information and send it to the attacker server, which is still active at the time of this research.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blte9120922332ab068" alt="Figure 9: Metadata of the Rust malware" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte9120922332ab068/6502913d3a3d4841e1f6efba/fig9-Rust-defender-healthCheckmetadataVT.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 9: Metadata of the Rust malware</figcaption></figure><figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 10: Rust compiler" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9e4e043348197e65/65029386f4133504258918f5/fig10-Rust-malware-compiler.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 10: Rust compiler</figcaption></figure>Rust is becoming more popular among malware authors. Security products are not yet detecting Rust malware accurately, and the reverse engineering process is more complex. The Rust standard library is not familiar to tools like IDA and Ghidra. It results in tagging large portions of the code as unknown, and it is difficult to differentiate the code of the standard library from the code of the malware. To overcome this, the plugin GhidRust was used, but it didn't detect the functions of the standard library. In addition, BinDiff was used. A simple Rust binary was compiled and compared against the malware, but very little code was shared. Some open projects for Rust were used in the malware such as Tokio (a runtime for writing reliable, asynchronous, and slim applications with the Rust programming language), hyper (a fast and correct HTTP implementation for Rust) and Serde JSON (a framework for serializing and deserializing Rust data structures efficiently and generically). After that part, we moved on to dynamic analysis.Once the file is executed it goes to sleep for 12 minutes. This is a known method to avoid security researchers and sandbox’s easy analysis.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 11: “Sleep” for 12 minutes" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt70fbe3ef467a938d/650293edeb5afe09bc4a7884/fig11-sleep-12-minutes-to-avoid-easy-reversing.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 11: “Sleep” for 12 minutes</figcaption></figure>Then it starts collecting information about the infected machine:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 12: “Collect” information" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt43287626dd55bb8c/650321cc796098004ab2e260/fig12-Collect-information.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 12: “Collect” information</figcaption></figure><figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 13: Processes collecting information about the PC" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3d7dc9d84a471c52/650295df1c72d858748b1217/fig13-ExfilProccesses.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 13: Processes collecting information about the PC</figcaption></figure>The malware then reads the output of the above executions by redirecting their StdOut to a named pipe. It is notable that the values of StdIn, StdOut, and StdErr match the handles of the processes to the named pipes.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 14: “Read” the collected information" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltbb4b1a45002b971a/650297073a3d489d5af6efd7/fig14-tsdoutNamedPipes.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 14: “Read” the collected information</figcaption></figure>The information is gathered leveraging the following template:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 15: Sample of the collected info before encryption" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6497946a4527cebe/6502975576c8e45ee3b5f637/fig15-collected-info.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 15: Sample of the collected info before encryption</figcaption></figure>The above information is then encrypted and sent to the attacker server using an uncommon, hardcoded port 35667:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 16: Encrypted information being sent to the server" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt474685ab5f698b32/6502977d9bf26140fd6bcd01/fig16-encrypted-information-sent-toC2.