US CERT: Technical Security Alerts

Original release date: October 30, 2020
Summary

This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) version 7 framework. See the ATT&CK for Enterprise version 7 for all referenced threat actor tactics and techniques.

This joint cybersecurity advisory was coauthored by the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI). CISA and the FBI are aware of an Iranian advanced persistent threat (APT) actor targeting U.S. state websites—to include election websites. CISA and the FBI assess this actor is responsible for the mass dissemination of voter intimidation emails to U.S. citizens and the dissemination of U.S. election-related disinformation in mid-October 2020. This disinformation (hereinafter, “the propaganda video”) was in the form of a video purporting to misattribute the activity to a U.S. domestic actor and implies that individuals could cast fraudulent ballots, even from overseas. https://www.odni.gov/index.php/newsroom/press-releases/item/2162-dni-john-ratcliffe-s-remarks-at-press-conference-on-election-security.  (Reference FBI FLASH message ME-000138-TT, disseminated October 29, 2020). Further evaluation by CISA and the FBI has identified the targeting of U.S. state election websites was an intentional effort to influence and interfere with the 2020 U.S. presidential election.

Click here for a PDF version of this report.

Technical Details

Analysis by CISA and the FBI indicates this actor scanned state websites, to include state election websites, between September 20 and September 28, 2020, with the Acunetix vulnerability scanner (Active Scanning: Vulnerability Scanning [T1595.002]). Acunetix is a widely used and legitimate web scanner, which has been used by threat actors for nefarious purposes. Organizations that do not regularly use Acunetix should monitor their logs for any activity from the program that originates from IP addresses provided in this advisory and consider it malicious reconnaissance behavior. 

Additionally, CISA and the FBI observed this actor attempting to exploit websites to obtain copies of voter registration data between September 29 and October 17, 2020 (Exploit Public-Facing Application [T1190]). This includes attempted exploitation of known vulnerabilities, directory traversal, Structured Query Language (SQL) injection, web shell uploads, and leveraging unique flaws in websites. 

CISA and the FBI can confirm that the actor successfully obtained voter registration data in at least one state. The access of voter registration data appeared to involve the abuse of website misconfigurations and a scripted process using the cURL tool to iterate through voter records. A review of the records that were copied and obtained reveals the information was used in the propaganda video. 

CISA and FBI analysis of identified activity against state websites, including state election websites, referenced in this product cannot all be fully attributed to this Iranian APT actor. FBI analysis of the Iranian APT actor’s activity has identified targeting of U.S. elections’ infrastructure (Compromise Infrastructure [T1584]) within a similar timeframe, use of IP addresses and IP ranges – including numerous virtual private network (VPN) service exit nodes – which correlate to this Iran APT actor (Gather Victim Host Information [T1592)]), and other investigative information. 

Reconnaissance

The FBI has information indicating this Iran-based actor attempted to access PDF documents from state voter sites using advanced open-source queries (Search Open Websites and Domains [T1539]). The actor demonstrated interest in PDFs hosted on URLs with the words “vote” or “voter” and “registration.” The FBI identified queries of URLs for election-related sites. 

The FBI also has information indicating the actor researched  the following information in a suspected attempt to further their efforts to survey and exploit state election websites.

• YOURLS exploit
• Bypassing ModSecurity Web Application Firewall
• Detecting Web Application Firewalls
• SQLmap tool

Acunetix Scanning

CISA’s analysis identified the scanning of multiple entities by the Acunetix Web Vulnerability scanning platform between September 20 and September 28, 2020 (Active Scanning: Vulnerability Scanning [T1595.002]). 

The actor used the scanner to attempt SQL injection into various fields in /registration/registration/details with status codes 404 or 500:

/registration/registration/details?addresscity=-1 or 3*2<(0+5+513-513) -- &addressstreet1=xxxxx&btnbeginregistration=begin voter registration&btnnextelectionworkerinfo=next&btnnextpersonalinfo=next&btnnextresdetails=next&btnnextvoterinformation=next&btnsubmit=submit&chkageverno=on&chkageveryes=on&chkcitizenno=on&chkcitizenyes=on&chkdisabledvoter=on&chkelectionworker=on&chkresprivate=1&chkstatecancel=on&dlnumber=1&dob=xxxx/x/x&email=sample@email.tst&firstname=xxxxx&gender=radio&hdnaddresscity=&hdngender=&last4ssn=xxxxx&lastname=xxxxxinjjeuee&mailaddresscountry=sample@xxx.xxx&mailaddressline1=sample@email.tst&mailaddressline2=sample@xxx.xxx&mailaddressline3=sample@xxx.xxx&mailaddressstate=aa&mailaddresszip=sample@xxxx.xxx&mailaddresszipex=sample@xxx.xxx&middlename=xxxxx&overseas=1&partycode=a&phoneno1=xxx-xxx-xxxx&phoneno2=xxx-xxx-xxxx&radio=consent&statecancelcity=xxxxxxx&statecancelcountry=usa&statecancelstate=XXaa&statecancelzip=xxxxx&statecancelzipext=xxxxx&suffixname=esq&txtmailaddresscity=sample@xxx.xxx

Requests

The actor used the following requests associated with this scanning activity.

2020-09-26 13:12:56 x.x.x.x GET /x/x v[$acunetix]=1 443 - x.x.x.x Mozilla/5.0+(Windows+NT+6.1;+WOW64)+AppleWebKit/537.21+(KHTML,+like+Gecko)+Chrome/41.0.2228.0+Safari/537.21 - 200 0 0 0

2020-09-26 13:13:19 X.X.x.x GET /x/x voterid[$acunetix]=1 443 - x.x.x.x Mozilla/5.0+(Windows+NT+6.1;+WOW64)+AppleWebKit/537.21+(KHTML,+like+Gecko)+Chrome/41.0.2228.0+Safari/537.21 - 200 0 0 1375

2020-09-26 13:13:18 .X.x.x GET /x/x voterid=;print(md5(acunetix_wvs_security_test)); 443 - X.X.x.x 

User Agents Observed

CISA and FBI have observed the following user agents associated with this scanning activity.

Mozilla/5.0+(Windows+NT+6.1;+WOW64)+AppleWebKit/537.21+(KHTML,+like+Gecko)+Chrome/41.0.2228.0+Safari/537.21 - 500 0 0 0 

Mozilla/5.0+(X11;+U;+Linux+x86_64;+en-US;+rv:1.9b4)+Gecko/2008031318+Firefox/3.0b4 

Mozilla/5.0+(X11;+U;+Linux+i686;+en-US;+rv:1.8.1.17)+Gecko/20080922+Ubuntu/7.10+(gutsy)+Firefox/2.0.0.17

Exfiltration Obtaining Voter Registration Data

Following the review of web server access logs, CISA analysts, in coordination with the FBI, found instances of the cURL and FDM User Agents sending GET requests to a web resource associated with voter registration data. The activity occurred between September 29 and October 17, 2020. Suspected scripted activity submitted several hundred thousand queries iterating through voter identification values, and retrieving results with varying levels of success [Gather Victim Identity Information (T1589)]. A sample of the records identified by the FBI reveals they match information in the aforementioned propaganda video.
Requests

The actor used the following requests.

2020-10-17 13:07:51 x.x.x.x GET /x/x voterid=XXXX1 443 - x.x.x.x curl/7.55.1 - 200 0 0 1406

2020-10-17 13:07:55 x.x.x.x GET /x/x voterid=XXXX2 443 - x.x.x.x curl/7.55.1 - 200 0 0 1390

2020-10-17 13:07:58 x.x.x.x GET /x/x voterid=XXXX3 443 - x.x.x.x curl/7.55.1 - 200 0 0 1625

2020-10-17 13:08:00 x.x.x.x GET /x/x voterid=XXXX4 443 - x.x.x.x curl/7.55.1 - 200 0 0 1390

Note: incrementing voterid values in cs_uri_query field

User Agents

CISA and FBI have observed the following user agents.

FDM+3.x

curl/7.55.1

Mozilla/5.0+(Windows+NT+6.1;+WOW64)+AppleWebKit/537.21+(KHTML,+like+Gecko)+Chrome/41.0.2228.0+Safari/537.21 - 500 0 0 0 
Mozilla/5.0+(X11;+U;+Linux+x86_64;+en-US;+rv:1.9b4)+Gecko/2008031318+Firefox/3.0b4

See figure 1 below for a timeline of the actor’s malicious activity.

Figure 1: Overview of malicious activity

MitigationsDetection Acunetix Scanning

Organizations can identify Acunetix scanning activity by using the following keywords while performing log analysis.

• $acunetix
• acunetix_wvs_security_test

Indicators of Compromise

For a downloadable copy of IOCs, see AA20-304A.stix.

Disclaimer: Many of the IP addresses included below likely correspond to publicly available VPN services, which can be used by individuals all over the world. Although this creates the potential for false positives, any activity listed should warrant further investigation. The actor likely uses various IP addresses and VPN services.

The following IPs have been associated with this activity.

• 102.129.239[.]185 (Acunetix Scanning)
• 143.244.38[.]60 (Acunetix Scanning and cURL requests)
• 45.139.49[.]228 (Acunetix Scanning)
• 156.146.54[.]90 (Acunetix Scanning)
• 109.202.111[.]236 (cURL requests)
• 185.77.248[.]17 (cURL requests)
• 217.138.211[.]249 (cURL requests)
• 217.146.82[.]207 (cURL requests)
• 37.235.103[.]85 (cURL requests)
• 37.235.98[.]64 (cURL requests)
• 70.32.5[.]96 (cURL requests)
• 70.32.6[.]20 (cURL requests)
• 70.32.6[.]8 (cURL requests)
• 70.32.6[.]97 (cURL requests)
• 70.32.6[.]98 (cURL requests)
• 77.243.191[.]21 (cURL requests and FDM+3.x (Free Download Manager v3) enumeration/iteration)
• 92.223.89[.]73 (cURL requests)

CISA and the FBI are aware the following IOCs have been used by this Iran-based actor. These IP addresses facilitated the mass dissemination of voter intimidation email messages on October 20, 2020.

• 195.181.170[.]244 (Observed September 30 and October 20, 2020)
• 102.129.239[.]185 (Observed September 30, 2020)
• 104.206.13[.]27 (Observed September 30, 2020)
• 154.16.93[.]125 (Observed September 30, 2020)
• 185.191.207[.]169 (Observed September 30, 2020)
• 185.191.207[.]52 (Observed September 30, 2020)
• 194.127.172[.]98 (Observed September 30, 2020)
• 194.35.233[.]83 (Observed September 30, 2020)
• 198.147.23[.]147 (Observed September 30, 2020)
• 198.16.66[.]139(Observed September 30, 2020)
• 212.102.45[.]3 (Observed September 30, 2020)
• 212.102.45[.]58 (Observed September 30, 2020)
• 31.168.98[.]73 (Observed September 30, 2020)
• 37.120.204[.]156 (Observed September 30, 2020)
• 5.160.253[.]50 (Observed September 30, 2020)
• 5.253.204[.]74 (Observed September 30, 2020)
• 64.44.81[.]68 (Observed September 30, 2020)
• 84.17.45[.]218 (Observed September 30, 2020)
• 89.187.182[.]106 (Observed September 30, 2020)
• 89.187.182[.]111 (Observed September 30, 2020)
• 89.34.98[.]114 (Observed September 30, 2020)
• 89.44.201[.]211 (Observed September 30, 2020)

Recommendations

The following list provides recommended self-protection mitigation strategies against cyber techniques used by advanced persistent threat actors: 

• Validate input as a method of sanitizing untrusted input submitted by web application users. Validating input can significantly reduce the probability of successful exploitation by providing protection against security flaws in web applications. The types of attacks possibly prevented include SQL injection, Cross Site Scripting (XSS), and command injection.
• Audit your network for systems using Remote Desktop Protocol (RDP) and other internet-facing services. Disable unnecessary services and install available patches for the services in use. Users may need to work with their technology vendors to confirm that patches will not affect system processes.
• Verify all cloud-based virtual machine instances with a public IP, and avoid using open RDP ports, unless there is a valid need. Place any system with an open RDP port behind a firewall and require users to use a VPN to access it through the firewall.
• Enable strong password requirements and account lockout policies to defend against brute-force attacks.
• Apply multi-factor authentication, when possible.
• Maintain a good information back-up strategy by routinely backing up all critical data and system configuration information on a separate device. Store the backups offline, verify their integrity, and verify the restoration process.
• Enable logging and ensure logging mechanisms capture RDP logins. Keep logs for a minimum of 90 days and review them regularly to detect intrusion attempts.
• When creating cloud-based virtual machines, adhere to the cloud provider's best practices for remote access.
• Ensure third parties that require RDP access follow internal remote access policies.
• Minimize network exposure for all control system devices. Where possible, critical devices should not have RDP enabled.
• Regulate and limit external to internal RDP connections. When external access to internal resources is required, use secure methods, such as a VPNs. However, recognize the security of VPNs matches the security of the connected devices.
• Use security features provided by social media platforms; use strong passwords, change passwords frequently, and use a different password for each social media account. 
• See CISA’s Tip on Best Practices for Securing Election Systems for more information. 

General Mitigations

Keep applications and systems updated and patched

Apply all available software updates and patches and automate this process to the greatest extent possible (e.g., by using an update service provided directly from the vendor). Automating updates and patches is critical because of the speed of threat actors to create new exploits following the release of  a patch. These “N-day” exploits can be as damaging as zero-day exploits. Ensure the authenticity and integrity of vendor updates by using signed updates delivered over protected links. Without the rapid and thorough application of patches, threat actors can operate inside a defender’s patch cycle. NSA "NSA'S Top Ten Cybersecurity Mitigation Strategies" https://www.nsa.gov/Portals/70/documents/what-we-do/cybersecurity/professional-resources/csi-nsas-top10-cybersecurity-mitigation-strategies.pdf Additionally, use tools (e.g., the OWASP Dependency-Check Project tool https://owasp.org/www-project-dependency-check/) to identify the publicly known vulnerabilities in third-party libraries depended upon by the application.

Scan web applications for SQL injection and other common web vulnerabilities

Implement a plan to scan public-facing web servers for common web vulnerabilities (e.g., SQL injection, cross-site scripting) by using a commercial web application vulnerability scanner in combination with a source code scanner. https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/defending-against-the-exploitation-of-sql-vulnerabilities-to.cfm Fixing or patching vulnerabilities after they are identified is especially crucial for networks hosting older web applications. As sites get older, more vulnerabilities are discovered and exposed.

Deploy a web application firewall  

Deploy a web application firewall (WAF) to prevent invalid input attacks and other attacks destined for the web application. WAFs are intrusion/detection/prevention devices that inspect each web request made to and from the web application to determine if the request is malicious. Some WAFs install on the host system and others are dedicated devices that sit in front of the web application. WAFs also weaken the effectiveness of automated web vulnerability scanning tools. 

Deploy techniques to protect against web shells

Patch web application vulnerabilities or fix configuration weaknesses that allow web shell attacks, and follow guidance on detecting and preventing web shell malware. NSA & ASD "CyberSecurity Information: Detect and Prevent Web Shell Malware" https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF Malicious cyber actors often deploy web shells—software that can enable remote administration—on a victim’s web server. Malicious cyber actors can use web shells to execute arbitrary system commands commonly sent over HTTP or HTTPS. Attackers often create web shells by adding or modifying a file in an existing web application. Web shells provide attackers with persistent access to a compromised network using communications channels disguised to blend in with legitimate traffic. Web shell malware is a long-standing, pervasive threat that continues to evade many security tools. 

Use multi-factor authentication for administrator accounts

Prioritize protection for accounts with elevated privileges, remote access, or used on high-value assets. https://us-cert.cisa.gov/cdm/event/Identifying-and-Protecting-High-Value-Assets-Closer-Look-Governance-Needs-HVAs Use physical token-based authentication systems to supplement knowledge-based factors such as passwords and personal identification numbers (PINs). NSA "NSA'S Top Ten Cybersecurity Mitigation Strategies" https://www.nsa.gov/Portals/70/documents/what-we-do/cybersecurity/professional-resources/csi-nsas-top10-cybersecurity-mitigation-strategies.pdf Organizations should migrate away from single-factor authentication, such as password-based systems, which are subject to poor user choices and more susceptible to credential theft, forgery, and password reuse across multiple systems.

Remediate critical web application security risks

First, identify and remediate critical web application security risks. Next, move on to other less critical vulnerabilities. Follow available guidance on securing web applications. NSA “Building Web Applications – Security for Developers” https://apps.nsa.gov/iaarchive/library/ia-guidance/security-tips/building-web-applications-security-recommendations-for.cfm https://owasp.org/www-project-top-ten/ https://cwe.mitre.org/top25/archive/2020/2020_cwe_top25.html

How do I respond to unauthorized access to election-related systems? Implement your security incident response and business continuity plan

It may take time for your organization’s IT professionals to isolate and remove threats to your systems and restore normal operations. In the meantime, take steps to maintain your organization’s essential functions according to your business continuity plan. Organizations should maintain and regularly test backup plans, disaster recovery plans, and business continuity procedures.

Contact CISA or law enforcement immediately 

To report an intrusion and to request incident response resources or technical assistance, contact CISA (Central@cisa.gov or 888-282-0870) or the FBI through a local field office or the FBI’s Cyber Division (CyWatch@ic.fbi.gov or 855-292-3937).

