- Initial Access: Attackers compromise a legitimate email account and send phishing emails containing a malicious URL, either directly in the email body or within an attached .eml file. The email often impersonates a trusted entity and may include branding to appear legitimate. The URL leads to a compromised SharePoint page hosting a weaponized Visio (.vsdx) file.
- Execution: The Visio file contains a malicious URL hidden behind a clickable element, such as a “View Document” button. Victims are instructed to hold down the Ctrl key while clicking the element to access the URL, a technique designed to evade automated security scanners. This URL redirects the victim to a fake Microsoft login page designed to steal credentials.
- Persistence (Implied): Although not explicitly mentioned in the document, attackers likely leverage the stolen credentials for persistent access to the victim’s environment. This may involve establishing backdoors, creating new accounts, or modifying existing ones.
- Command and Control: After gaining access, attackers likely establish a command-and-control (C2) channel using application layer protocols like HTTP to communicate with the compromised system, issue commands, and manage the attack.
- Exfiltration: Attackers exfiltrate sensitive data from the victim’s environment over the established C2 channel.
Category: Engage Reports
Harnessing Chisel for Covert Operations
The attacker utilizes Chisel, a tunneling tool, to establish a covert communication channel with the C2 server over HTTP. This allows them to bypass firewalls and security measures that might detect traditional C2 traffic.
It’s Not Safe To Pay SafePay
The threat actor initiated the attack by disabling Windows Defender’s real-time protection and automatic file submission. They then proceeded to discover network shares using a PowerShell script. Sensitive data was collected and archived using WinRAR. Subsequently, they employed a UAC bypass technique involving COM objects to gain elevated privileges. Finally, the SafePay ransomware was deployed to encrypt files on the target system.
DONOT APT’s Attack on Maritime & Defense Manufacturing
- Technique: Spearphishing Attachment (T1566.001)
- Procedure: DONOT APT used spearphishing emails with malicious attachments, likely exploiting Microsoft Office vulnerabilities (e.g., CVE-2017-11882) to deliver the initial payload. These emails were likely tailored to individuals working in Pakistan’s maritime and defense sector.
- Technique: Command and Scripting Interpreter: Windows Command Shell (T1059.003)
- Procedure: Upon successful exploitation of the vulnerability, the malicious attachment executes a Windows Command Shell command to launch the next stage of the attack.
- Technique: Scheduled Task/Job: Scheduled Task (T1053.005)
- Procedure: The malware creates a scheduled task named “Schedule” to execute the malicious DLL payload via
rundll32.exeevery 5 minutes. This ensures the malware’s persistence on the compromised system.
- Technique: Application Layer Protocol: HTTP (T1071.001)
- Procedure: The malware communicates with its command-and-control (C2) server using HTTP for receiving commands and exfiltrating data.
- Technique: Exfiltration Over C2 Channel (T1041)
- Procedure: Sensitive data stolen from the victim’s system is likely exfiltrated to the attacker’s C2 server over the established HTTP communication channel.
Tropic Trooper – Campaign
Tropic Trooper employs a multi-stage attack flow:
- Initial Access: Exploiting vulnerabilities in public-facing applications (like Microsoft Exchange Server) or through spearphishing emails with malicious attachments.
- Persistence: Establishing persistent access using web shells (like “ByPassGodzilla”) and malware (like “Yahoyah” and “ChinaChopper”).
- Privilege Escalation: Utilizing DLL side-loading and exploiting system services to gain higher privileges.
- Lateral Movement: Moving laterally within the network using SMB shares and remote services.
- Data Exfiltration: Exfiltrating data to cloud storage or using other automated methods.
Tropic Trooper – Spear Phishing Attachment
Tropic Trooper crafts spearphishing emails with malicious attachments, often disguised as legitimate documents or files, to target individuals within their desired organizations. These attachments typically contain malware, such as the “Yahoyah” downloader, which enables them to establish persistence on compromised systems.
Tropic Trooper – Exploit Web Facing App
Tropic Trooper exploits vulnerabilities in public-facing web servers, such as Microsoft Exchange Server, to gain initial access to target networks. They leverage known vulnerabilities (like CVE-2023-26360) to establish a foothold and deploy web shells like “ByPassGodzilla” for further malicious activities.
DarkComet RAT – Proxy
The DarkComet RAT utilizes a connection proxy, specifically SOCKS5, to obfuscate the true command and control (C2) server infrastructure. This makes it more difficult to identify and block the C2 communication, allowing the attacker to maintain persistent control over the infected system.
DarkComet RAT – Phishing
The attacker sent a spearphishing email containing a malicious Microsoft Word document (.doc) as an attachment. This document exploits a vulnerability (CVE-2012-0158) to execute embedded malicious code, ultimately leading to the download and execution of the DarkComet RAT payload.