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 16: Encrypted information being sent to the server</figcaption></figure>We have built a script to decrypt the information, available in our <a href="https://github.com/deepinstinct/Rusty-Flag-DecryptData" target="_blank">Git</a>, that the malware is sending.All analyzed files above have a low detection rate on VT at the time. There are zero detections on first seen and most of the detections are generic ones.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 17: Detections of the RUST implant in VT. All detections are generic." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt831a4c472c34a419/650297c50433c0d28e25462b/fig17-VT_Detections.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 17: Detections of the RUST implant in VT. All detections are generic.</figcaption></figure>While the other Rust implant still has zero detections:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 18: 2nd Rust implant VT detections" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3926fc166ca5accf/65029808a8cf8b810b3e0b3f/fig18-sengforVTDet.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 18: 2nd Rust implant VT detections</figcaption></figure><h5>Conclusion:</h5>Deep Instinct Threat Lab could not attribute these attacks to any known threat actor. There is a possibility that these files are part of a red team exercise.Regardless of the above statement, the fact that both Rust implants had zero detections when first uploaded to VirusTotal shows that writing malware in esoteric languages can bypass many security solutions.<h5>MITRE:</h5><table><thead class="bg-grey"><tr><th>Tactic</th><th>Technique</th><th>Description</th><th>Observable</th></tr></thead><tbody><tr><td>Discovery</td><td>T1082 System Information Discovery</td><td>The malware executes systeminfo.exe to gain information about the infected computer</td><td>systeminfo.exe</td></tr><tr><td>Discovery</td><td>T1016 System Network Configuration Discovery</td><td>Gain detailed information about the network interfaces on the system</td><td>ipconfig.exe /all</td></tr><tr><td>Discovery</td><td>T1033 System Owner/User Discovery</td><td>Gain user, group, and privileges information for the users</td><td>Whoami.exe /all</td></tr><tr><td>Discovery</td><td>T1087 Account Discovery</td><td>Gain information about local or domain accounts on a system</td><td>Net.exe user</td></tr><tr><td>Discovery</td><td>T1057 Process Discovery</td><td>Gain a list of currently running processes, including detailed information about each one</td><td>Tasklist.exe /v</td></tr><tr><td>Persistence</td><td>T1053 Scheduled Task/Job</td><td>Create a scheduled task using the xml file</td><td>Schtasks.exe</td></tr><tr><td>Command and Control</td><td>T1132 Data Encoding</td><td>Encrypted communication</td><td>Encrypted information sent to the C2. A tool for decrypting the information is provided in our Git.</td></tr></tbody></table><h5>IOC:</h5>78.135.73[.]140<table><thead class="bg-grey"><tr><th>SHA256</th><th>Description</th></tr></thead><tbody><tr><td>463183002d558ec6f4f12475cc81ac2cb8da21549959f587e0fb93bd3353e13e</td><td>Archive containing malicious Office file</td></tr><tr><td>edc531d255b9ae8ae6902dc676f24e95a478576cad297e08e2bbc0b8fe03e4ce</td><td>Malicious Office file</td></tr><tr><td>1546bb5bfc25741434148b77fe51fed7618432a232049b3f6f7210e7fb1f3f0e</td><td>MSI file from hxxps://t[.]ly/8CYQW</td></tr><tr><td>387304b50852736281a29d00ed2d8cdb3368d171215f1099b41c404e7e099193</td><td>SangforUD.EXE Rust implant</td></tr><tr><td>0742cd9b92661f23f6b294cc29c814de027b5b64b045e4807fc03123b153bcd5</td><td>Decoy PDF file</td></tr><tr><td>04725fb5a9e878d68e03176364f3b1057a5c54cca06ec988013a508d6bb29b42</td><td>Malicious LNK file</td></tr><tr><td>35f2f7cd7945f43d9692b6ea39d82c4fc9b86709b18164ad295ce66ac20fd8e5</td><td>MSI file from LNK vector</td></tr><tr><td>5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db</td><td>WinDefenderHealth.EXE Rust implant</td></tr><tr><td>e508cafa5c45847ecea35539e836dc9370699d21522839342c3f3573bf550555</td><td>Decoy JPEG file</td></tr></tbody></table>