Resources

• CISA Tip: Best Practices for Securing Election Systems
• CISA Tip: Securing Voter Registration Data 
• CISA Tip: Website Security 
• CISA Tip: Avoiding Social Engineering and Phishing Attacks
• CISA Tip: Securing Network Infrastructure Devices 
• Joint Advisory: Technical Approaches to Uncovering and Remediating Malicious Activity
• CISA Insights: Actions to Counter Email-Based Attacks on Election-related Entities 
• FBI and CISA Public Service Announcement (PSA): Spoofed Internet Domains and Email Accounts Pose Cyber and Disinformation Risks to Voters
• FBI and CISA PSA: Foreign Actors Likely to Use Online Journals to Spread Disinformation Regarding 2020 Elections 
• FBI and CISA PSA: Distributed Denial of Service Attacks Could Hinder Access to Voting Information, Would Not Prevent Voting 
• FBI and CISA PSA: False Claims of Hacked Voter Information Likely Intended to Cast Doubt on Legitimacy of U.S. Elections
• FBI and CISA PSA: Cyber Threats to Voting Processes Could Slow But Not Prevent Voting 
• FBI and CISA PSA: Foreign Actors and Cybercriminals Likely to Spread Disinformation Regarding 2020 Election Result

 

Revisions

• October 30, 2020: Initial Version

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: October 28, 2020
Summary

This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) version 7 framework. See the ATT&CK for Enterprise version 7 for all referenced threat actor tactics and techniques.

This joint cybersecurity advisory was coauthored by the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Department of Health and Human Services (HHS). This advisory describes the tactics, techniques, and procedures (TTPs) used by cybercriminals against targets in the Healthcare and Public Health Sector (HPH) to infect systems with Ryuk ransomware for financial gain.

CISA, FBI, and HHS have credible information of an increased and imminent cybercrime threat to U.S. hospitals and healthcare providers. CISA, FBI, and HHS are sharing this information to provide warning to healthcare providers to ensure that they take timely and reasonable precautions to protect their networks from these threats.

Click here for a PDF version of this report.

Key Findings

• CISA, FBI, and HHS assess malicious cyber actors are targeting the HPH Sector with Trickbot malware, often leading to ransomware attacks, data theft, and the disruption of healthcare services.
• These issues will be particularly challenging for organizations within the COVID-19 pandemic; therefore, administrators will need to balance this risk when determining their cybersecurity investments.

Technical DetailsThreat Details

Since 2016, the cybercriminal enterprise behind Trickbot malware has continued to develop new functionality and tools increasing the ease, speed, and profitability of victimization. What began as a banking trojan and descendant of Dyre malware, now provides its operators a full suite of tools to conduct a myriad of illegal cyber activities. These activities include credential harvesting, mail exfiltration, cryptomining, point-of-sale data exfiltration, and the deployment of ransomware, such as Ryuk. In early 2019, the FBI began to observe new Trickbot modules named Anchor, which cyber actors typically used in attacks targeting high-profile victims—such as large corporations. These attacks often involved data exfiltration from networks and point-of-sale devices. As part of the new Anchor toolset, Trickbot developers created Anchor_DNS, a tool for sending and receiving data from victim machines using Domain Name System (DNS) tunneling.

Anchor_DNS is a backdoor that allows victim machines to communicate with command and control (C2) servers over DNS to evade typical network defense products and make their malicious communications blend in with legitimate DNS traffic. Anchor_DNS uses a single-byte XOR cipher to encrypt its communications, which have been observed using key 0xB9. Once decrypted, the string Anchor_DNS can be found in the DNS request traffic.

Trickbot Indicators of Compromise

After successful execution of the malware, Trickbot copies itself as an executable file with a 12-character (includes .exe), randomly generated file name (e.g. mfjdieks.exe) and places this file in one of the following directories.

• C:\Windows\
• C:\Windows\SysWOW64\
• C:\Users\[Username]\AppData\Roaming\

The malware may also drop a file named anchorDiag.txt in one of the directories listed above.

Prior to initiating communications with the C2 server, the malware uses an infection marker of Global\fde345tyhoVGYHUJKIOuy, typically found in the running memory of the victim machine.

Part of the initial network communications with the C2 server involves sending information about the victim machine such as its computer name/hostname, operating system version, and build via a base64-encoded GUID. The GUID is composed of /GroupID/ClientID/ with the following naming convention:

/anchor_dns/[COMPUTERNAME]_[WindowsVersionBuildNo].[32CharacterString]/.

The malware uses scheduled tasks that run every 15 minutes to ensure persistence on the victim machine. The scheduled task typically uses the following naming convention.

[random_folder_name_in_%APPDATA%_excluding_Microsoft]

autoupdate#[5_random_numbers] (e.g., Task autoupdate#16876).

After successful execution, Anchor_DNS further deploys malicious batch scripts (.bat) using PowerShell commands.

The malware deploys self-deletion techniques by executing the following commands.

• cmd.exe /c timeout 3 && del C:\Users\[username]\[malware_sample]
• cmd.exe /C PowerShell \"Start-Sleep 3; Remove-Item C:\Users\[username]\[malware_sample_location]\"

The following domains found in outbound DNS records are associated with Anchor_DNS.

• kostunivo[.]com
• chishir[.]com
• mangoclone[.]com
• onixcellent[.]com

This malware used the following legitimate domains to test internet connectivity.

• ipecho[.]net
• api[.]ipify[.]org
• checkip[.]amazonaws[.]com
• ip[.]anysrc[.]net
• wtfismyip[.]com
• ipinfo[.]io
• icanhazip[.]com
• myexternalip[.]com

The Anchor_DNS malware historically used the following C2 servers.

• 23[.]95[.]97[.]59
• 51[.]254[.]25[.]115
• 193[.]183[.]98[.]66
• 91[.]217[.]137[.]37
• 87[.]98[.]175[.]85

Ryuk Ransomware

Typically Ryuk has been deployed as a payload from banking Trojans such as Trickbot. (See the United Kingdom (UK) National Cyber Security Centre (NCSC) advisory, Ryuk Ransomware Targeting Organisations Globally, on their ongoing investigation into global Ryuk ransomware campaigns and associated Emotet and TrickBot malware.) Ryuk first appeared in August 2018 as a derivative of Hermes 2.1 ransomware, which first emerged in late 2017 and was available for sale on the open market as of August 2018. Ryuk still retains some aspects of the Hermes code. For example, all of the files encrypted by Ryuk contain the HERMES tag but, in some infections, the files have .ryuk added to the filename, while others do not. In other parts of the ransomware code, Ryuk has removed or replaced features of Hermes, such as the restriction against targeting specific Eurasia-based systems.

While negotiating the victim network, Ryuk actors will commonly use commercial off-the-shelf products—such as Cobalt Strike and PowerShell Empire—in order to steal credentials. Both frameworks are very robust and are highly effective dual-purpose tools, allowing actors to dump clear text passwords or hash values from memory with the use of Mimikatz. This allows the actors to inject malicious dynamic-link library into memory with read, write, and execute permissions. In order to maintain persistence in the victim environment, Ryuk actors have been known to use scheduled tasks and service creation.

Ryuk actors will quickly map the network in order to enumerate the environment to understand the scope of the infection. In order to limit suspicious activity and possible detection, the actors choose to live off the land and, if possible, use native tools—such as net view, net computers, and ping—to locate mapped network shares, domain controllers, and active directory. In order to move laterally throughout the network, the group relies on native tools, such as PowerShell, Windows Management Instrumentation (WMI), Windows Remote Management , and Remote Desktop Protocol (RDP). The group also uses third-party tools, such as Bloodhound.

Once dropped, Ryuk uses AES-256 to encrypt files and an RSA public key to encrypt the AES key. The Ryuk dropper drops a .bat file that attempts to delete all backup files and Volume Shadow Copies (automatic backup snapshots made by Windows), preventing the victim from recovering encrypted files without the decryption program.

In addition, the attackers will attempt to shut down or uninstall security applications on the victim systems that might prevent the ransomware from executing. Normally this is done via a script, but if that fails, the attackers are capable of manually removing the applications that could stop the attack. The RyukReadMe file placed on the system after encryption provides either one or two email  addresses, using the end-to-end encrypted email provider Protonmail, through which the victim can contact the attacker(s). While earlier versions provide a ransom amount in the initial notifications, Ryuk users are now designating a ransom amount only after the victim makes contact.

The victim is told how much to pay to a specified Bitcoin wallet for the decryptor and is provided a sample decryption of two files.

Initial testing indicates that the RyukReadMe file does not need to be present for the decryption script to run successfully but other reporting advises some files will not decrypt properly without it. Even if run correctly, there is no guarantee the decryptor will be effective. This is further complicated because the RyukReadMe file is deleted when the script is finished. This may affect the decryption script unless it is saved and stored in a different location before running.

According to MITRE, Ryuk uses the ATT&CK techniques listed in table 1.

Table 1: Ryuk ATT&CK techniques

Technique Use System Network Configuration Discovery [T1016] Ryuk has called GetIpNetTable in attempt to identify all mounted drives and hosts that have Address Resolution Protocol entries. 

Masquerading: Match Legitimate Name or Location [T1036.005]

Ryuk has constructed legitimate appearing installation folder paths by calling GetWindowsDirectoryW and then inserting a null byte at the fourth character of the path. For Windows Vista or higher, the path would appear as C:\Users\Public.  Process Injection [T1055] Ryuk has injected itself into remote processes to encrypt files using a combination of VirtualAlloc, WriteProcessMemory, and CreateRemoteThread.  Process Discovery [T1057] Ryuk has called CreateToolhelp32Snapshot to enumerate all running processes.  Command and Scripting Interpreter: Windows Command Shell [T1059.003] Ryuk has used cmd.exe to create a Registry entry to establish persistence.  File and Directory Discovery [T1083] Ryuk has called GetLogicalDrives to enumerate all mounted drives, and GetDriveTypeW to determine the drive type. Native API [T1106] Ryuk has used multiple native APIs including ShellExecuteW to run executables; GetWindowsDirectoryW to create folders; and VirtualAlloc, WriteProcessMemory, and CreateRemoteThread for process injection.  Access Token Manipulation [T1134] Ryuk has attempted to adjust its token privileges to have the SeDebugPrivilege.  Data Encrypted for Impact [T1486] Ryuk has used a combination of symmetric and asymmetric encryption to encrypt files. Files have been encrypted with their own AES key and given a file extension of .RYK. Encrypted directories have had a ransom note of RyukReadMe.txt written to the directory.  Service Stop [T1489] Ryuk has called kill.bat for stopping services, disabling services and killing processes.  Inhibit System Recovery [T1490] Ryuk has used vssadmin Delete Shadows /all /quiet to delete volume shadow copies and vssadmin resize shadowstorage to force deletion of shadow copies created by third-party applications.  Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder [T1047.001] Ryuk has used the Windows command line to create a Registry entry under HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence. Impair Defenses: Disable or Modify Tools [T1562.001] Ryuk has stopped services related to anti-virus. Mitigations

For a downloadable copy of IOCs, see AA20-302A.stix.

Plans and Policies

CISA, FBI, and HHS encourage HPH Sector organizations to maintain business continuity plans—the practice of executing essential functions through emergencies (e.g., cyberattacks)—to minimize service interruptions. Without planning, provision, and implementation of continuity principles, organizations may be unable to continue operations. Evaluating continuity and capability will help identify continuity gaps. Through identifying and addressing these gaps, organizations can establish a viable continuity program that will help keep them functioning during cyberattacks or other emergencies. CISA, FBI, and HHS suggest HPH Sector organizations review or establish patching plans, security policies, user agreements, and business continuity plans to ensure they address current threats posed by malicious cyber actors.

Network Best Practices

• Patch operating systems, software, and firmware as soon as manufacturers release updates.
• Check configurations for every operating system version for HPH organization-owned assets to prevent issues from arising that local users are unable to fix due to having local administration disabled.
• Regularly change passwords to network systems and accounts and avoid reusing passwords for different accounts.
• Use multi-factor authentication where possible.
• Disable unused remote access/Remote Desktop Protocol (RDP) ports and monitor remote access/RDP logs.
• Implement application and remote access allow listing to only allow systems to execute programs known and permitted by the established security policy.
• Audit user accounts with administrative privileges and configure access controls with least privilege in mind.
• Audit logs to ensure new accounts are legitimate.
• Scan for open or listening ports and mediate those that are not needed.
• Identify critical assets such as patient database servers, medical records, and teleheatlh and telework infrastructure; create backups of these systems and house the backups offline from the network.
• Implement network segmentation. Sensitive data should not reside on the same server and network segment as the email environment.
• Set antivirus and anti-malware solutions to automatically update; conduct regular scans.

Ransomware Best Practices

CISA, FBI and HHS do not recommend paying ransoms. Payment does not guarantee files will be recovered. It may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. In addition to implementing the above network best practices, the FBI, CISA and HHS also recommend the following:

• Regularly back up data, air gap, and password protect backup copies offline.
• Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, secure location.

User Awareness Best Practices

• Focus on awareness and training. Because end users are targeted, make employees and stakeholders aware of the threats—such as ransomware and phishing scams—and how they are delivered. Additionally, provide users training on information security principles and techniques as well as overall emerging cybersecurity risks and vulnerabilities.
• Ensure that employees know who to contact when they see suspicious activity or when they believe they have been a victim of a cyberattack. This will ensure that the proper established mitigation strategy can be employed quickly and efficiently.

Recommended Mitigation Measures

System administrators who have indicators of a Trickbot network compromise should immediately take steps to back up and secure sensitive or proprietary data. Trickbot infections may be indicators of an imminent ransomware attack; system administrators should take steps to secure network devices accordingly. Upon evidence of a Trickbot infection, review DNS logs and use the XOR key of 0xB9 to decode XOR encoded DNS requests to reveal the presence of Anchor_DNS, and maintain and provide relevant logs.

GENERAL RANSOMWARE MITIGATIONS — HPH SECTOR

This section is based on CISA and Multi-State Information Sharing and Analysis Center (MS-ISAC)'s Joint Ransomware Guide, which can be found at https://www.cisa.gov/publication/ransomware-guide.

CISA, FBI, and HHS recommend that healthcare organizations implement both ransomware prevention and ransomware response measures immediately.

Ransomware Prevention Join and Engage with Cybersecurity Organizations

CISA, FBI, and HHS recommend that healthcare organizations take the following initial steps:

• Join a healthcare information sharing organization, H-ISAC:
  • Health Information Sharing and Analysis Center (H-ISAC): https://h-isac.org/membership-account/join-h-isac/
  • Sector-based ISACs - National Council of ISACs: https://www.nationalisacs.org/member-isacs
  • Information Sharing and Analysis Organization (ISAO) Standards Organization: https://www.isao.org/information-sharing-groups/
• Engage with CISA and FBI, as well as HHS—through the HHS Health Sector Cybersecurity Coordination Center (HC3)—to build a lasting partnership and collaborate on information sharing, best practices, assessments, and exercises.
  • CISA: cisa.gov, https://us-cert.cisa.gov/mailing-lists-and-feeds, central@cisa.gov  
  • FBI: ic3.gov, www.fbi.gov/contact-us/field, CyWatch@fbi.gov
  • HHS/HC3: http://www.hhs.gov/hc3, HC3@HHS.gov

Engaging with the H-ISAC, ISAO, CISA, FBI, and HHS/HC3 will enable your organization to receive critical information and access to services to better manage the risk posed by ransomware and other cyber threats.

Follow Ransomware Best Practices

Refer to the best practices and references below to help manage the risk posed by ransomware and support your organization’s coordinated and efficient response to a ransomware incident. Apply these practices to the greatest extent possible based on availability of organizational resources.

• It is critical to maintain offline, encrypted backups of data and to regularly test your backups. Backup procedures should be conducted on a regular basis. It is important that backups be maintained offline or in separated networks as many ransomware variants attempt to find and delete any accessible backups. Maintaining offline, current backups is most critical because there is no need to pay a ransom for data that is readily accessible to your organization.
  • Use the 3-2-1 rule as a guideline for backup practices. The rule states that three copies of all critical data are retained on at least two different types of media and at least one of them is stored offline.
  • Maintain regularly updated “gold images” of critical systems in the event they need to be rebuilt. This entails maintaining image “templates” that include a preconfigured operating system (OS) and associated software applications that can be quickly deployed to rebuild a system, such as a virtual machine or server.
  • Retain backup hardware to rebuild systems in the event rebuilding the primary system is not preferred.
    • Hardware that is newer or older than the primary system can present installation or compatibility hurdles when rebuilding from images.
    • Ensure all backup hardware is properly patched.
• In addition to system images, applicable source code or executables should be available (stored with backups, escrowed, license agreement to obtain, etc.). It is more efficient to rebuild from system images, but some images will not install on different hardware or platforms correctly; having separate access to needed software will help in these cases.
• Create, maintain, and exercise a basic cyber incident response plan and associated communications plan that includes response and notification procedures for a ransomware incident.
  • Review available incident response guidance, such as CISA’s Technical Approaches to Uncovering and Remediating Malicious Activity https://us-cert.cisa.gov/ncas/alerts/aa20-245a.
• Help your organization better organize around cyber incident response.
• Develop a cyber incident response plan.
• The Ransomware Response Checklist, available in the CISA and MS-ISAC Joint Ransomware Guide, serves as an adaptable, ransomware- specific annex to organizational cyber incident response or disruption plans.
• Review and implement as applicable MITRE’s Medical Device Cybersecurity: Regional Incident Preparedness and Response Playbook (https://www.mitre.org/sites/default/files/publications/pr-18-1550-Medical-Device-Cybersecurity-Playbook.pdf).
• Develop a risk management plan that maps critical health services and care to the necessary information systems; this will ensure that the incident response plan will contain the proper triage procedures.
• Plan for the possibility of critical information systems being inaccessible for an extended period of time. This should include but not be limited to the following:
  • Print and properly store/protect hard copies of digital information that would be required for critical patient healthcare.
  • Plan for and periodically train staff to handle the re-routing of incoming/existing patients in an expedient manner if information systems were to abruptly and unexpectedly become unavailable.
  • Coordinate the potential for surge support with other healthcare facilities in the greater local area. This should include organizational leadership periodically meeting and collaborating with counterparts in the greater local area to create/update plans for their facilities to both abruptly send and receive a significant amount of critical patients for immediate care. This may include the opportunity to re-route healthcare employees (and possibly some equipment) to provide care along with additional patients.
• Consider the development of a second, air-gapped communications network that can provide a minimum standard of backup support for hospital operations if the primary network becomes unavailable if/when needed.
• Predefine network segments, IT capabilities and other functionality that can either be quickly separated from the greater network or shut down entirely without impacting operations of the rest of the IT infrastructure.
• Legacy devices should be identified and inventoried with highest priority and given special consideration during a ransomware event.
• See CISA and MS-ISAC's Joint Ransomware Guide for infection vectors including internet-facing vulnerabilities and misconfigurations; phishing; precursor malware infection; and third parties and managed service providers.
• HHS/HC3 tracks ransomware that is targeting the HPH Sector; this information can be found at http://www.hhs.gov/hc3.

