Engage Report: Head Mare Group’s PhantomCore Campaign

Subject: Engage Report: Head Mare Group’s PhantomCore Campaign

Tactics: TA0001 Initial Access

Technique: T1071.001 Application Layer Protocol: Web Protocols, T1059.003 Command and Scripting Interpreter: Windows Command Shell, T1566.001 Phishing: Spearphishing Attachment, T1021 Remote Services, T1082 System Information Discovery

Procedure:

The Head Mare group distributes malicious ZIP archives, likely through spam emails disguised as invoices or financial documents, to deceive recipients into executing the malicious payload.

Vulnerability: EAV0002 When adversaries interact with the environment or personas, they are vulnerable to collecting, or in some way interacting with, manipulated or decoy data. In those cases the data may increase their tolerance for imperfections in the environment and improve the overall believability of the ruse.

Engagement Opportunity:

Deploy a decoy system with enticing “financial documents” as bait to lure attackers into deploying the PhantomCore payload. This allows for capturing and analyzing the malware for improved detection and response mechanisms.

Threat Actor: Head Mare Group

Threat Objective:

Disrupt operations and demand ransom from organizations in Russia and Belarus.

Deception Opportunity:

Create a fake network share mimicking a high-value target within a Russian organization. Plant decoy documents and lure the attackers into attempting data exfiltration, providing valuable intelligence on their exfiltration methods and tools.

Sensor Data Placement: Application

Observable Level: Core to Adversary-Brought Tool

Scoring Rationale:

The campaign uses a custom malware (PhantomCore) and existing tools like PowerShell and cmd.exe, providing observables at both “Core to Adversary-Brought Tool” and “Core to Pre-Existing Tool” levels. The attack involves user-level interactions and application manipulation, justifying the selection of Application and User-Mode for sensor data placement.

• Sensor Data Placement:
  • Application
  • User-Mode
     
• Observable Level:
  • Core to Adversary-Brought Tool
     
  • Core to Pre-Existing Tool

Link to Report: https://www.google.com/url?sa=E&source=gmail&q=https://cyble.com/blog/head-mare-group-intensifies-attacks-against-russia/

Link to Report II.:

Additional Comments:

The Head Mare group demonstrates continuous evolution in tactics and malware development, making it crucial to monitor their activities and adapt defense strategies accordingly.

Possible elements:

MSG (Pseudocode):

# Malicious Sub-Graph Standard

# Node Format:
# [Node ID]: [Tactic] - [Technique] - [Procedure] ([Observable Level])

# Edge Format:
# [Source Node ID] --> [Destination Node ID] ([Exploited Vulnerability])

# Head Mare Group PhantomCore Attack Graph

[1]: Initial Access [TA0001] - Phishing [T1566] - Deliver malicious ZIP archive via spam email disguised as invoice (Core to Adversary-Brought Tool)
[2]: Execution [TA0002] - Command and Scripting Interpreter: PowerShell [T1059.001] - Execute PowerShell command to extract and launch payload (Core to Pre-Existing Tool)
[3]: Execution [TA0002] - Windows Command Shell [T1059.003] - Use cmd.exe to execute commands and interact with the payload (Core to Pre-Existing Tool)
[4]: Command and Control [TA0011] - Application Layer Protocol: Web Protocols [T1071.001] - Communicate with C2 server over HTTP using Boost.Beast library (Core to Adversary-Brought Tool)
[5]: Discovery [TA0007] - System Information Discovery [T1082] - Collect victim's OS version, IP address, and other system details (Core to Sub-Technique or Technique)
[6]: Lateral Movement [TA0008] - Remote Services [T1021] - Execute additional commands and deploy payloads from C2 server (Core to Sub-Technique or Technique)

1 --> 2 (Lack of User Awareness)
2 --> 3 (None)
3 --> 4 (Lack of Network Monitoring)
4 --> 5 (None)
5 --> 6 (Lack of System Monitoring)

# Pseudocode Standard

# Function Format:
# function [Tactic]_[Technique]([Input]):
# [Procedure]
# return [Output]

# Head Mare Group PhantomCore Pseudocode

function Initial_Access_Phishing(target_email):
# Craft spam email with malicious ZIP archive
# Disguise email as invoice or financial document
# Send email to target_email
return malicious_zip

function Execution_Command_and_Scripting_Interpreter(malicious_zip):
# Execute PowerShell command to extract ZIP archive
# Launch PhantomCore payload from extracted files
return running_payload

function Execution_Windows_Command_Shell(running_payload):
# Use cmd.exe for command execution within the payload
# Interact with the payload for additional operations
return C2_communication_module

function Command_and_Control_Application_Layer_Protocol(C2_communication_module):
# Establish HTTP connection with C2 server using Boost.Beast
# Send and receive data and commands
return victim_details, additional_payloads

function Discovery_System_Information_Discovery(running_payload):
# Collect victim's OS version, IP address, computer name, etc.
# Send collected information to C2 server
return victim_profile

function Lateral_Movement_Remote_Services(additional_payloads):
# Execute commands received from C2 server
# Deploy additional payloads for further compromise
return compromised_system