Operation Rusty Flag – A Malicious Campaign Against Azerbaijanian Targets

blog-cover-image-contain-yourself-v2.jpg

Contain Yourself: Staying Undetected Using the Windows Container Isolation Framework

blog-image-nofilter-defcon-v3.jpg

#NoFilter - Abusing Windows Filtering Platform for Privilege Escalation

blog-phonyc2-muddywater.jpg

PhonyC2: Revealing a New Malicious Command & Control Framework by MuddyWater

pindos-js-dropper-blog.jpg

Deep Instinct’s Threat Research Lab recently noticed a new strain of a JavaScript-based dropper that is delivering Bumblebee and IcedID. The dropper contains comments in Russian and employs the unique user-agent string “PindOS”, which may be a <a href="https://en.wikipedia.org/wiki/Anti-American_sentiment_in_Russia#Pindos" target="_blank">reference</a> to current (and past) anti-American sentiment in Russia.Bumblebee is a malware loader first discovered in March 2022. It was associated with <a href="https://info.deepinstinct.com/conti-leaks-cyber-threat-reports" target="_self">Conti group</a> and was being used as a replacement for BazarLoader. It acts as a primary vector for multiple types of other malware, including ransomware.IcedID is a modular banking malware designed to steal financial information. It has been seen in the wild since at least 2017 and has recently been <a href="https://www.bleepingcomputer.com/news/security/new-icedid-variants-shift-from-bank-fraud-to-malware-delivery/" target="_blank">observed</a> shifting some of its focus to malware delivery.<h5>Bumblebee’s Dilemma – PowerShell or JavaScript?</h5><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltac10f75989680347" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltac10f75989680347/6493347d48e15a005746c1ff/fig00-bumble_meme.jpg" style="text-align: center;"/></figure>Bumblebee’s primary modus operandi, including its most recent <a href="https://www.secureworks.com/blog/bumblebee-malware-distributed-via-trojanized-installer-downloads" target="_blank">major campaign</a>, involves a PowerShell-based first stage with very characteristic obfuscation (“elemXXX”). This serves as a wrapper and loading routine for an embedded 64-bit payload .DLL. Our analysis of this flow can be found <a href="/blog/the-dark-side-of-bumblebee-malware-loader" target="_self">here</a>.The possible switch to JavaScript instead of PowerShell marks a significant change in Bumblebee’s well-established TTP’s.<h5>IcedID – From Banker to Loader?</h5>As recent reports indicate, IcedID appears to be partially following in Emotet’s footsteps and may be abandoning its banking and financial functionalities in favor of becoming a more generalized loader-type malware. An association with a new JavaScript type of dropper can be seen as another step in this direction.<h5>PindOS JavaScript Technical Analysis</h5>Once de-obfuscated, the dropper is surprisingly simple. It consists of a single function, “exec,” which gets four parameters:<ul><li>“UserAgent” – The user-agent string to be used when downloading Bumblebee’s .DLL</li><li>“URL1” – First address to download from</li><li>“URL2” – Second address to download from</li><li>“RunDLL” – Payload .DLL exported function to call</li></ul>When executed, the dropper will attempt to download the payload initially from URL1 and execute it by calling on the specified export directly via rundll32.exe. If this fails, the dropper will attempt to download the payload from URL2 and execute it using a combination of PowerShell and rundll32.exe.The downloaded payload is saved to %appdata%/Microsoft/Templates/&lt;6-char-random-number&gt;.dat<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt310d8e627d3469ad" alt="Figure 1 – PindOS' main function" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt310d8e627d3469ad/6493347db9a076b80b92866c/fig01-pindos-main-function.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 1 – PindOS' main function</figcaption></figure>The function is then called twice, with four separate URLs:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt94b88382eb4426e4" alt="Figure 2 – exec function call from Bumblebee dropper" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt94b88382eb4426e4/6493347dd5b9a5988d6de2e6/fig02-exec-function-call-from-bumblebee-dropper.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 2 – exec function call from Bumblebee dropper</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt2ccea6ece70d6aef" alt="Figure 3 – exec function call from IcedID dropper" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2ccea6ece70d6aef/6493347d1fb2d3643c496f99/fig03-exec-call-from-icedid-dropper.