Hardening Guidance

• The Food and Drug Administration provides multiple guidance documents regarding the hardening of healthcare and specifically medical devices found here: https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity.
• See CISA and MS-ISAC's Joint Ransomware Guide for additional in-depth hardening guidance.

Contact CISA for These No-Cost Resources

• Information sharing with CISA and MS-ISAC (for SLTT organizations) includes bi-directional sharing of best practices and network defense information regarding ransomware trends and variants as well as malware that is a precursor to ransomware.
• Policy-oriented or technical assessments help organizations understand how they can improve their defenses to avoid ransomware infection: https://www.cisa.gov/cyber-resource-hub.
  • Assessments include Vulnerability Scanning and Phishing Campaign Assessment.
• Cyber exercises evaluate or help develop a cyber incident response plan in the context of a ransomware incident scenario.
• CISA Cybersecurity Advisors (CSAs) advise on best practices and connect you with CISA resources to manage cyber risk.
• Contacts:
  • SLTT organizations: CyberLiaison_SLTT@cisa.dhs.gov
  • Private sector organizations: CyberLiaison_Industry@cisa.dhs.gov

Ransomware Quick References

• Ransomware: What It Is and What to Do About It (CISA): General ransomware guidance for organizational leadership and more in-depth information for CISOs and technical staff: https://www.us-cert.cisa.gov/sites/default/files/publications/Ransomware_Executive_One-Pager_and_Technical_ Document-FINAL.pdf
• Ransomware (CISA): Introduction to ransomware, notable links to CISA products on protecting networks, specific ransomware threats, and other resources: https://www.us-cert.cisa.gov/Ransomware  
• HHS/HC3: Ransomware that impacts HPH is tracked by the HC3 and can be found at www.hhs.gov/hc3
• Security Primer – Ransomware (MS-ISAC): Outlines opportunistic and strategic ransomware campaigns, common infection vectors, and best practice recommendations: https://www.cisecurity.org/white-papers/security-primer-ransomware/
• Ransomware: Facts, Threats, and Countermeasures (MS- ISAC): Facts about ransomware, infection vectors, ransomware capabilities, and how to mitigate the risk of ransomware infection: https://www.cisecurity.org/blog/ransomware- facts-threats-and-countermeasures/
• HHS Ransomware Fact Sheet: https://www.hhs.gov/sites/default/files/RansomwareFactSheet.pdf
• NIST Securing Data Integrity White Paper: https://csrc.nist.gov/publications/detail/white-paper/2020/10/01/securing-data-integrity-against-ransomware-attacks/draft

Ransomware Response Checklist

Remember: Paying the ransom will not ensure your data is decrypted or that your systems or data will no longer be compromised. CISA, FBI, and HHS do not recommend paying ransom.

Should your organization be a victim of ransomware, CISA strongly recommends responding by using the Ransomware Response Checklist located in CISA and MS-ISAC's Joint Ransomware Guide, which contains steps for detection and analysis as well as containment and eradication.

Consider the Need For Extended Identification or Analysis

• If extended identification or analysis is needed, CISA, HHS/HC3, or federal law enforcement may be interested in any of the following information that your organization determines it can legally share:
• Recovered executable file
• Copies of the readme file – DO NOT REMOVE the file or decryption may not be possible
• Live memory (RAM) capture from systems with additional signs of compromise (use of exploit toolkits, RDP activity, additional files found locally)
• Images of infected systems with additional signs of compromise (use of exploit toolkits, RDP activity, additional files found locally)
• Malware samples
• Names of any other malware identified on your system
• Encrypted file samples
• Log files (Windows Event Logs from compromised systems, Firewall logs, etc.)
• Any PowerShell scripts found having executed on the systems
• Any user accounts created in Active Directory or machines added to the network during the exploitation
• Email addresses used by the attackers and any associated phishing emails
• A copy of the ransom note
• Ransom amount and whether or not the ransom was paid
• Bitcoin wallets used by the attackers
• Bitcoin wallets used to pay the ransom (if applicable)
• Copies of any communications with attackers

Upon voluntary request, CISA can assist with analysis (e.g., phishing emails, storage media, logs, malware) at no cost to support your organization in understanding the root cause of an incident, even in the event additional remote assistance is not requested.

• CISA – Advanced Malware Analysis Center: https://www.malware.us-cert.gov/MalwareSubmission/pages/submission.jsf
• Remote Assistance – Request via Central@cisa.gov

Contact Information

CISA, FBI, and HHS recommend identifying and having on hand the following contact information for ready use should your organization become a victim of a ransomware incident. Consider contacting these organizations for mitigation and response assistance or for purpose of notification.

• State and Local Response Contacts
• IT/IT Security Team – Centralized Cyber Incident Reporting
• State and Local Law Enforcement
• Fusion Center        
• Managed/Security Service Providers
• Cyber Insurance       

To report suspicious or criminal activity related to information found in this Joint Cybersecurity Advisory, contact your local FBI field office at www.fbi.gov/contact-us/field, or the FBI’s 24/7 Cyber Watch (CyWatch) at (855) 292-3937 or by email at CyWatch@fbi.gov. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact. To request incident response resources or technical assistance related to these threats, contact CISA at Central@cisa.gov.

Additionally, see the CISA and MS-ISAC's Joint Ransomware Guide for information on contacting—and what to expect from contacting—federal asset response contacts and federal threat response contacts.

DISCLAIMER

This document is marked TLP:WHITE. Disclosure is not limited. Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the Traffic Light Protocol, see https://cisa.gov/tlp.

References

• CISA Emergency Services Sector Continuity Planning Suite
• CISA MS-ISAC Joint Ransomware Guide
• CISA Tip: Avoiding Social Engineering and Phishing Attacks
• FBI PSA: “High-Impact Ransomware Attacks Threaten U.S. Businesses and Organizations"
• Health Industry Cybersecurity Tactical Crisis Response
• Health Industry Cybersecurity Practices (HICP)
• HHS - Ransomware Spotlight Webinar
• HHS - Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients
• HHS - Ransomware Briefing
• HHS - Aggressive Ransomware Impacts
• HHS - Ransomware Fact Sheet
• HHS - Cyber Attack Checklist
• HHS - Cyber-Attack Response Infographic
• NIST - Data Integrity Publication
• NIST - Guide for Cybersecurity Event Recovery
• NIST - Identifying and Protecting Assets Against Ransomware and Other Destructive Events
• NIST - Detecting and Responding to Ransomware and Other Destructive Events
• NIST - Recovering from Ransomware and Other Destructive Events

Revisions

• October 28, 2020: Initial version

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: October 27, 2020
Summary

This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) version 7 framework. See the ATT&CK for Enterprise version 7 for all referenced threat actor tactics and techniques.

This joint cybersecurity advisory was coauthored by the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the U.S. Cyber Command Cyber National Mission Force (CNMF). This advisory describes the tactics, techniques, and procedures (TTPs) used by North Korean advanced persistent threat (APT) group Kimsuky—against worldwide targets—to gain intelligence on various topics of interest to the North Korean government. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA. For more information on HIDDEN COBRA activity, visit https://www.us-cert.cisa.gov/northkorea.

This advisory describes known Kimsuky TTPs, as found in open-source and intelligence reporting through July 2020. The target audience for this advisory is commercial sector businesses desiring to protect their networks from North Korean APT activity.

Click here for a PDF version of this report.

Key Findings

This advisory’s key findings are:

• The Kimsuky APT group has most likely been operating since 2012.
• Kimsuky is most likely tasked by the North Korean regime with a global intelligence gathering mission.
• Kimsuky employs common social engineering tactics, spearphishing, and watering hole attacks to exfiltrate desired information from victims.[1],[2]
• Kimsuky is most likely to use spearphishing to gain initial access into victim hosts or networks.[3]
• Kimsuky conducts its intelligence collection activities against individuals and organizations in South Korea, Japan, and the United States.
• Kimsuky focuses its intelligence collection activities on foreign policy and national security issues related to the Korean peninsula, nuclear policy, and sanctions.
• Kimsuky specifically targets:
• • Individuals identified as experts in various fields,
  • Think tanks, and
  • South Korean government entities.[4],[5],[6],[7],[8]
• CISA, FBI, and CNMF recommend individuals and organizations within this target profile increase their defenses and adopt a heightened state of awareness. Particularly important mitigations include safeguards against spearphishing, use of multi-factor authentication, and user awareness training.

Technical DetailsInitial Access

Kimsuky uses various spearphishing and social engineering methods to obtain Initial Access [TA0001] to victim networks.[9],[10],[11] Spearphishing—with a malicious attachment embedded in the email—is the most observed Kimsuky tactic (Phishing: Spearphishing Attachment [T1566.001]).[12],[13]

• The APT group has used web hosting credentials—stolen from victims outside of their usual targets—to host their malicious scripts and tools. Kimsuky likely obtained the credentials from the victims via spearphishing and credential harvesting scripts. On the victim domains, they have created subdomains mimicking legitimate sites and services they are spoofing, such as Google or Yahoo mail.[14]
• Kimsuky has also sent benign emails to targets, which were possibly intended to build trust in advance of a follow-on email with a malicious attachment or link.
  • Posing as South Korean reporters, Kimsuky exchanged several benign interview-themed emails with their intended target to ostensibly arrange an interview date and possibly build rapport. The emails contained the subject line “Skype Interview requests of [Redacted TV Show] in Seoul,” and began with a request to have the recipient appear as a guest on the show. The APT group invited the targets to a Skype interview on the topic of inter-Korean issues and denuclearization negotiations on the Korean Peninsula.
  • After a recipient agreed to an interview, Kimsuky sent a subsequent email with a malicious document, either as an attachment or as a Google Drive link within the body. The document usually contained a variant of BabyShark malware (see the Execution section for information on BabyShark). When the date of the interview drew near, Kimsuky sent an email canceling the interview.
• Kimsuky tailors its spearphishing and social engineering approaches to use topics relevant to the target, such as COVID-19, the North Korean nuclear program, or media interviews.[15],[16],[17]

Kimsuky’s other methods for obtaining initial access include login-security-alert-themed phishing emails, watering hole attacks, distributing malware through torrent sharing sites, and directing victims to install malicious browser extensions (Phishing: Spearphising Link [T1566.002], Drive-by Compromise [T1189], Man-in-the-Browser [T1185]).[18]

Execution

After obtaining initial access, Kimsuky uses BabyShark malware and PowerShell or the Windows Command Shell for Execution [TA0002].

• BabyShark is Visual Basic Script (VBS)-based malware.
  • First, the compromised host system uses the native Microsoft Windows utility, mshta.exe, to download and execute an HTML application (HTA) file from a remote system (Signed Binary Proxy Execution: Mshta [T1218.005]).
  • The HTA file then downloads, decodes, and executes the encoded BabyShark VBS file.
  • The script maintains Persistence [TA0003] by creating a Registry key that runs on startup (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder [T1547.001]).
  •  It then collects system information (System Information Discovery [T1082]), sends it to the operator’s command control (C2) servers, and awaits further commands.[19],[20],[21],[22]
• Open-source reporting indicates BabyShark is delivered via an email message containing a link or an attachment (see Initial Access section for more information) (Phishing: Spearphising Link [T1566.002], Phishing: Spearphishing Attachment [T1566.001]). Kimsuky tailors email phishing messages to match its targets’ interests. Observed targets have been U.S. think tanks and the global cryptocurrency industry.[23]
• Kimsuky uses PowerShell to run executables from the internet without touching the physical hard disk on a computer by using the target’s memory (Command and Scripting Interpreter: PowerShell [T1059.001]). PowerShell commands/scripts can be executed without invoking powershell.exe through HTA files or mshta.exe.[24],[25],[26],[27]

Persistence

Kimsuky has demonstrated the ability to establish Persistence [TA0003] through using malicious browser extensions, modifying system processes, manipulating the autostart execution, using Remote Desktop Protocol (RDP), and changing the default file association for an application. By using these methods, Kimsuky can gain login and password information and/or launch malware outside of some application allowlisting solutions.

• In 2018, Kimsuky used an extension, which was available on the Google Chrome Web Store, to infect victims and steal passwords and cookies from their browsers (Man-in-the-Browser [T1185]). The extension’s reviews gave it a five-star rating, however the text of the reviews applied to other extensions or was negative. The reviews were likely left by compromised Google+ accounts.[28]
• Kimsuky may install a new service that can execute at startup by using utilities to interact with services or by directly modifying the Registry keys (Boot or Logon Autostart Execution [T1547]). The service name may be disguised with the name from a related operating system function or by masquerading as benign software. Services may be created with administrator privileges but are executed under system privileges, so an adversary can also use a service to escalate privileges from Administrator to System. They can also directly start services through Service Execution.[29],[30]
• During the STOLEN PENCIL operation in May 2018, Kimsuky used the GREASE malware. GREASE is a tool capable of adding a Windows administrator account and enabling RDP while avoiding firewall rules (Remote Services: Remote Desktop Protocol [T1021.001]).[31]
• Kimsuky uses a document stealer module that changes the default program associated with Hangul Word Processor (HWP) documents (.hwp files) in the Registry (Event Triggered Execution: Change Default File Association [T1546.001]). Kimsuky manipulates the default Registry setting to open a malicious program instead of the legitimate HWP program (HWP is a Korean word processor). The malware will read and email the content from HWP documents before the legitimate HWP program ultimately opens the document.[32] Kimsuky also targets Microsoft Office users by formatting their documents in a .docx file rather than .hwp and will tailor their macros accordingly.[33]
• Kimsuky maintains access to compromised domains by uploading actor-modified versions of open-source Hypertext Processor (PHP)-based web shells; these web shells enable the APT actor to upload, download, and delete files and directories on the compromised domains (Server Software Component: Web Shell [T1505.003]). The actor often adds “Dinosaur” references within the modified web shell codes.[34]

Privilege Escalation

Kimsuky uses well-known methods for Privilege Escalation [TA0004]. These methods include placing scripts in the Startup folder, creating and running new services, changing default file associations, and injecting malicious code in explorer.exe.

• Kimsuky has used Win7Elevate—an exploit from the Metasploit framework—to bypass the User Account Control to inject malicious code into explorer.exe (Process Injection [T1055]). This malicious code decrypts its spying library—a collection of keystroke logging and remote control access tools and remote control download and execution tools—from resources, regardless of the victim’s operating system. It then saves the decrypted file to a disk with a random but hardcoded name (e.g., dfe8b437dd7c417a6d.tmp) in the user’s temporary folder and loads this file as a library, ensuring the tools are then on the system even after a reboot. This allows for the escalation of privileges.[35]
• Before the injection takes place, the malware sets the necessary privileges (see figure 1). The malware writes the path to its malicious Dynamic Link Library (DLL) and ensures the remote process is loaded by creating a remote thread within explorer.exe (Process Injection [T1055]).[36]

Figure 1: Privileges set for the injection [37]

Defense Evasion

Kimsuky uses well-known and widely available methods for Defense Evasion [TA0005] within a network. These methods include disabling security tools, deleting files, and using Metasploit.[38],[39]

• Kimsuky’s malicious DLL runs at startup to zero (i.e., turn off) the Windows firewall Registry keys (see figure 2). This disables the Windows system firewall and turns off the Windows Security Center service, which prevents the service from alerting the user about the disabled firewall (see figure 2) (Impair Defenses: Disable or Modify System Firewall [T1562.004]).[40]

Figure 2: Disabled firewall values in the Registry [41]

• Kimsuky has used a keylogger that deletes exfiltrated data on disk after it is transmitted to its C2 server (Indicator Removal on Host: File Deletion [T1070.004]).[42]
• Kimsuky has used mshta.exe, which is a utility that executes Microsoft HTAs. It can be used for proxy execution of malicious .hta files and JavaScript or VBS through a trusted windows utility (Signed Binary Proxy Execution: Mshta [T1218.005]). It can also be used to bypass application allow listing solutions (Abuse Elevation Control Mechanism: Bypass User Access Control [T1548.002]).[43],[44]
• Win7Elevate—which was noted above—is also used to evade traditional security measures. Win7Elevatve is a part of the Metasploit framework open-source code and is used to inject malicious code into explorer.exe (Process Injection [T1055]). The malicious code decrypts its spying library from resources, saves the decrypted file to disk with a random but hardcoded name in the victim's temporary folder, and loads the file as a library.[45],[46],[47]

Credential Access

Kimsuky uses legitimate tools and network sniffers to harvest credentials from web browsers, files, and keyloggers (Credential Access [TA0006]).

• Kimsuky uses memory dump programs instead of using well-known malicious software and performs the credential extraction offline. Kimsuky uses ProcDump, a Windows command line administration tool, also available for Linux, that allows a user to create crash dumps/core dumps of processes based upon certain criteria, such as high central processing unit (CPU) utilization (OS Credential Dumping [T1003]). ProcDump monitors for CPU spikes and generates a crash dump when a value is met; it passes information to a Word document saved on the computer. It can be used as a general process dump utility that actors can embed in other scripts, as seen by Kimsuky’s inclusion of ProcDump in the BabyShark malware.[48]
• According to open-source security researchers, Kimsuky abuses a Chrome extension to steal passwords and cookies from browsers (Man-in-the-Browser [T1185]).[49],[50] The spearphishing email directs a victim to a phishing site, where the victim is shown a benign PDF document but is not able to view it. The victim is then redirected to the official Chrome Web Store page to install a Chrome extension, which has the ability to steal cookies and site passwords and loads a JavaScript file, named jQuery.js, from a separate site (see figure 3).[51]

Figure 3: JavaScript file, named jQuery.js [52]

• Kimsuky also uses a PowerShell based keylogger, named MECHANICAL, and a network sniffing tool, named Nirsoft SniffPass (Input Capture: Keylogging [T1056.001], Network Sniffing [T1040]). MECHANICAL logs keystrokes to %userprofile%\appdata\roaming\apach.{txt,log} and is also a "cryptojacker," which is a tool that uses a victim’s computer to mine cryptocurrency. Nirsoft SniffPass is capable of obtaining passwords sent over non-secure protocols.[53]
• Kimsuky used actor-modified versions of PHProxy, an open-source web proxy written in PHP, to examine web traffic between the victim and the website accessed by the victims and to collect any credentials entered by the victim.[54]

Discovery

Kimsuky enumerates system information and the file structure for victims’ computers and networks (Discovery [TA0007]). Kimsuky appears to rely on using the victim’s operating system command prompt to enumerate the file structure and system information (File and Directory Discovery [T1083]). The information is directed to C:\WINDOWS\msdatl3.inc, read by malware, and likely emailed to the malware’s command server.[55]

Collection

Kimsuky collects data from the victim system through its HWP document malware and its keylogger (Collection [TA0009]). The HWP document malware changes the default program association in the Registry to open HWP documents (Event Triggered Execution: Change Default File Association [T1546.001]). When a user opens an HWP file, the Registry key change triggers the execution of malware that opens the HWP document and then sends a copy of the HWP document to an account under the adversary’s control. The malware then allows the user to open the file as normal without any indication to the user that anything has occurred. The keylogger intercepts keystrokes and writes them to C:\Program Files\Common Files\System\Ole DB\msolui80.inc and records the active window name where the user pressed keys (Input Capture: Keylogging [T1056.001]). There is another keylogger variant that logs keystrokes into C:\WINDOWS\setup.log.[56]

Kimsuky has also used a Mac OS Python implant that gathers data from Mac OS systems and sends it to a C2 server (Command and Scripting Interpreter: Python [T1059.006]). The Python program downloads various implants based on C2 options specified after the filedown.php (see figure 4).

Figure 4: Python Script targeting MacOS [57]

Command and Control

Kimsuky has used a modified TeamViewer client, version 5.0.9104, for Command and Control [TA0011] (Remote Access Software [T1219]). During the initial infection, the service “Remote Access Service” is created and adjusted to execute C:\Windows\System32\vcmon.exe at system startup (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder [T1547.001]). Every time vcmon.exe is executed, it disables the firewall by zeroing out Registry values (Impair Defenses: Disable or Modify System Firewall [T1562.004]). The program then modifies the TeamViewer Registry settings by changing the TeamViewer strings in TeamViewer components. The launcher then configures several Registry values, including SecurityPasswordAES, that control how the remote access tool will work. The SecurityPasswordAES Registry value represents a hash of the password used by a remote user to connect to TeamViewer Client (Use Alternate Authentication Material: Pass the Hash [T1550.002]). This way, the attackers set a pre-shared authentication value to have access to the TeamViewer Client. The attacker will then execute the TeamViewer client netsvcs.exe.[58]

Kimsuky has been using a consistent format. In the URL used recently—express.php?op=1—there appears to be an option range from 1 to 3.[59]

Exfiltration

Open-source reporting from cybersecurity companies describes two different methods Kimsuky has used to exfiltrate stolen data: via email or through an RC4 key generated as an MD5 hash or a randomly generated 117-bytes buffer (Exfiltration [TA0010]).

There was no indication that the actor destroyed computers during the observed exfiltrations, suggesting Kimsuky’s intention is to steal information, not to disrupt computer networks. Kimsuky’s preferred method for sending or receiving exfiltrated information is through email, with their malware on the victim machine encrypting the data before sending it to a C2 server (Archive Collected Data [T1560]).  Kimsuky also sets up auto-forward rules within a victim’s email account (Email Collection: Email Forwarding Rule [T1114.003]).

Kimsuky also uses an RC4 key generated as an MD5 hash or a randomly generated 117-bytes buffer to exfiltrate stolen data. The data is sent RSA-encrypted (Encrypted Channel: Symmetric Cryptography [T1573.001]). Kimsuky’s malware constructs an 1120-bit public key and uses it to encrypt the 117-bytes buffer. The resulting data file is saved in C:\Program Files\Common Files\System\Ole DB\ (Data Staged: Local Data Staging [T1074.001]).[60]

MitigationsIndicators of Compromise

Kimsuky has used the domains listed in table 1 to carry out its objectives:

For a downloadable copy of IOCs, see AA20-301A.stix.

Table 1: Domains used by Kimsuky

login.bignaver.com

nytimes.onekma.com

webuserinfo.com

member.navier.pe.hu

nid.naver.onektx.com

pro-navor.com

cloudnaver.com

read.tongilmoney.com

naver.pw

resetprofile.com

nid.naver.unicrefia.com

daurn.org

servicenidnaver.com

mail.unifsc.com

naver.com.de

account.daurn.pe.hu

member.daum.unikortv.com

ns.onekorea.me

login.daum.unikortv.com

securetymail.com

riaver.site

account.daum.unikortv.com

help-navers.com

mailsnaver.com

daum.unikortv.com

beyondparallel.sslport.work

cloudmail.cloud

member.daum.uniex.kr

comment.poulsen.work

helpnaver.com

jonga.ml

impression.poulsen.work

view-naver.com

myaccounts.gmail.kr-infos.com

statement.poulsen.work

view-hanmail.net

naver.hol.es

demand.poulsen.work

login.daum.net-accounts.info

dept-dr.lab.hol.es

sankei.sslport.work

read-hanmail.net

Daurn.pe.hu

sts.desk-top.work

net.tm.ro

Bigfile.pe.hu

hogy.desk-top.work

daum.net.pl

Cdaum.pe.hu

kooo.gq

usernaver.com

eastsea.or.kr

tiosuaking.com

naver.com.ec

myaccount.nkaac.net

help.unikoreas.kr

naver.com.mx

naver.koreagov.com

resultview.com

naver.com.se

naver.onegov.com

account.daum.unikftc.kr

naver.com.cm

member-authorize.com

ww-naver.com

nid.naver.com.se

naver.unibok.kr

vilene.desk-top.work

csnaver.com

nid.naver.unibok.kr

amberalexander.ghtdev.com

nidnaver.email

read-naver.com

nidnaver.net

cooper.center

dubai-1.com

coinone.co.in

nidlogin.naver.corper.be

amberalexander.ghtdev.com

naver.com.pl

nid.naver.corper.be

gloole.net

naver.cx

naverdns.co

smtper.org

smtper.cz

naver.co.in

login.daum.kcrct.ml

myetherwallet.com.mx

downloadman06.com

login.outlook.kcrct.ml

myetherwallet.co.in

loadmanager07.com

top.naver.onekda.com

com-download.work

com-option.work

com-sslnet.work

com-vps.work

com-ssl.work

desk-top.work

intemet.work

jp-ssl.work

org-vip.work

sslport.work

sslserver.work

ssltop.work

taplist.work

vpstop.work

webmain.work

preview.manage.org-view.work

intranet.ohchr.account-protect.work

 

Table 2: Redacted domains used by Kimsuky

[REDACTED]/home/dwn.php?van=101

[REDACTED]/home/dwn.php?v%20an=101

[REDACTED]/home/dwn.php?van=102

[REDACTED]/home/up.php?id=NQDPDE

[REDACTED]/test/Update.php?wShell=201

 

Contact Information

To report suspicious or criminal activity related to information found in this Joint Cybersecurity Advisory, contact your local FBI field office at www.fbi.gov/contact-us/field, or the FBI’s 24/7 Cyber Watch (CyWatch) at (855) 292-3937 or by e-mail at CyWatch@fbi.gov. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact. To request incident response resources or technical assistance related to these threats, contact CISA at Central@cisa.dhs.gov.

  DISCLAIMER  

This information is provided "as is" for informational purposes only. The United States Government does not provide any warranties of any kind regarding this information. In no event shall the United States Government or its contractors or subcontractors be liable for any damages, including but not limited to, direct, indirect, special or consequential damages, arising out of, resulting from, or in any way connected with this information, whether or not based upon warranty, contract, tort, or otherwise, whether or not arising out of negligence, and whether or not injury was sustained from, or arose out of the results of, or reliance upon the information.

The United States Government does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply their endorsement, recommendation, or favoring by the United States Government.

References

• [1] Netscout: Stolen Pencil Campaign Targets Academia
• [2] CYWARE Social: Babyshark malware continues to target nuclear and cryptocurrency industries
• [3] CYWARE Social: Babyshark malware continues to target nuclear and cryptocurrency industries
• [4] Netscout: Stolen Pencil Campaign Targets Academia
• [5] MITRE ATT&CK: Groups – Kimsuky
• [6] Securityweek.com: North Korean Suspected Cyber-espionage Attacks Against South Korea Entities
• [7] MITRE ATT&CK: Groups – Kimsuky
• [8] CrowdStrike: 2020 Global Threat Report
• [9] Malwarebytes: APTs and COVID-19: How advanced persistent threats use the coronavirus as a lure
• [10] PwC: Tracking ‘Kimsuky’, the North Korea-based cyber espionage group: Part 2
• [11] CrowdStrike: 2020 Global Threat Report
• [12] Netscout: Stolen Pencil Campaign Targets Academia
• [13] MITRE ATT&CK: Groups – Kimsuky
• ">[14] Private Sector Partner
• [15] CYWARE Social: Babyshark malware continues to target nuclear and cryptocurrency industries
• [16] Malwarebytes: APTs and COVID-19: How advanced persistent threats use the coronavirus as a lure
• [17] cyberscoop: North Korea could accelerate commercial espionage to meet Kim’s economic deadline
• [18] MITRE ATT&CK: Groups – Kimsuky
• [19] CYWARE Social: Babyshark malware continues to target nuclear and cryptocurrency industries
• [20] MITRE ATT&CK: Groups – Kimsuky
• [21] Palo Alto Networks Unit 42: New BabyShark Malware Targets U.S. National Security Think Tanks
• [22] Palo Alto Networks Unit 42: New BabyShark Malware Targets U.S. National Security Think Tanks
• [23] CYWARE Social: Babyshark malware continues to target nuclear and cryptocurrency industries
• [24] MITRE ATT&CK: Groups – Kimsuky
• [25] Palo Alto Networks Unit 42: BabyShark Malware Part Two – Attacks Continue Using KimJongRAT and PCRat
• [26] McAfee: What is mshta, how can it be used and how to protect against it
• [27] Palo Alto Networks Unit 42: New BabyShark Malware Targets U.S. National Security Think Tanks
• [28] Netscout: Stolen Pencil Campaign Targets Academia
• [29] MITRE ATT&CK: Groups – Kimsuky
• [30] Palo Alto Networks Unit 42: New BabyShark Malware Targets U.S. National Security Think Tanks
• [31] Netscout: Stolen Pencil Campaign Targets Academia
• [32] Securelist: The “Kimsuky” Operation: A North Korean APT?
• ">[33] Private Sector Partner
• ">[34] Private Sector Partner
• [35] Securelist: The “Kimsuky” Operation: A North Korean APT?
• [36] Yoroi: The North Korean Kimsuky APT Keeps Threatening South Korea Evolving its TTPs
• [37] Yoroi: The North Korean Kimsuky APT Keeps Threatening South Korea Evolving its TTPs
• [38] Securelist: The “Kimsuky” Operation: A North Korean APT?
• [39] MITRE ATT&CK: Groups – Kimsuky
• [40] Securelist: The “Kimsuky” Operation: A North Korean APT?
• [41] Securelist: The “Kimsuky” Operation: A North Korean APT?
• [42] Securelist: The “Kimsuky” Operation: A North Korean APT?
• [43] MITRE ATT&CK: Groups – Kimsuky
• [44] McAfee: What is mshta, how can it be used and how to protect against it
• [45] Securityweek.com: North Korean Suspected Cyber-espionage Attacks Against South Korea Entities
• [46] Securelist: The “Kimsuky” Operation: A North Korean APT?
• [47] MITRE ATT&CK: Groups – Kimsuky
• [48] Detecting credential theft through memory access modelling with Microsoft Defender ATP
• [49] MITRE ATT&CK: Groups – Kimsuky
• [50] ZDNet: Cyber-espionage-group-uses-chrome-extension-to-infect-victims
• [51] ZDNet: Cyber-espionage-group-uses-chrome-extension-to-infect-victims
• [52] Netscout: Stolen Pencil Campaign Targets Academia
• [53] Netscout: Stolen Pencil Campaign Targets Academia
• ">[54] Private Sector Partner
• [55] Securelist: The “Kimsuky” Operation: A North Korean APT?
• [56] Securelist: The “Kimsuky” Operation: A North Korean APT?
• ">[57] Private Sector Partner
• [58] Securelist: The “Kimsuky” Operation: A North Korean APT?
• ">[59] Private Sector Partner
• [60] Securelist: The “Kimsuky” Operation: A North Korean APT?

Revisions

• October 27, 2020: Initial Version

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: October 22, 2020
Summary

The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) are warning that Iranian advanced persistent threat (APT) actors are likely intent on influencing and interfering with the U.S. elections to sow discord among voters and undermine public confidence in the U.S. electoral process.

The APT actors are creating fictitious media sites and spoofing legitimate media sites to spread obtained U.S. voter-registration data, anti-American propaganda, and misinformation about voter suppression, voter fraud, and ballot fraud.

The APT actors have historically exploited critical vulnerabilities to conduct distributed denial-of-service (DDoS) attacks, structured query language (SQL) injections attacks, spear-phishing campaigns, website defacements, and disinformation campaigns. 

Click here for a PDF version of this report.

Technical Details

These actors have conducted a significant number of intrusions against U.S.-based networks since August 2019. The actors leveraged several Common Vulnerabilities and Exposures (CVEs)—notably CVE-2020-5902 and CVE-2017-9248—pertaining to virtual private networks (VPNs) and content management systems (CMSs). 

• CVE-2020-5902 affects F5 VPNs. Remote attackers could exploit this vulnerability to execute arbitrary code. [1].
• CVE-2017-9248 affects Telerik UI. Attackers could exploit this vulnerability in web applications using Telerik UI for ASP.NET AJAX to conduct cross-site scripting (XSS) attacks.[2]

Historically, these actors have conducted DDoS attacks, SQL injections attacks, spear-phishing campaigns, website defacements, and disinformation campaigns. These activities could render these systems temporarily inaccessible to the public or election officials, which could slow, but would not prevent, voting or the reporting of results.

• A DDoS attack could slow or render election-related public-facing websites inaccessible by flooding the internet-accessible server with requests; this would prevent users from accessing online resources, such as voting information or non-official voting results. In the past, cyber actors have falsely claimed DDoS attacks have compromised the integrity of voting systems in an effort to mislead the public that their attack would prevent a voter from casting a ballot or change votes already cast.
• A SQL injection involves a threat actor inserting malicious code into the entry field of an application, causing that code to execute if entries have not been sanitized. SQL injections are among the most dangerous and common exploits affecting websites. A SQL injection into a media company’s CMS could enable a cyber actor access to network systems to manipulate content or falsify news reports prior to publication.
• Spear-phishing messages may not be easily detectible. These emails often ask victims to fill out forms or verify information through links embedded in the email. APT actors use spear phishing to gain access to information—often credentials, such as passwords—and to identify follow-on victims. A malicious cyber actor could use compromised email access to spread disinformation to the victims’ contacts or collect information sent to or from the compromised account.
• Public-facing website defacements typically involve a cyber threat actor compromising the website or its associated CMS, allowing the actor to upload images to the site’s landing page. In situations where such public-facing websites relate to elections (e.g., the website of a county board of elections), defacements could cast doubt on the security and legitimacy of the websites’ information. If cyber actors were able to successfully change an election-related website, the underlying data and internal systems would remain uncompromised..
• Disinformation campaigns involve malign actions taken by foreign governments or actors designed to sow discord, manipulate public discourse, or discredit the electoral system. Malicious actors often use social media as well as fictitious and spoofed media sites for these campaigns. Based on their corporate policies, social media companies have worked to counter these actors’ use of their platforms to promote fictitious news stories by removing the news stories, and in many instances, closing the accounts related to the malicious activity. However, these adversaries will continue their attempts to create fictitious accounts that promote divisive storylines to sow discord, even after the election.