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 3 – exec function call from IcedID dropper</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltf4668bbd24eb05b8" alt="Figure 4 – Payload download" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf4668bbd24eb05b8/6493347df7411b69d437e201/fig04-payload-download.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 4 – Payload download</figcaption></figure>The retrieved payloads are generated pseudo-randomly “on-demand” which results in a new sample hash each time a payload is fetched. This is commonly done to avoid signature-based detection. However, in Bumblebee’s case, this seems somewhat ineffective compared to the previous flow (which did not write the payload directly to disk), as the samples are fairly <a href="https://www.virustotal.com/gui/file/28c87170f2525fdecc4092fb347acd9b8350ed65e0fd584ce9fc001fd237d523/detection/f-28c87170f2525fdecc4092fb347acd9b8350ed65e0fd584ce9fc001fd237d523-1686560298" target="_blank">well detected</a> even on “first-seen”. This is likely due to the generated payload’s exports and several other indicators which remain constant and do not vary across the different generated samples.<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt9a6ab350a777b88a" alt="Figure 5 – A generalized comparison of Bumblebee’s infection flows - “older” on the right; “newer” on the left." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9a6ab350a777b88a/64933d2de66699a1d52eb992/fig05-a-generalized-comparison-of-bumblebees-infection-flows.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 5 – A generalized comparison of Bumblebee’s infection flows - “older” on the right; “newer” on the left.</figcaption></figure>According to Virus Total, on “first-seen” PindOS droppers have mostly received very low detection rates:<img asset_uid="blt5a182e8e00749668" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5a182e8e00749668/64933d2d1fb2d36df6496fcb/fig06-vt-first-seen-detection-pindos-virus.png"/><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt6e2212907fb50273" alt="Figures 6 & 7 – VT first-seen detection for PindOS droppers" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6e2212907fb50273/64933d2d48a8ff009c477fde/fig07-vt-first-seen-detection-pindos-dropper.png" style="text-align: center;"/><figcaption style="text-align: center;">Figures 6 &amp; 7 – VT first-seen detection for PindOS droppers</figcaption></figure><h5>Bumblebee DLL Payload Analysis Highlights</h5>The DLL payload is slightly different from the one previously encountered. Dynamically, it is very similar, with the addition of a few layers of obfuscation. It’s anti-debugging and anti-VM/sandbox features remain the same but with some additional “legitimate looking” strings taken from the <a href="https://github.com/FFmpeg/FFmpeg/blob/1617d1a752d5e97d5e74f6c384609c027c884553/libavutil/error.c" target="_blank">FFmpeg project open-source</a> project’s “error.c” file and a few other files from the same project added for distraction purposes:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt64d2e5ce682d4b38" alt="Figure 8 – Strings found in Bumblebee DLL" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt64d2e5ce682d4b38/6493347d9601bc69e508214d/fig08-strings-found-in-bumblebee-dll.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 8 – Strings found in Bumblebee DLL</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltff29e3f9d11aa98a" alt="Figure 9 – FFmpeg project source, “error.c” file." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltff29e3f9d11aa98a/6493347dea50bc3ffabea7f4/fig09-ffmpeg-project-source-error.c-file.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 9 – FFmpeg project source, “error.c” file.</figcaption></figure>Another point of differentiation is that previously Bumblebee DLLs had two main export functions, while the new one has four.<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt3c905274f728fa88" alt="Figure 10 – “New” Bumblebee DLL Exports" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3c905274f728fa88/6493347dd2420473b31cd636/fig10-new-bumblebee-dll-exports.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 10 – “New” Bumblebee DLL Exports</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltcb5ad0e83176edf1" alt="Figure 11 – “Old” Bumblebee DLL exports, with main “SetPath” function" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltcb5ad0e83176edf1/6493347d75c2ae82940617e7/fig11-old-bumblebee-dll-exports-with-main-setpath-function.