Mitigations

The following recommended mitigations list includes self-protection strategies against the cyber techniques used by the APT actors:

• Validate input—input validation is a method of sanitizing untrusted input provided by web application users. Implementing input validation can protect against security flaws of web applications by significantly reducing the probability of successful exploitation. Types of attacks possibly prevented include SQL injection, XSS, and command injection.
• Audit your network for systems using Remote Desktop Protocol (RDP) and other internet-facing services. Disable the service if unneeded or install available patches. Users may need to work with their technology vendors to confirm that patches will not affect system processes.
• Verify all cloud-based virtual machine instances with a public IP; do not have open RDP ports, unless there is a valid business reason to do so. Place any system with an open RDP port behind a firewall, and require users to use a VPN to access it through the firewall.
• Enable strong password requirements and account lockout policies to defend against brute-force attacks.
• Apply multi-factor authentication, when possible.
• Apply system and software updates regularly, particularly if you are deploying products affected by CVE-2020-5902 and CVE-2017-9248.
  • For patch information on CVE-2020-5902, refer to F5 Security Advisory K52145254.
  • For patch information on CVE-2017-9248, refer to Progress Telerik details for CVE-2017-9248.
• Maintain a good information back-up strategy that involves routinely backing up all critical data and system configuration information on a separate device. Store the backups offline; verify their integrity and restoration process.
• Enable logging and ensure logging mechanisms capture RDP logins. Keep logs for a minimum of 90 days, and review them regularly to detect intrusion attempts.
• When creating cloud-based virtual machines, adhere to the cloud provider's best practices for remote access.
• Ensure third parties that require RDP access are required to follow internal policies on remote access.
• Minimize network exposure for all control system devices. Where possible, critical devices should not have RDP enabled.
• Regulate and limit external to internal RDP connections. When external access to internal resources is required, use secure methods, such as VPNs, recognizing VPNs are only as secure as the connected devices.
• Be aware of unsolicited contact on social media from any individual you do not know.
• Be aware of attempts to pass links or files via social media from anyone you do not know.
• Be aware of unsolicited requests to share a file via online services.
• Be aware of email messages conveying suspicious alerts or other online accounts, including login notifications from foreign countries or other alerts indicating attempted unauthorized access to your accounts.
• Be suspicious of emails purporting to be from legitimate online services (e.g., the images in the email appear to be slightly pixelated and/or grainy, language in the email seems off, the email originates from an IP address not attributable to the provider/company).
• Be suspicious of unsolicited email messages that contain shortened links (e.g., via tinyurl, bit.ly).
• Use security features provided by social media platforms, use strong passwords, change passwords frequently, and use a different password for each social media account.
• See CISA’s Tip on Best Practices for Securing Election Systems for more information.

General Mitigations Keep applications and systems updated and patched

Apply all available software updates and patches; automate this process to the greatest extent possible (e.g., by using an update service provided directly from the vendor). Automating updates and patches is critical because of the speed at which threat actors create exploits after a patch is released. These “N-day” exploits can be as damaging as a zero-day exploits. Vendor updates must also be authentic; updates are typically signed and delivered over protected links to ensure the integrity of the content. Without rapid and thorough patch application, threat actors can operate inside a defender’s patch cycle.[3] In addition to updating the application, use tools (e.g., the OWASP Dependency-Check Project tool[4]) to identify publicly known vulnerabilities in third-party libraries that the application depends on.

Scan web applications for SQL injection and other common web vulnerabilities

Implement a plan to scan public-facing web servers for common web vulnerabilities (SQL injection, cross-site scripting, etc.); use a commercial web application vulnerability scanner in combination with a source code scanner.[5] As vulnerabilities are found, they should be fixed or patched. This is especially crucial for networks that host older web applications; as sites get older, more vulnerabilities are discovered and exposed.

Deploy a web application firewall 

Deploy a web application firewall (WAF) to help prevent invalid input attacks and other attacks destined for the web application. WAFs are intrusion/detection/prevention devices that inspect each web request made to and from the web application to determine if the request is malicious. Some WAFs install on the host system and others are dedicated devices that sit in front of the web application. WAFs also weaken the effectiveness of automated web vulnerability scanning tools.

Deploy techniques to protect against web shells

Patch web application vulnerabilities or fix configuration weaknesses that allow web shell attacks, and follow guidance on detecting and preventing web shell malware.[6] Malicious cyber actors often deploy web shells—software that can enable remote administration—on a victim’s web server. Malicious cyber actors can use web shells to execute arbitrary system commands, which are commonly sent over HTTP or HTTPS. Attackers often create web shells by adding or modifying a file in an existing web application. Web shells provide attackers with persistent access to a compromised network using communications channels disguised to blend in with legitimate traffic. Web shell malware is a long-standing, pervasive threat that continues to evade many security tools.

Use multi-factor authentication for administrator accounts

Prioritize protection for accounts with elevated privileges, with remote access, and/or used on high value assets.[7] Use physical token-based authentication systems to supplement knowledge-based factors such as passwords and personal identification numbers (PINs).[8] Organizations should migrate away from single-factor authentication, such as password-based systems, which are subject to poor user choices and more susceptible to credential theft, forgery, and password reuse across multiple systems.

Remediate critical web application security risks

First, identify and remedite critical web application security risks first; then, move on to other less critical vulnerabilities. Follow available guidance on securing web applications.[9],[10],[11]

How do I respond to unauthorized access to election-related systems? Implement your security incident response and business continuity plan

It may take time for your organization’s IT professionals to isolate and remove threats to your systems and restore normal operations. In the meantime, take steps to maintain your organization’s essential functions according to your business continuity plan. Organizations should maintain and regularly test backup plans, disaster recovery plans, and business continuity procedures.

Contact CISA or law enforcement immediately

To report an intrusion and to request incident response resources or technical assistance, contact CISA (Central@cisa.dhs.gov or 888-282-0870) or the Federal Bureau of Investigation (FBI) through a local field office or the FBI’s Cyber Division (CyWatch@ic.fbi.gov or 855-292-3937).

Resources

• CISA Tip: Best Practices for Securing Election Systems
• CISA Tip: Securing Voter Registration Data
• CISA Tip: Website Security
• CISA Tip: Avoiding Social Engineering and Phishing Attacks
• CISA Tip: Securing Network Infrastructure Devices
• CISA Activity Alert: Technical Approaches to Uncovering and Remediating Malicious Activity
• CISA Insights: Actions to Counter Email-Based Attacks On Election-related Entities
• FBI and CISA Public Service Announcement (PSA): Spoofed Internet Domains and Email Accounts Pose Cyber and Disinformation Risks to Voters
• FBI and CISA PSA: Foreign Actors Likely to Use Online Journals to Spread Disinformation Regarding 2020 Elections
• FBI and CISA PSA: Distributed Denial of Service Attacks Could Hinder Access to Voting Information, Would Not Prevent Voting
• FBI and CISA PSA: False Claims of Hacked Voter Information Likely Intended to Cast Doubt on Legitimacy of U.S. Elections
• FBI and CISA PSA: Cyber Threats to Voting Processes Could Slow But Not Prevent Voting
• FBI and CISA PSA: Foreign Actors and Cybercriminals Likely to Spread Disinformation Regarding 2020 Election Results
   

Contact Information

To report suspicious or criminal activity related to information found in this Joint Cybersecurity Advisory, contact your local FBI field office at www.fbi.gov/contact-us/field, or the FBI’s 24/7 Cyber Watch (CyWatch) at (855) 292-3937 or by e-mail at CyWatch@fbi.gov. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact. To request incident response resources or technical assistance related to these threats, contact CISA at Central@cisa.dhs.gov.

References

• [1] F5 Security Advisory: K52145254: TMUI RCE vulnerability CVE-2020-5902
• [2] Progress Telerik details for CVE-2017-9248
• [3] NSA "NSA'S Top Ten Cybersecurity Mitigation Strategies
• [4] OWASP Dependency-Check
• [5] NSA "Defending Against the Exploitation of SQL Vulnerabilities to Compromise a Network"
• [6] NSA & ASD "CyberSecurity Information: Detect and Prevent Web Shell Malware"
• [7] CISA: Identifying and Protecting High Value Assets: A Closer Look at Governance Needs for HVAs:
• [8] NSA "NSA'S Top Ten Cybersecurity Mitigation Strategies"
• [9] NSA “Building Web Applications – Security for Developers”:
• [10] OWASP Top Ten
• [11] 2020 CWE Top 25 Most Dangerous Software Weaknesses

Revisions

• October 22, 2020: Initial Version

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: October 22, 2020
Summary

This joint cybersecurity advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor tactics and techniques

This joint cybersecurity advisory—written by the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA)—provides information on Russian state-sponsored advanced persistent threat (APT) actor activity targeting various U.S. state, local, territorial, and tribal (SLTT) government networks, as well as aviation networks. This advisory updates joint CISA-FBI cybersecurity advisory AA20-283A: APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations.

Since at least September 2020, a Russian state-sponsored APT actor—known variously as Berserk Bear, Energetic Bear, TeamSpy, Dragonfly, Havex, Crouching Yeti, and Koala in open-source reporting—has conducted a campaign against a wide variety of U.S. targets. The Russian state-sponsored APT actor has targeted dozens of SLTT government and aviation networks, attempted intrusions at several SLTT organizations, successfully compromised network infrastructure, and as of October 1, 2020, exfiltrated data from at least two victim servers.

The Russian-sponsored APT actor is obtaining user and administrator credentials to establish initial access, enable lateral movement once inside the network, and locate high value assets in order to exfiltrate data. In at least one compromise, the APT actor laterally traversed an SLTT victim network and accessed documents related to:

• Sensitive network configurations and passwords.
• Standard operating procedures (SOP), such as enrolling in multi-factor authentication (MFA).
• IT instructions, such as requesting password resets.
• Vendors and purchasing information.
• Printing access badges.

To date, the FBI and CISA have no information to indicate this APT actor has intentionally disrupted any aviation, education, elections, or government operations. However, the actor may be seeking access to obtain future disruption options, to influence U.S. policies and actions, or to delegitimize SLTT government entities.

As this recent malicious activity has been directed at SLTT government networks, there may be some risk to elections information housed on SLTT government networks. However, the FBI and CISA have no evidence to date that integrity of elections data has been compromised. Due to the heightened awareness surrounding elections infrastructure and the targeting of SLTT government networks, the FBI and CISA will continue to monitor this activity and its proximity to elections infrastructure.

• Click here for a PDF version of this report.
• Click here for a STIX package of IOCs.

Technical Details

The FBI and CISA have observed Russian state-sponsored APT actor activity targeting U.S. SLTT government networks, as well as aviation networks. The APT actor is using Turkish IP addresses 213.74.101[.]65, 213.74.139[.]196, and 212.252.30[.]170 to connect to victim web servers (Exploit Public Facing Application [T1190]).

The actor is using 213.74.101[.]65 and 213.74.139[.]196 to attempt brute force logins and, in several instances, attempted Structured Query Language (SQL) injections on victim websites (Brute Force [T1110]; Exploit Public Facing Application [T1190]). The APT actor also hosted malicious domains, including possible aviation sector target columbusairports.microsoftonline[.]host, which resolved to 108.177.235[.]92 and [cityname].westus2.cloudapp.azure.com; these domains are U.S. registered and are likely SLTT government targets (Drive-By Compromise [T1189]).

The APT actor scanned for vulnerable Citrix and Microsoft Exchange services and identified vulnerable systems, likely for future exploitation. This actor continues to exploit a Citrix Directory Traversal Bug (CVE-2019-19781) and a Microsoft Exchange remote code execution flaw (CVE-2020-0688).

The APT actor has been observed using Cisco AnyConnect Secure Socket Layer (SSL) virtual private network (VPN) connections to enable remote logins on at least one victim network, possibly enabled by an Exim Simple Mail Transfer Protocol (SMTP) vulnerability (CVE 2019-10149) (External Remote Services [T1133]). More recently, the APT actor enumerated and exploited a Fortinet VPN vulnerability (CVE-2018-13379) for Initial Access [TA0001] and a Windows Netlogon vulnerability (CVE-2020-1472) to obtain access to Windows Active Directory (AD) servers for Privilege Escalation [TA0004] within the network (Valid Accounts [T1078]). These vulnerabilities can also be leveraged to compromise other devices on the network (Lateral Movement [TA0008]) and to maintain Persistence [TA0003]).

Between early February and mid-September, these APT actors used 213.74.101[.]65, 212.252.30[.]170, 5.196.167[.]184, 37.139.7[.]16, 149.56.20[.]55, 91.227.68[.]97, and 5.45.119[.]124 to target U.S. SLTT government networks. Successful authentications—including the compromise of Microsoft Office 365 (O365) accounts—have been observed on at least one victim network (Valid Accounts [T1078]).

MitigationsIndicators of Compromise

The APT actor used the following IP addresses and domains to carry out its objectives:

• 213.74.101[.]65
• 213.74.139[.]196
• 212.252.30[.]170
• 5.196.167[.]184
• 37.139.7[.]16
• 149.56.20[.]55
• 91.227.68[.]97
• 138.201.186[.]43
• 5.45.119[.]124
• 193.37.212[.]43
• 146.0.77[.]60
• 51.159.28[.]101
• columbusairports.microsoftonline[.]host
• microsoftonline[.]host
• email.microsoftonline[.]services
• microsoftonline[.]services
• cityname[.]westus2.cloudapp.azure.com

IP address 51.159.28[.]101 appears to have been configured to receive stolen Windows New Technology Local Area Network Manager (NTLM) credentials. FBI and CISA recommend organizations take defensive actions to mitigate the risk of leaking NTLM credentials; specifically, organizations should disable NTLM or restrict outgoing NTLM. Organizations should consider blocking IP address 51.159.28[.]101 (although this action alone may not mitigate the threat, as the APT actor has likely established, or will establish, additional infrastructure points).

Organizations should check available logs for traffic to/from IP address 51.159.28[.]101 for indications of credential-harvesting activity. As the APT actors likely have—or will—establish additional infrastructure points, organizations should also monitor for Server Message Block (SMB) or WebDAV activity leaving the network to other IP addresses.

Refer to AA20-296A.stix for a downloadable copy of IOCs.

Network Defense-in-Depth

Proper network defense-in-depth and adherence to information security best practices can assist in mitigating the threat and reducing the risk to critical infrastructure. The following guidance may assist organizations in developing network defense procedures.

• Keep all applications updated according to vendor recommendations, and especially prioritize updates for external facing applications and remote access services to address CVE-2019-19781, CVE-2020-0688, CVE 2019-10149, CVE-2018-13379, and CVE-2020-1472. Refer to table 1 for patch information on these CVEs.

Table 1: Patch information for CVEs

Vulnerability Vulnerable Products Patch Information CVE-2019-19781

• Citrix Application Delivery Controller
• Citrix Gateway
• Citrix SDWAN WANOP

 

Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway versions 11.1 and 12.0

Citrix blog post: security updates for Citrix SD-WAN WANOP release 10.2.6 and 11.0.3

Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway versions 12.1 and 13.0

Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway version 10.5

CVE-2020-0688

• Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 30
• Microsoft Exchange Server 2013 Cumulative Update 23
• Microsoft Exchange Server 2016 Cumulative Update 14
• Microsoft Exchange Server 2016 Cumulative Update 15
• Microsoft Exchange Server 2019 Cumulative Update 3
• Microsoft Exchange Server 2019 Cumulative Update 4

 

Microsoft Security Advisory for CVE-2020-0688 CVE-2019-10149

• Exim versions 4.87–4.91

Exim page for CVE-2019-10149 CVE-2018-13379

• FortiOS 6.0: 6.0.0 to 6.0.4
• FortiOS 5.6: 5.6.3 to 5.6.7
• FortiOS 5.4: 5.4.6 to 5.4.12

Fortinet Security Advisory: FG-IR-18-384 CVE-2020-1472

• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
• Windows Server 2012
• Windows Server 2012 (Server Core installation)
• Windows Server 2012 R2
• Windows Server 2016
• Windows Server 2019
• Windows Server 2019 (Server Core installation)
• Windows Server, version 1903  (Server Core installation)
• Windows Server, version 1909  (Server Core installation)
• Windows Server, version 2004   (Server Core installation)

Microsoft Security Advisory for CVE-2020-1472

 

 

• Follow Microsoft’s guidance on monitoring logs for activity related to the Netlogon vulnerability, CVE-2020-1472.
• If appropriate for your organization’s network, prevent external communication of all versions of SMB and related protocols at the network boundary by blocking Transmission Control Protocol (TCP) ports 139 and 445 and User Datagram Protocol (UDP) port 137. See the CISA publication on SMB Security Best Practices for more information.
• Implement the prevention, detection, and mitigation strategies outlined in:
  • CISA Alert TA15-314A – Compromised Web Servers and Web Shells – Threat Awareness and Guidance.
  • National Security Agency Cybersecurity Information Sheet U/OO/134094-20 – Detect and Prevent Web Shells Malware.
• Isolate external facing services in a network demilitarized zone (DMZ) since they are more exposed to malicious activity; enable robust logging, and monitor the logs for signs of compromise.
• Establish a training mechanism to inform end users on proper email and web usage, highlighting current information and analysis and including common indicators of phishing. End users should have clear instructions on how to report unusual or suspicious emails.
• Implement application controls to only allow execution from specified application directories. System administrators may implement this through Microsoft Software Restriction Policy, AppLocker, or similar software. Safe defaults allow applications to run from PROGRAMFILES, PROGRAMFILES(X86), and WINDOWS folders. All other locations should be disallowed unless an exception is granted.
• Block Remote Desktop Protocol (RDP) connections originating from untrusted external addresses unless an exception exists; routinely review exceptions on a regular basis for validity.

Comprehensive Account Resets

For accounts where NTLM password hashes or Kerberos tickets may have been compromised (e.g., through CVE-2020-1472), a double-password-reset may be required in order to prevent continued exploitation of those accounts. For domain-admin-level credentials, a reset of KRB-TGT “Golden Tickets” may be required, and Microsoft has released specialized guidance for this. Such a reset should be performed very carefully if needed.

If there is an observation of CVE-2020-1472 Netlogon activity or other indications of valid credential abuse, it should be assumed the APT actors have compromised AD administrative accounts. In such cases, the AD forest should not be fully trusted, and, therefore, a new forest should be deployed. Existing hosts from the old compromised forest cannot be migrated in without being rebuilt and rejoined to the new domain, but migration may be done through “creative destruction,” wherein, as endpoints in the legacy forest are decommissioned, new ones can be built in the new forest. This will need to be completed in on-premise—as well as in Azure-hosted—AD instances.

Note that fully resetting an AD forest is difficult and complex; it is best done with the assistance of personnel who have successfully completed the task previously.

It is critical to perform a full password reset on all user and computer accounts in the AD forest. Use the following steps as a guide.

1. Create a temporary administrator account, and use this account only for all administrative actions
2. Reset the Kerberos Ticket Granting Ticket (krbtgt) password;[1] this must be completed before any additional actions (a second reset will take place in step 5)
3. Wait for the krbtgt reset to propagate to all domain controllers (time may vary)
4.  Reset all account passwords (passwords should be 15 characters or more and randomly assigned):
   1. User accounts (forced reset with no legacy password reuse)
   2. Local accounts on hosts (including local accounts not covered by Local Administrator Password Solution [LAPS])
   3. Service accounts
   4. Directory Services Restore Mode (DSRM) account
   5. Domain Controller machine account
   6. Application passwords
5. Reset the krbtgt password again
6. Wait for the krbtgt reset to propagate to all domain controllers (time may vary)
7. Reboot domain controllers
8. Reboot all endpoints

The following accounts should be reset:

• AD Kerberos Authentication Master (2x)
• All Active Directory Accounts
• All Active Directory Admin Accounts
• All Active Directory Service Accounts
• All Active Directory User Accounts
• DSRM Account on Domain Controllers
• Non-AD Privileged Application Accounts
• Non-AD Unprivileged Application Accounts
• Non-Windows Privileged Accounts
• Non-Windows User Accounts
• Windows Computer Accounts
• Windows Local Admin

VPN Vulnerabilities

Implement the following recommendations to secure your organization’s VPNs:

• Update VPNs, network infrastructure devices, and devices being used to remote into work environments with the latest software patches and security configurations. See CISA Tips Understanding Patches and Software Updates and Securing Network Infrastructure Devices. Wherever possible, enable automatic updates.
• Implement MFA on all VPN connections to increase security. Physical security tokens are the most secure form of MFA, followed by authenticator app-based MFA. SMS and email-based MFA should only be used when no other forms are available. If MFA is not implemented, require teleworkers to use strong passwords. See CISA Tips Choosing and Protecting Passwords and Supplementing Passwords for more information.

Discontinue unused VPN servers. Reduce your organization’s attack surface by discontinuing unused VPN servers, which may act as a point of entry for attackers. To protect your organization against VPN vulnerabilities:

• Audit configuration and patch management programs.
• Monitor network traffic for unexpected and unapproved protocols, especially outbound to the Internet (e.g., Secure Shell [SSH], SMB, RDP).
• Implement MFA, especially for privileged accounts.
• Use separate administrative accounts on separate administration workstations.
• Keep software up to date. Enable automatic updates, if available.

Contact Information

To report suspicious or criminal activity related to information found in this Joint Cybersecurity Advisory, contact your local FBI field office at www.fbi.gov/contact-us/field, or the FBI’s 24/7 Cyber Watch (CyWatch) at (855) 292-3937 or by e-mail at CyWatch@fbi.gov. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact. To request incident response resources or technical assistance related to these threats, contact CISA at Central@cisa.dhs.gov.

Resources

• APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations – https://us-cert.cisa.gov/ncas/alerts/aa20-283a
• CISA Activity Alert CVE-2019-19781 – https://us-cert/cisa.gov/ncas/alerts/aa20-031a
• CISA Vulnerability Bulletin – https://us-cert/cisa.gov/ncas/bulletins/SB19-161
• CISA Current Activity – https://us-cert.cisa.gov/ncas/current-activity/2020/03/10/unpatched-microsoft-exchange-servers-vulnerable-cve-2020-0688
• Citrix Directory Traversal Bug (CVE-2019-19781) – https://nvd.nist.gov/vuln/detail/CVE-2019-19781
• Microsoft Exchange remote code execution flaw (CVE-2020-0688) – https://nvd.nist.gov/vuln/detail/CVE-2020-0688
• CVE-2018-13379 – https://nvd.nist.gov/vuln/detail/CVE-2018-13379
• CVE-2020-1472 – https://nvd.nist.gov/vuln/detail/CVE-2020-1472
• CVE 2019-10149 – https://nvd.nist.gov/vuln/detail/CVE-2019-10149
• NCCIC/USCERT Alert TA15-314A – Compromised Web Servers and Web Shells – Threat Awareness and Guidance – https://us-cert.cisa.gov/ncas/alerts/TA15-314A
• NCCIC/US-CERT publication on SMB Security Best Practices – https://us-cert.cisa.gov/ncas/current-activity/2017/01/16/SMB-Security-Best-Practices
   

  DISCLAIMER  

This information is provided "as is" for informational purposes only. The United States Government does not provide any warranties of any kind regarding this information. In no event shall the United States Government or its contractors or subcontractors be liable for any damages, including but not limited to, direct, indirect, special or consequential damages, arising out of, resulting from, or in any way connected with this information, whether or not based upon warranty, contract, tort, or otherwise, whether or not arising out of negligence, and whether or not injury was sustained from, or arose out of the results of, or reliance upon the information.

The United States Government does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply their endorsement, recommendation, or favoring by the United States Government.

References

• [1] Microsoft: AD Forest Recovery - Resetting the krbtgt password

Revisions

• October 22, 2020: Initial Version

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: October 9, 2020
Summary

This joint cybersecurity advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques.

Note: the analysis in this joint cybersecurity advisory is ongoing, and the information provided should not be considered comprehensive. The Cybersecurity and Infrastructure Security Agency (CISA) will update this advisory as new information is available.

This joint cybersecurity advisory was written by CISA with contributions from the Federal Bureau of Investigation (FBI). 

CISA has recently observed advanced persistent threat (APT) actors exploiting multiple legacy vulnerabilities in combination with a newer privilege escalation vulnerability—CVE-2020-1472—in Windows Netlogon. The commonly used tactic, known as vulnerability chaining, exploits multiple vulnerabilities in the course of a single intrusion to compromise a network or application. 

This recent malicious activity has often, but not exclusively, been directed at federal and state, local, tribal, and territorial (SLTT) government networks. Although it does not appear these targets are being selected because of their proximity to elections information, there may be some risk to elections information housed on government networks.

CISA is aware of some instances where this activity resulted in unauthorized access to elections support systems; however, CISA has no evidence to date that integrity of elections data has been compromised. There are steps that election officials, their supporting SLTT IT staff, and vendors can take to help defend against this malicious cyber activity.

Some common tactics, techniques, and procedures used by APT actors include leveraging legacy network access and virtual private network (VPN) vulnerabilities in association with the recent critical CVE-2020-1472 Netlogon vulnerability. CISA is aware of multiple cases where the Fortinet FortiOS Secure Socket Layer (SSL) VPN vulnerability CVE-2018-13379 has been exploited to gain access to networks. To a lesser extent, CISA has also observed threat actors exploiting the MobileIron vulnerability CVE-2020-15505. While these exploits have been observed recently, this activity is ongoing and still unfolding. CISA recommends network staff and administrators review internet-facing infrastructure for vulnerabilities, including Juniper CVE-2020-1631, Pulse Secure CVE-2019-11510,  Citrix NetScaler CVE-2020-19781, and Palo Alto Networks CVE-2020-2021 (this list is not considered exhaustive).

After gaining initial access, the actors exploit CVE-2020-1472 to compromise all Active Directory (AD) identity services. Actors have then been observed using legitimate remote access tools, such as VPN and Remote Desktop Protocol (RDP), to access the environment with the compromised credentials. Observed activity targets multiple sectors, and is not limited to SLTT entities.

Click here for a PDF version of this report.

Technical DetailsInitial Access

APT threat actors are actively leveraging legacy vulnerabilities in internet-facing infrastructure (Exploit Public-Facing Application [T1190], External Remote Services [T1133]) to gain initial access into systems. The APT actors appear to have predominately gained initial access via the Fortinet FortiOS VPN vulnerability CVE-2018-13379; however, other vulnerabilities, listed below, have been observed (as analysis is evolving, these listed vulnerabilities should not be considered comprehensive).

• Citrix NetScaler CVE-2020-19781
• MobileIron CVE-2020-15505
• Pulse Secure CVE-2019-11510
• Palo Alto Networks CVE-2020-2021
• F5 BIG-IP CVE-2020-5902

FortiGuard ForitOS SSL VPN CVE-2018-13379

CVE-2018-13379 is a path traversal vulnerability in the FortiOS SSL VPN web portal. An unauthenticated attacker could exploit this vulnerability to download FortiOS system files through specially crafted HTTP resource requests.

MobileIron Core & Connector Vulnerability CVE-2020-15505

CVE-202-15505 is a remote code execution vulnerability in MobileIron Core & Connector versions 10.3 and earlier. This vulnerability allows an external attacker, with no privileges, to execute code of their choice on the vulnerable system. As mobile device management (MDM) systems are critical to configuration management for external devices, they are usually highly permissioned and make a valuable target for threat actors.

Privilege Escalation

Post initial access, the APT actors use multiple techniques to expand access to the environment. The actors are leveraging CVE-2020-1472 in Windows Netlogon to escalate privileges and obtain access to Windows AD servers. Actors are also leveraging the opensource tools such as Mimikatz and the CrackMapExec tool to obtain Valid Account [T1078] credentials from AD servers.

Microsoft Netlogon Remote Protocol Vulnerability: CVE-2020-1472

CVE-2020-1472 is a vulnerability in Microsoft Windows Netlogon Remote Protocol (MS-NRPC), a core authentication component of Active Directory. This vulnerability could allow an unauthenticated attacker with network access to a domain controller to completely compromise all AD identity services (Valid Accounts: Domain Accounts [T1078.002]). Malicious actors can leverage this vulnerability to compromise other devices on the network (Lateral Movement [TA0008]).

Persistence

Once system access has been achieved, the APT actors use abuse of legitimate credentials (Valid Account [T1078]) to log in via VPN or Remote Access Services [T1133] to maintain persistence.

Mitigations

Organizations with externally facing infrastructure devices that have the vulnerabilities listed in this joint cybersecurity advisory, or other vulnerabilities, should move forward with an “assume breach” mentality. As initial exploitation and escalation may be the only observable exploitation activity, most mitigations will need to focus on more traditional network hygiene and user management activities.

Keep Systems Up to Date

Patch systems and equipment promptly and diligently. Establishing and consistently maintaining a thorough patching cycle continues to be the best defense against adversary TTPs. See table 1 for patch information on CVEs mentioned in this report.

Table 1: Patch information for exploited CVEs

Vulnerability Vulnerable Products Patch Information CVE-2018-13379

• FortiOS 6.0
• FortiOS 5.6  
• FortiOS 5.4

• Fortiguard Security Advisory: FG-IR-18-384

CVE-2019-19781

• Citrix Application Delivery Controller
• Citrix Gateway
• Citrix SDWAN WANOP

• Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway versions 11.1 and 12.0  
• Citrix blog post: security updates for Citrix SD-WAN WANOP release 10.2.6 and 11.0.3
• Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway versions 12.1 and 13.0
• Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway version 10.5

CVE-2020-5902

• Big-IP devices (LTM, AAM, Advanced WAF, AFM, Analytics, APM, ASM, DDHD, DNS, FPS, GTM, Link Controller, PEM, SSLO, CGNAT)

• F5 Security Advisory: K52145254: TMUI RCE vulnerability CVE-2020-5902

CVE-2020-11510

• Pulse Connect Secure 9.0R1 - 9.0R3.3, 8.3R1 - 8.3R7, 8.2R1 - 8.2R12, 8.1R1 - 8.1R15
• Pulse Policy Secure 9.0R1 - 9.0R3.1, 5.4R1 - 5.4R7, 5.3R1 - 5.3R12, 5.2R1 - 5.2R12, 5.1R1 - 5.1R15

• Pulse Secure Out-of-Cycle Advisory: Multiple vulnerabilities resolved in Pulse Connect Secure / Pulse Policy Secure 9.0RX

CVE-2020-15505

• MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0  
• Sentry versions 9.7.2 and earlier, and 9.8.0;  
• Monitor and Reporting Database (RDB) version 2.0.0.1 and earlier

• Mobile Iron Blog: MobileIron Security Updates Available

CVE-2020-1631

• Junos OS 12.3, 12.3X48, 14.1X53, 15.1, 15.1X49, 15.1X53, 17.2, 17.3, 17.4, 18.1, 18.2, 18.3, 18.4, 19.1, 19.2, 19.3, 19.4, 20.1

• Juniper Security Advisory JSA11021

CVE-2020-2021

• PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15, and all versions of PAN-OS 8.0 (EOL)

• Palo Alto Networks Security Advisory for CVE-2020-2021

CVE-2020-1472

• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
• Windows Server 2012
• Windows Server 2012 (Server Core installation)
• Windows Server 2012 R2
• Windows Server 2016
• Windows Server 2019
• Windows Server 2019 (Server Core installation)
• Windows Server, version 1903  (Server Core installation)
• Windows Server, version 1909  (Server Core installation)
• Windows Server, version 2004   (Server Core installation)

• Microsoft Security Advisory for CVE-2020-1472

Comprehensive Account Resets

If there is an observation of CVE-2020-1472 Netlogon activity or other indications of valid credential abuse detected, it should be assumed the APT actors have compromised AD administrative accounts, the AD forest should not be fully trusted, and, therefore, a new forest should be deployed. Existing hosts from the old compromised forest cannot be migrated in without being rebuilt and rejoined to the new domain, but migration may be done through “creative destruction,” wherein as endpoints in the legacy forest are decommissioned, new ones can be built in the new forest. This will need to be completed on on-premise as well as Azure hosted AD instances.

Note that fully resetting an AD forest is difficult and complex; it is best done with the assistance of personnel who have successfully completed the task previously.

It is critical to perform a full password reset on all user and computer accounts in the AD forest. Use the following steps as a guide.

1. Create a temporary administrator account, and use this account only for all administrative actions
2. Reset the Kerberos Ticket Granting Ticket (krbtgt) password; this must be completed before any additional actions and a second reset will take place in step 5
3. Wait for the krbtgt reset to propagate to all domain controllers (time may vary)
4. Reset all account passwords (passwords should be 15 characters or more and randomly assigned):
   1. User accounts (forced reset with no legacy password reuse)
   2. Local accounts on hosts (including local accounts not covered by Local Administrator Password Solution [LAPS])
   3. Service accounts
   4. Directory Services Restore Mode (DSRM) account
   5. Domain Controller machine account
   6. Application passwords
5. Reset the krbtgt password again
6. Wait for the krbtgt reset to propagate to all domain controllers (time may vary)
7. Reboot domain controllers
8. Reboot all endpoints

The following accounts should be reset:

• AD Kerberos Authentication Master (2x)
• All Active Directory Accounts
• All Active Directory Admin Accounts
• All Active Directory Service Accounts
• All Active Directory User Accounts
• DSRM Account on Domain Controllers
• Non-AD Privileged Application Accounts
• Non-AD Unprivileged Application Accounts
• Non-Windows Privileged Accounts
• Non-Windows User Accounts
• Windows Computer Accounts
• Windows Local Admin

VPN Vulnerabilities

Implement the following recommendations to secure your organization’s VPNs:

• Update VPNs, network infrastructure devices, and devices being used to remote into work environments with the latest software patches and security configurations. See CISA Tips Understanding Patches and Securing Network Infrastructure Devices. Wherever possible, enable automatic updates. See table 1 for patch information on VPN-related CVEs mentioned in this report.
• Implement multi-factor authentication (MFA) on all VPN connections to increase security. Physical security tokens are the most secure form of MFA, followed by authenticator app-based MFA. SMS and email-based MFA should only be used when no other forms are available. If MFA is not implemented, require teleworkers to use strong passwords. See CISA Tips Choosing and Protecting Passwords and Supplementing Passwords for more information.

Discontinue unused VPN servers. Reduce your organization’s attack surface by discontinuing unused VPN servers, which may act as a point of entry for attackers. How to protect your organization against VPN vulnerabilities:

• Audit configuration and patch management programs.
• Monitor network traffic for unexpected and unapproved protocols, especially outbound to the internet (e.g., SSH, SMB, RDP).
• Implement MFA, especially for privileged accounts.
• Use separate administrative accounts on separate administration workstations.
• Keep software up to date. Enable automatic updates, if available.  

To secure your organization’s Netlogon channel connections:

• Update all Domain Controllers and Read Only Domain Controllers. On August 11, 2020, Microsoft released software updates to mitigate CVE-2020-1472. Applying this update to domain controllers is currently the only mitigation to this vulnerability (aside from removing affected domain controllers from the network).
• Monitor for new events, and address non-compliant devices that are using vulnerable Netlogon secure channel connections.
• Block public access to potentially vulnerable ports, such as 445 (SMB) and 135 (RPC).

To protect your organization against this CVE, follow advice from Microsoft, including:

• Update your domain controllers with an update released August 11, 2020 or later.
• Find which devices are making vulnerable connections by monitoring event logs.
• Address non-compliant devices making vulnerable connections.
• Enable enforcement mode to address CVE-2020-1472 in your environment.