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 11 – “Old” Bumblebee DLL exports, with main “SetPath” function</figcaption></figure>Further examination of the DLL brings us to the same main function as the previous variant.<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltec80d5d7fc0f0819" alt="Figure 12 – “SetPath” in the “new” Bumblebee DLL." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltec80d5d7fc0f0819/6493347ee6669913502eb96f/fig12-setpath-in-the-new-bumblebee-dll.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 12 – “SetPath” in the “new” Bumblebee DLL.</figcaption></figure><h5>Conclusion</h5>Bumblebee’s latest “experiment” attempts to leverage pseudo-random sample generation as a means of reducing the risk of detection. This has been used by threat actors in the financial/banking malware landscape for years, including IcedID, which “shares” the PindOS dropper.Whether PindOS is permanently adopted by the actors behind Bumblebee and IcedID remains to be seen. If this “experiment” is successful for each of these "companion” malware operators it may become a permanent tool in their arsenal and gain popularity among other threat actors.As Bumblebee and <a href="https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/" target="_blank">IcedID</a> are known to deliver ransomware, we recommend that security teams take note of these IOCs. You can find updated lists of IOCs on our <a href="https://github.com/deepinstinct/PindOS-JS-Dropper" target="_blank">GitHub page</a>.<h5>IOCs</h5><ul><li>Network Artifact User-Agent: PindOS</li><li>Bumblebee infection URLs hxxps://qaswrahc.com/wp-content/out/mn[.]php hxxp://tusaceitesesenciales.com/mn[.]php hxxp://carwashdenham.com/mn[.]php hxxps://intellectproactive.com/dist/out/mn[.]php</li><li>Bumblebee .JS dropper SHA256 bcd9b7d4ca83e96704e00e378728db06291e8e2b50d68db22efd1f8974d1ca91 07d2cb0dc0cd353fb210b065733743078e79c4a27c42872cd516a6b1fb1f00d1 00ec8f3900336c7aeb31fef4d111ee6e33f12ad451bc5119d3e50ad80b2212b0 15da5b0a65dd8135273124da0c6e52e017e3b54642f87571e82d2314aae97eec 180a935383b39501c7bdf2745b3a334841f01a7df9d063fecca587b5cc3f5e7a</li><li>Bumblebee DLL payload SHA256 24dd5c33b8a5136bdf29d0c07cf56ef0e33a285bb12696a8ff65e4065cb18359 76c9780256e195901e1c09cb8a37fb5967f9f5b36564e380e7cf2558652f875b 28c87170f2525fdecc4092fb347acd9b8350ed65e0fd584ce9fc001fd237d523 ac261ac26221505798c65c61a207f3951cc7dce2e1014409d8a765d85bfd91d4</li><li>IcedID infection URLs hxxps://masar-alulaedu.com/wp-content/woocommerce/out/berr[.]php hxxps://egyfruitcorner.com/wp-content/tareq/out/berr[.]php hxxps://tech21africa.com/wp-content/uploads/out/berr[.]php hxxps://www.posao-austrija.at/images/out/lim[.]php hxxps://logisticavirtual.org/wp-content/out/lim[.]php hxxps://adecoco.us/wp-content/out/lim[.]php hxxps://acsdxb.net/wp-content/out/lim[.]php</li><li>IcedID .JS dropper SHA256 92506fe773db7472e7782dbb5403548323e65a9eb2e4c15f9ac65ee6c4bd908b c84c84387f0b9e7bc575a008f36919448b4e6645e1f5d054e20b59be726ee814 7355656f894ae26215f979b953c8fa237dc39af857a6b27754a93adb1823f3b6 8f40ff286419eb4b0c4d15710dc552afb2c2a227a180f4b4f520d09b05724151</li><li>IcedID DLL payload SHA256 9101975f7aca998da796fc15a63b36ab8aa0fe0aed0b186aaed06a3383d5f226 4f0c9c6fc1287ef16f4683db90dd677054a1f834594494d61d765fa3f2e1352c cb307d7fa6eaac6a975ad64ff966ff6b0b0fdd59109246c2f6f5e8d50a33e93c 361b0157ef63d362fdd4399288f5f6a0e1536633dfb49c808a3590718c4d8f10 e71c9ac9ddd55b485e636840da150db5cd2791d0681123457bd40623acd8311c 8ae3be9f09f5fc64ec898a4d6467b2f6e50eaaa26fc460a4f1a9b9566e97a9a7</li></ul><h5>MITRE ATT&amp;CK</h5><table><thead><tr><th style="width: 13%;">Tactic</th><th>Technique</th><th>Description</th><th>Observable</th></tr></thead><tbody><tr><td>Execution</td><td>Command and Scripting Interpreter: JavaScript – T1059.007</td><td>Adversaries may abuse various implementations of JavaScript for execution.</td><td>.JS Droppers</td></tr><tr><td>Defense Evasion</td><td>System Binary Proxy Execution: Rundll32 – T1218.001</td><td>Adversaries may abuse rundll32.exe to proxy execution of malicious code.</td><td>Rundll32.exe usage</td></tr><tr><td>Defense Evasion</td><td>Obfuscated Files or Information – T1027</td><td>Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.</td><td>Obfuscated JS, “Random” generated payloads</td></tr></tbody></table>

PindOS: New JavaScript Dropper Delivering Bumblebee and IcedID