How to uncover and mitigate malicious activity

• Collect and remove for further analysis:
  • Relevant artifacts, logs, and data
• Implement mitigation steps that avoid tipping off the adversary that their presence in the network has been discovered.
• Consider soliciting incident response support from a third-party IT security organization to:
  • Provide subject matter expertise and technical support to the incident response,
  • Ensure that the actor is eradicated from the network, and
  • Avoid residual issues that could result in follow-up compromises once the incident is closed

Resources

• CISA VPN-Related Guidance
• CISA Infographic: Risk Vulnerability And Assessment (RVA) Mapped to the MITRE ATT&CK FRAMEWORK
• National Security Agency InfoSheet: Configuring IPsec Virtual Private Networks
• CISA Joint Advisory: AA20-245A: Technical Approaches to Uncovering and Remediating Malicious Activity
• CISA Activity Alert: AA20-073A: Enterprise VPN Security
• CISA Activity Alert: AA20-031A: Detecting Citrix CVE-2019-19781
• CISA Activity Alert: AA20-010A: Continued Exploitation of Pulse Secure VPN Vulnerability
• Cybersecurity Alerts and Advisories: Subscriptions to CISA Alerts and MS-ISAC Advisories

Contact Information

Recipients of this report are encouraged to contribute any additional information that they may have related to this threat.

For any questions related to this report or to report an intrusion and request resources for incident response or technical assistance, please contact:

• CISA (888-282-0870 or Central@cisa.dhs.gov), or
• The FBI through the FBI Cyber Division (855-292-3937 or CyWatch@fbi.gov) or a local field office

  DISCLAIMER   This information is provided "as is" for informational purposes only. The United States Government does not provide any warranties of any kind regarding this information. In no event shall the United States Government or its contractors or subcontractors be liable for any damages, including but not limited to, direct, indirect, special or consequential damages, arising out of, resulting from, or in any way connected with this information, whether or not based upon warranty, contract, tort, or otherwise, whether or not arising out of negligence, and whether or not injury was sustained from, or arose out of the results of, or reliance upon the information.

The United States Government does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply their endorsement, recommendation, or favoring by the United States Government.

 

Revisions

• October 9, 2020: Initial Version

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: October 6, 2020
Summary

This Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques.

This product was written by the Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State Information Sharing & Analysis Center (MS-ISAC).

Emotet—a sophisticated Trojan commonly functioning as a downloader or dropper of other malware—resurged in July 2020, after a dormant period that began in February. Since August, CISA and MS-ISAC have seen a significant increase in malicious cyber actors targeting state and local governments with Emotet phishing emails. This increase has rendered Emotet one of the most prevalent ongoing threats.

To secure against Emotet, CISA and MS-ISAC recommend implementing the mitigation measures described in this Alert, which include applying protocols that block suspicious attachments, using antivirus software, and blocking suspicious IPs.

Technical Details

Emotet is an advanced Trojan primarily spread via phishing email attachments and links that, once clicked, launch the payload (Phishing: Spearphishing Attachment [T1566.001], Phishing: Spearphishing Link [T1566.002]).The malware then attempts to proliferate within a network by brute forcing user credentials and writing to shared drives (Brute Force: Password Guessing [T1110.001], Valid Accounts: Local Accounts [T1078.003], Remote Services: SMB/Windows Admin Shares [T1021.002]).

Emotet is difficult to combat because of its “worm-like” features that enable network-wide infections. Additionally, Emotet uses modular Dynamic Link Libraries to continuously evolve and update its capabilities.

Since July 2020, CISA has seen increased activity involving Emotet-associated indicators. During that time, CISA’s EINSTEIN Intrusion Detection System, which protects federal, civilian executive branch networks, has detected roughly 16,000 alerts related to Emotet activity. CISA observed Emotet being executed in phases during possible targeted campaigns. Emotet used compromised Word documents (.doc) attached to phishing emails as initial insertion vectors. Possible command and control network traffic involved HTTP POST requests to Uniform Resource Identifiers consisting of nonsensical random length alphabetical directories to known Emotet-related domains or IPs with the following user agent string (Application Layer Protocol: Web Protocols [T1071.001]).

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR

Traffic to known Emotet-related domains or IPs occurred most commonly over ports 80, 8080, and 443. In one instance, traffic from an Emotet-related IP attempted to connect to a suspected compromised site over port 445, possibly indicating the use of Server Message Block exploitation frameworks along with Emotet (Exploitation of Remote Services [T1210]). Figure 1 lays out Emotet’s use of enterprise techniques.

 

​

Figure 1: MITRE ATT&CK enterprise techniques used by Emotet

  Timeline of Activity

The following timeline identifies key Emotet activity observed in 2020.

• February: Cybercriminals targeted non-U.S. countries using COVID-19-themed phishing emails to lure victims to download Emotet.[1]

• July: Researchers spotted emails with previously used Emotet URLs, particularly those used in the February campaign, targeting U.S. businesses with COVID-19-themed lures.[2]

• August:
  • Security researchers observed a 1,000 percent increase in downloads of the Emotet loader. Following this change, antivirus software firms adjusted their detection heuristics to compensate, leading to decreases in observed loader downloads.[3]  
  • Proofpoint researchers noted mostly minimal changes in most tactics and tools previously used with Emotet. Significant changes included:
    • Emotet delivering Qbot affiliate partner01 as the primary payload and
    • The Emotet mail sending module’s ability to deliver benign and malicious attachments.[4]
  • CISA and MS-ISAC observed increased attacks in the United States, particularly cyber actors using Emotet to target state and local governments.

• September:
  • Cyber agencies and researchers alerted the public of surges of Emotet, including compromises in Canada, France, Japan, New Zealand, Italy, and the Netherlands. Emotet botnets were observed dropping Trickbot to deliver ransomware payloads against some victims and Qakbot Trojans to steal banking credentials and data from other targets.[5],[6],[7],[8]
  • Security researchers from Microsoft identified a pivot in tactics from the Emotet campaign. The new tactics include attaching password-protected archive files (e.g., Zip files) to emails to bypass email security gateways. These email messages purport to deliver documents created on mobile devices to lure targeted users into enabling macros to “view” the documents—an action which actually enables the delivery of malware.[9]
  • Palo Alto Networks reported cyber actors using thread hijacking to spread Emotet. This attack technique involves stealing an existing email chain from an infected host to reply to the chain—using a spoofed identity—and attaching a malicious document to trick recipients into opening the file.[10]

MITRE ATT&CK Techniques

According to MITRE, Emotet uses the ATT&CK techniques listed in table 1.

Table 1: Common exploit tools

Technique

Use

OS Credential Dumping: LSASS Memory [T1003.001]

Emotet has been observed dropping password grabber modules including Mimikatz.

Remote Services: SMB/Windows Admin Shares [T1021.002]

Emotet leverages the Admin$ share for lateral movement once the local admin password has been brute forced.

Obfuscated Files or Information [T1027]

Emotet has obfuscated macros within malicious documents to hide the URLs hosting the malware, cmd.exe arguments, and PowerShell scripts.

Obfuscated Files or Information: Software Packing [T1027.002]

Emotet has used custom packers to protect its payloads.

Network Sniffing [T1040]

Emotet has been observed to hook network APIs to monitor network traffic.

Exfiltration Over C2 Channel [T1041]

Emotet has been seen exfiltrating system information stored within cookies sent within a HTTP GET request back to its command and control (C2) servers.

Windows Management Instrumentation [T1047]

Emotet has used WMI to execute powershell.exe.

Process Injection: Dynamic-link Library Injection [T1055.001]

Emotet has been observed injecting in to Explorer.exe and other processes.

Process Discovery [T1057]

Emotet has been observed enumerating local processes.

Command and Scripting Interpreter: PowerShell [T1059.001]

Emotet has used Powershell to retrieve the malicious payload and download additional resources like Mimikatz.

Command and Scripting Interpreter: Windows Command Shell [T1059.003]

Emotet has used cmd.exe to run a PowerShell script.

Command and Scripting Interpreter: Visual Basic [T1059.005]

Emotet has sent Microsoft Word documents with embedded macros that will invoke scripts to download additional payloads.

Valid Accounts: Local Accounts [T1078.003]

Emotet can brute force a local admin password, then use it to facilitate lateral movement.

Account Discovery: Email Account [T1087.003]

Emotet has been observed leveraging a module that can scrape email addresses from Outlook.

Brute Force: Password Guessing [T1110.001]

Emotet has been observed using a hard-coded list of passwords to brute force user accounts.

Email Collection: Local Email Collection [T1114.001]

Emotet has been observed leveraging a module that scrapes email data from Outlook.

User Execution: Malicious Link [T1204.001]

Emotet has relied upon users clicking on a malicious link delivered through spearphishing.

User Execution: Malicious File [T1204.002]

Emotet has relied upon users clicking on a malicious attachment delivered through spearphishing.

Exploitation of Remote Services [T1210]

Emotet has been seen exploiting SMB via a vulnerability exploit like ETERNALBLUE (MS17-010) to achieve lateral movement and propagation.

Create or Modify System Process: Windows Service [T1543.003]

Emotet has been observed creating new services to maintain persistence.

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder [T1547.001]

Emotet has been observed adding the downloaded payload to the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key to maintain persistence.

Scheduled Task/Job: Scheduled Task [T1053.005]

Emotet has maintained persistence through a scheduled task.

Unsecured Credentials: Credentials In Files [T1552.001]

Emotet has been observed leveraging a module that retrieves passwords stored on a system for the current logged-on user.

Credentials from Password Stores: Credentials from Web Browsers [T1555.003]

Emotet has been observed dropping browser password grabber modules.

Archive Collected Data [T1560]

Emotet has been observed encrypting the data it collects before sending it to the C2 server.

Phishing: Spearphishing Attachment [T1566.001]

Emotet has been delivered by phishing emails containing attachments.

Phishing: Spearphishing Link [T1566.002]

Emotet has been delivered by phishing emails containing links.

Non-Standard Port [T1571]

Emotet has used HTTP over ports such as 20, 22, 7080, and 50000, in addition to using ports commonly associated with HTTP/Hypertext Transfer Protocol Secure.

Encrypted Channel: Asymmetric Cryptography [T1573.002]

Emotet is known to use RSA keys for encrypting C2 traffic.

Detection Signatures

MS-ISAC developed the following Snort signature for use in detecting network activity associated with Emotet activity.

alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"[CIS] Emotet C2 Traffic Using Form Data to Send Passwords"; content:"POST"; http_method; content:"Content-Type|3a 20|multipart/form-data|3b 20|boundary="; http_header; fast_pattern; content:"Content-Disposition|3a 20|form-data|3b 20|name=|22|"; http_client_body; content:!"------WebKitFormBoundary"; http_client_body; content:!"Cookie|3a|"; pcre:"/:?(chrome|firefox|safari|opera|ie|edge) passwords/i"; reference:url,cofense.com/flash-bulletin-emotet-epoch-1-changes-c2-communication/; sid:1; rev:2;)

CISA developed the following Snort signatures for use in detecting network activity associated with Emotet activity. Note: Uniform Resource Identifiers should contain a random length alphabetical multiple directory string, and activity will likely be over ports 80, 8080, or 443.

alert tcp any any -> any $HTTP_PORTS (msg:"EMOTET:HTTP URI GET contains '/wp-content/###/'"; sid:00000000; rev:1; flow:established,to_server; content:"/wp-content/"; http_uri; content:"/"; http_uri; distance:0; within:4; content:"GET"; nocase; http_method; urilen:<17; classtype:http-uri; content:"Connection|3a 20|Keep-Alive|0d 0a|"; http_header; metadata:service http;)

alert tcp any any -> any $HTTP_PORTS (msg:"EMOTET:HTTP URI GET contains '/wp-admin/###/'"; sid:00000000; rev:1; flow:established,to_server; content:"/wp-admin/"; http_uri; content:"/"; http_uri; distance:0; within:4; content:"GET"; nocase; http_method; urilen:<15; content:"Connection|3a 20|Keep-Alive|0d 0a|"; http_header; classtype:http-uri; metadata:service http;)

Mitigations

CISA and MS-ISAC recommend that network defenders—in federal, state, local, tribal, territorial governments, and the private sector—consider applying the following best practices to strengthen the security posture of their organization's systems. System owners and administrators should review any configuration changes prior to implementation to avoid unwanted impacts.

• Block email attachments commonly associated with malware (e.g.,.dll and .exe).
• Block email attachments that cannot be scanned by antivirus software (e.g., .zip files).
• Implement Group Policy Object and firewall rules.
• Implement an antivirus program and a formalized patch management process.
• Implement filters at the email gateway, and block suspicious IP addresses at the firewall.
• Adhere to the principle of least privilege.
• Implement a Domain-Based Message Authentication, Reporting & Conformance validation system.
• Segment and segregate networks and functions.
• Limit unnecessary lateral communications.
• Disable file and printer sharing services. If these services are required, use strong passwords or Active Directory authentication.
• Enforce multi-factor authentication.
• Exercise caution when opening email attachments, even if the attachment is expected and the sender appears to be known. See Using Caution with Email Attachments.
• Enable a firewall on agency workstations, configured to deny unsolicited connection requests.
• Disable unnecessary services on agency workstations and servers.
• Scan for and remove suspicious email attachments; ensure the scanned attachment is its "true file type" (i.e., the extension matches the file header).
• Monitor users' web browsing habits; restrict access to suspicious or risky sites.
• Exercise caution when using removable media (e.g., USB thumb drives, external drives, CDs).
• Scan all software downloaded from the internet prior to executing.
• Maintain situational awareness of the latest threats and implement appropriate access control lists.
• Visit the MITRE ATT&CK Techniques pages (linked in table 1 above) for additional mitigation and detection strategies.
• See CISA’s Alert on Technical Approaches to Uncovering and Remediating Malicious Activity for more information on addressing potential incidents and applying best practice incident response procedures.
• See the joint CISA and MS-ISAC Ransomware Guide on how to be proactive and prevent ransomware attacks from happening and for a detailed approach on how to respond to an attack and best resolve the cyber incident.

For additional information on malware incident prevention and handling, see the National Institute of Standards and Technology Special Publication 800-83, Guide to Malware Incident Prevention and Handling for Desktops and Laptops.

Resources

• MS-ISAC Security Event Primer – Emotet
• CISA Alert TA18-201A – Emotet Malware
• MITRE ATT&CK – Emotet
• MITRE ATT&CK for Enterprise

References

• [1] Bleeping Computer: Emotet Malware Strikes U.S. Businesses with COVID-19 Spam
• [2] IBID
• [3] Security Lab: Emotet Update Increases Downloads
• [4] Proofpoint: A Comprehensive Look at Emotet’s Summer 2020 Return
• [5] ZDNet: France, Japan, New Zealand Warn of Sudden Strike in Emotet Attacks
• [6] Bleeping Computer: France Warns of Emotet Attacking Companies, Administration
• [7] ESET: Emotet Strikes Quebec’s Department of Justice: An ESET Analysis
• [8] ZDNet: Microsoft, Italy, and the Netherlands Warn of Increased Emotet Activity
• [9] Bleeping Computer: Emotet Double Blunder: Fake ‘Windows 10 Mobile’ and Outdated Messages
• [10] Palo Alto Networks: Case Study: Emotet Thread Hijacking, an Email Attack Technique

Revisions

• October 6, 2020: Initial Version

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: October 1, 2020
Summary

This Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques.

In light of heightened tensions between the United States and China, the Cybersecurity and Infrastructure Security Agency (CISA) is providing specific Chinese government and affiliated cyber threat actor tactics, techniques, and procedures (TTPs) and recommended mitigations to the cybersecurity community to assist in the protection of our Nation’s critical infrastructure. In addition to the recommendations listed in the Mitigations section of this Alert, CISA recommends organizations take the following actions.

1. Adopt a state of heightened awareness. Minimize gaps in personnel availability, consistently consume relevant threat intelligence, and update emergency call trees.
2. Increase organizational vigilance. Ensure security personnel monitor key internal security capabilities and can identify anomalous behavior. Flag any known Chinese indicators of compromise (IOCs) and TTPs for immediate response.
3. Confirm reporting processes. Ensure personnel know how and when to report an incident. The well-being of an organization’s workforce and cyber infrastructure depends on awareness of threat activity. Consider reporting incidents to CISA to help serve as part of CISA’s early warning system (see the Contact Information section below).
4. Exercise organizational incident response plans. Ensure personnel are familiar with the key steps they need to take during an incident. Do they have the accesses they need? Do they know the processes? Are various data sources logging as expected? Ensure personnel are positioned to act in a calm and unified manner.

Technical DetailsChina Cyber Threat Profile

China has a history of using national military and economic resources to leverage offensive cyber tactics in pursuing its national interests. The “Made in China 2025” 10-year plan outlines China’s top-level policy priorities.[1],[2] China may seek to target the following industries deemed critical to U.S. national and economic interests: new energy vehicles, next generation information technology (IT), biotechnology, new materials, aerospace, maritime engineering and high-tech ships, railway, robotics, power equipment, and agricultural machinery.[3] China has exercised its increasingly sophisticated capabilities to illegitimately obtain U.S. intellectual property (IP), suppress both social and political perspectives deemed dangerous to China, and harm regional and international opponents.

The U.S. Intelligence Community and various private sector threat intelligence organizations have identified the Chinese People’s Liberation Army (PLA) and Ministry of State Security (MSS) as driving forces behind Chinese state-sponsored cyberattacks–either through contractors in the Chinese private sector or by the PLA and MSS entities themselves. China continues to engage in espionage-related activities that include theft of sensitive information such as innovation capital, IP, and personally identifiable information (PII). China has demonstrated a willingness to push the boundaries of their activities to secure information critical to advancing their economic prowess and competitive advantage.

Chinese Cyber Activity

According to open-source reporting, offensive cyber operations attributed to the Chinese government targeted, and continue to target, a variety of industries and organizations in the United States, including healthcare, financial services, defense industrial base, energy, government facilities, chemical, critical manufacturing (including automotive and aerospace), communications, IT, international trade, education, videogaming, faith-based organizations, and law firms.

Additionally, numerous Department of Justice (DOJ) indictments over several years provide evidence to suggest Chinese threat actors continuously seek to illegally obtain and exfiltrate U.S. IP. Their targets also include western companies with operations inside China.

Public reporting that associates Chinese actors with a range of high-profile attacks and offensive cyber activity includes:

• February 2013 – Cyber Threat Intelligence Researchers Link Advanced Persistent Threat (APT) 1 to China: a comprehensive report publicly exposed APT1 as part of China’s military cyber operations and a multi-year effort that exfiltrated IP from roughly 141 companies spanning 20 major industries.[4] APT1 established access to the victims’ networks and methodically exfiltrated IP across a large range of industries identified in China’s 12th 5-Year Plan. A year later, the DOJ indicted Chinese cyber threat actors assigned to PLA Unit 61398 for the first time (also highlighted in the report).[5]
• April 2017 – Chinese APTs Targeting IP in 12 Countries: CISA announced Chinese state-backed APTs carried out a multi-year campaign of cyber-enabled IP theft that targeted global technology service providers and their customers. The threat actors leveraged stolen administrative credentials (local and domain) and placed sophisticated malware on critical systems in an effort to steal the IP and sensitive data of companies located in at least 12 countries.[6]
• December 2018 – Chinese Cyber Threat Actors Indicted for Compromising Managed Service Providers (MSPs): DOJ indicted two Chinese cyber threat actors believed to be associated with APT10, who targeted MSPs and their large customer base through phishing and spearphishing campaigns aimed at exfiltrating sensitive business data and, possibly, PII.[7] CISA also briefed stakeholders on Chinese APT groups who targeted MSPs and their customers to steal data and further operationalize commercial and economic espionage.[8]
• February 2020 – China’s Military Indicted for 2017 Equifax Hack: DOJ indicted members of China’s PLA for stealing large amounts of PII and IP. The Chinese cyber threat actors exploited a vulnerability in the company’s dispute resolution website to enter the network, conduct reconnaissance, upload malware, and steal credentials to extract the targeted data. The breach impacted roughly half of all American citizens and stole Equifax’s trade secrets.[9]
• May 2020 – China Targets COVID-19 Research Organizations: the Federal Bureau of Investigation (FBI) and CISA reported the targeting and compromise of U.S. organizations conducting COVID-19-related research by cyber actors affiliated with China.[10] Large-scale password spraying campaigns were a commonly observed tactic in illicitly obtaining IP related to vaccines, treatments, and testing from networks and personnel affiliated with COVID-19-related research.[11],[12]

Common TTPs of Publicly Known Chinese Threat Actors

The section below provides common, publicly known, TTPs employed by Chinese threat actors, which map to the MITRE ATT&CK framework. Where possible, the tables include actions for detection and mitigation. This section is not exhaustive and does not detail all TTPs or detection and mitigation actions.   

PRE-ATT&CK TTPs

Chinese threat actors commonly use the techniques listed in table 1 to achieve reconnaissance (Technical Information Gathering [TA0015]), staging (Stage Capabilities [TA0026]), and testing (Test Capabilities [TA0025]) before executing an attack. PRE-ATT&CK techniques can be difficult to detect and mitigate, however, defenders should be aware of the use of these techniques.

Table 1: Chinese threat actor PRE-ATT&CK techniques

Technique Description Acquire and/or Use 3rd Party Software Services [T1330] Staging and launching attacks from software as a service solutions that cannot be easily tied back to the APT Compromise 3rd Party Infrastructure to Support Delivery [T1334] Compromising infrastructure owned by other parties to facilitate attacks (instead of directly purchasing infrastructure) Domain Registration Hijacking [T1326] Changing the registration of a domain name without the permission of its original registrant and then using the legitimate domain as a launch point for malicious purposes Acquire Open-Source Intelligence (OSINT) Data Sets and Information [T1247] Gathering data and information from publicly available sources, including public-facing websites of the target organization Conduct Active Scanning [T1254] Gathering information on target systems by scanning the systems for vulnerabilities. Adversaries are likely using tools such as Shodan to identify vulnerable devices connected to the internet Analyze Architecture and Configuration Posture [T1288] Analyzing technical scan results to identify architectural flaws, misconfigurations, or improper security controls in victim networks Upload, Install, and Configure Software/Tools [T1362] Placing malware on systems illegitimately for use during later stages of an attack to facilitate exploitability and gain remote access Enterprise ATT&CK TTPs

Chinese threat actors often employ publicly known TTPs against enterprise networks. To orchestrate attacks, they use commonly implemented security testing tools and frameworks, such as:

• Cobalt Strike and Beacon
• Mimikatz
• PoisonIvy
• PowerShell Empire
• China Chopper Web Shell

Table 2 lists common, publicly known, TTPs used by Chinese threat actors against enterprise networks and provides options for detection and mitigation based on the MITRE ATT&CK framework.

Table 2: Common Chinese threat actor techniques, detection, and mitigation

Technique / Sub-Technique Detection Mitigation Obfuscated Files or Information [T1027]

• Detect obfuscation by analyzing signatures of modified files.
• Flag common syntax used in obfuscation.

• Use antivirus/antimalware software to analyze commands after processing.

Phishing: Spearphishing Attachment [T1566.001] and Spearphishing Link [T1566.002]

• Use network intrusion detection systems (NIDS) and email gateways to detect suspicious attachments in email entering the network.
• Use detonation chambers to inspect email attachments in isolated environments.

• Quarantine suspicious files with antivirus solutions.
• Use network intrusion prevention systems to scan and remove malicious email attachments.
• Train users to identify phishing emails and notify IT.

System Network Configuration Discovery [T1016]

• Monitor for processes and command-line arguments that could be used by an adversary to gather system and network information.

• This technique is difficult to mitigate with preventative controls; organizations should focus on detecting and responding to malicious activity to limit impact.

Command and Scripting Interpreter: Windows Command Shell [T1059.003]

• Identify normal scripting behavior on the system then monitor processes and command-line arguments for suspicious script execution behavior.

• Only permit execution of signed scripts.
• Disable any unused shells or interpreters.

   

User Execution: Malicious File [T1204.002]

• Monitor execution of command-line arguments for applications (including compression applications) that may be used by an adversary to execute a user interaction.
• Set antivirus software to detect malicious documents and files downloaded and installed on endpoints.

• Use execution prevention to prevent the running of executables disguised as other files.
• Train users to identify phishing attacks and other malicious events that may require user interaction.

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder [T1547.001]

• Monitor the start folder for additions and changes.
• Monitor registry for changes to run keys that do not correlate to known patches or software updates.

• This technique is difficult to mitigate with preventative controls; organizations should focus on detecting and responding to malicious activity to limit impact.

Command and Scripting Interpreter: PowerShell [T1059.001]

• Enable PowerShell logging.
• Monitor for changes in PowerShell execution policy as a method of identifying malicious use of PowerShell.
• Monitor for PowerShell execution generally in environments where PowerShell is not typically used.

• Set PowerShell execution policy to execute only signed scripts.
• Disable PowerShell if not needed by the system.
• Disable WinRM service to help prevent use of PowerShell for remote execution.
• Restrict PowerShell execution policy to administrators.

Hijack Execution Flow: DLL Side-Loading [T1574.002]

• Track Dynamic Link Library (DLL) metadata, and compare DLLs that are loaded at process execution time against previous executions to detect usual differences unrelated to patching.

• Use the program sxstrace.exe to check manifest files for side-loading vulnerabilities in software.
• Update software regularly including patches for DLL side-loading vulnerabilities.

Ingress Tool Transfer [T1105]

• Monitor for unexpected file creation or files transfer into the network from external systems, which may be indicative of attackers staging tools in the compromised environment.
• Analyze network traffic for unusual data flows (i.e., a client sending much more data than it receives from a server).

• Use network intrusion detection and prevention systems to identify traffic for specific adversary malware or unusual data transfer over protocols such as File Transfer Protocol.

Remote System Discovery [T1018]

• Monitor processes and command-line arguments for actions that could be taken to gather system and network information.
• In cloud environments, usage of commands and application program interfaces (APIs) to request information about remote systems combined with additional unexpected commands may be a sign of malicious use.

• This technique is difficult to mitigate with preventative controls; organizations should focus on detecting and responding to malicious activity to limit impact.

Software Deployment Tools [T1072]

• Identify the typical use pattern of third-party deployment software, then monitor for irregular deployment activity.

• Isolate critical network systems access using group policies, multi-factor authentication (MFA), and firewalls.
• Patch deployment systems regularly.
• Use unique and limited credentials for access to deployment systems.

Brute Force: Password Spraying [T1110.003]

• Monitor logs for failed authentication attempts to valid accounts.

• Use MFA.
• Set account lockout policies after a certain number of failed login attempts.

Network Service Scanning [T1046]

• Use NIDS to identify scanning activity.

• Close unnecessary ports and services.
• Segment network to protect critical servers and devices.

Email Collection [T1114]

• Monitor processes and command-line arguments for actions that could be taken to gather local email files.

• Encrypt sensitive emails.
• Audit auto-forwarding email rules regularly.
• Use MFA for public-facing webmail servers.

Proxy: External Proxy [T1090.002]

• Analyze network data for uncommon data flows, such as a client sending significantly more data than it receives from an external server.

• Use NIDS and prevention systems to identify traffic for specific adversary malware using network signatures.

Drive-by Compromise [T1189]

• Use Firewalls and proxies to inspect URLs for potentially known-bad domains or parameters.
• Monitor network intrusion detection systems (IDS) to detect malicious scripts, and monitor endpoints for abnormal behavior.

 

• Isolate and sandbox impacted systems and applications to restrict the spread of malware.
• Leverage security applications to identify malicious behavior during exploitation.
• Restrict web-based content through ad-blockers and script blocking extensions.

Server Software Component: Web Shell [T1505.003]

• Analyze authentication logs, files, netflow/enclave netflow, and leverage process monitoring to discover anomalous activity.

• Patch vulnerabilities in internet facing applications.
• Leverage file integrity monitoring to identify file changes.
• Configure server to block access to the web accessible directory through principle of least privilege.

Application Layer Protocol: File Transfer Protocols [T1071.002] and DNS [T1071.004]

• Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server).
• Analyze packet contents to detect application layer protocols that do not follow the expected protocol standards regarding syntax, structure, or any other variable adversaries could leverage to conceal data.

• Leverage NIDS and NIPS using network signatures to identify traffic for specific adversary malware.

Additional APT Activity

The TTPs listed above have been repeatedly used across the spectrum of Chinese threat actors. The mitigations referenced in this alert can help reduce vulnerability to these TTPs; however, defenders should also maintain heightened awareness of threats actors that are more innovative in their approach, making it difficult to detect and respond to compromise. Publicly reported examples[13] include:

• APT3 (known as UPS Team) is known for deploying zero-day attacks that target Internet Explorer, Firefox, and Adobe Flash Player. The group’s custom implants and changing Command and Control (C2) infrastructure make them difficult to track. APT3 exploits use Rivest Cypher 4 (RC4) encryption to communicate and bypass address space layout randomization (ASLR)/Data Execution Prevention (DEP) by using Return Oriented Programming (ROP) chains.[14]
• APT10 (known as MenuPass Group) has established accessed to victim networks through compromised service providers, making it difficult for network defenders to identify the malicious traffic.
• APT19 (known as Codoso and Deep Panda) is known for developing custom Rich Text Format (RTF) and macro-enabled Microsoft Office documents for both implants and payloads. The group has backdoored software, such as software serial generators, and has an elite use of PowerShell for C2 over Hyper Text Transfer Protocol (HTTP)/Hyper Text Transfer Protocol Secure (HTTPS).[15]
• APT40 (known as Leviathan) has targeted external infrastructure with success, including internet-facing routers and virtual private networks.
• APT41 (known as Double Dragon) has exploited vulnerabilities in Citrix NetScaler/ADC, Cisco routers, and Zoho ManageEngine Desktop Central to compromise victims.[16]

MitigationsRecommended Actions

The following list provides actionable technical recommendations for IT security professionals to reduce their organization’s overall vulnerability. These recommendations are not exhaustive; rather they focus on the actions that will greatly reduce stakeholders’ attack surface.

1. Patch systems and equipment promptly and diligently. Establishing and consistently maintaining a thorough patching cycle continues to be the best defense against adversary TTPs. Focus on patching critical and high vulnerabilities that allow for remote code execution or denial-of-service on externally-facing (i.e., internet) equipment. Certain vulnerabilities—including CVE-2012-0158 in Microsoft products [17], CVE-2019-19781 in Citrix devices [18], and CVE-2020-5902 in BIG-IP Traffic Management User Interface [19]—have presented APTs with prime targets to gain initial access. Chinese APTs often use existing exploit code to target routinely exploited vulnerabilities [20], which present an opportunistic attack that requires limited resources. See table 3 for patch information on CVEs that have been routinely exploited by Chinese APTs.

Table 3: Patch information for vulnerabilities routinely exploited by Chinese APT actors

Vulnerability Vulnerable Products Patch Information CVE-2012-0158

Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0

• Microsoft Security Bulletin MS12-027: Vulnerability in Windows Common Controls Could Allow Remote Code Execution

CVE-2020-5902

• Big-IP devices (LTM, AAM, Advanced WAF, AFM, Analytics, APM, ASM, DDHD, DNS, FPS, GTM, Link Controller, PEM, SSLO, CGNAT)

• F5 Security Advisory: K52145254: TMUI RCE vulnerability CVE-2020-5902

CVE-2019-19781  

• Citrix Application Delivery Controller
• Citrix Gateway
• Citrix SDWAN WANOP

 

 

• Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway versions 11.1 and 12.0
• Citrix blog post: security updates for Citrix SD-WAN WANOP release 10.2.6 and 11.0.3
• Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway versions 12.1 and 13.0
• Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway version 10.5

CVE-2019-11510  

• Pulse Connect Secure 9.0R1 - 9.0R3.3, 8.3R1 - 8.3R7, 8.2R1 - 8.2R12, 8.1R1 - 8.1R15
• Pulse Policy Secure 9.0R1 - 9.0R3.1, 5.4R1 - 5.4R7, 5.3R1 - 5.3R12, 5.2R1 - 5.2R12, 5.1R1 - 5.1R15

• Pulse Secure Out-of-Cycle Advisory: Multiple vulnerabilities resolved in Pulse Connect Secure / Pulse Policy Secure 9.0RX

CVE-2019-16920

• D-Link products DIR-655C, DIR-866L, DIR-652, DHP-1565, DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825

• D-Link Security Advisory: DAP-1533 Rv Ax, DGL-5500 Rv Ax, DHP-1565 Rv Ax, DIR-130 Rv Ax, DIR-330 Rv Ax, DIR-615 Rv Ix, (non-US) DIR-652 Rv Bx, DIR-655 Rv Cx, DIR-825 Rv Cx, DIR-835 Rv Ax, DIR-855L Rv Ax, (non-US) DIR-862 Rv Ax, DIR-866L Rv Ax :: CVE-2019-16920 :: Unauthenticated Remote Code Execution (RCE) Vulnerability

CVE-2019-16278

• Nostromo 1.9.6 and below

• Nostromo 1.9.6 Directory Traversal/ Remote Command Execution
• Nostromo 1.9.6 Remote Code Execution

 

CVE-2019-1652

• Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers

• Cisco Security Advisory: Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability

CVE-2019-1653

• Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers

• Cisco Security Advisory: Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability

CVE-2020-10189

• Zoho ManageEngine Desktop Central before 10.0.474

• ManageEngine Desktop Central remote code execution vulnerability (CVE-2020-10189)

 

2. Implement rigorous configuration management programs. Audit configuration   management programs to ensure they can track and mitigate emerging threats. Review system configurations for misconfigurations and security weaknesses. Implementing a robust configuration and patch management program hinders sophisticated APT operations by limiting the effectiveness of opportunistic attacks.
    
3. Disable unnecessary ports, protocols, and services. Review network security device logs and determine whether to shut off unnecessary ports and protocols. Monitor common ports and protocols for C2 activity. Turn off or disable any unnecessary services or functionality within devices (e.g., universal plug and play [UPnP], PowerShell).
    
4. Enhance monitoring of network and email traffic. Review network signatures and indicators for focused operations activities, monitor for new phishing themes, and adjust email rules accordingly. Follow best practices of restricting attachments via email. Ensure that log information is aggregated and correlated to enable maximum detection capabilities, with a focus on monitoring for account misuse.
    
5. Use protection capabilities to stop malicious activity. Implement antivirus software and other endpoint protection capabilities to automatically detect and prevent malicious files from executing. Use network intrusion detection and prevention systems to identify and prevent commonly employed adversarial malware and limit nefarious data transfers.

Contact Information

CISA encourages recipients of this report to contribute any additional information that they may have related to this threat. For any questions related to this report, please contact CISA at:

• 1-888-282-0870 (From outside the United States: +1-703-235-8832)
• Central@cisa.dhs.gov (UNCLASS)

CISA encourages you to report any suspicious activity, including cybersecurity incidents, possible malicious code, software vulnerabilities, and phishing-related scams. Reporting forms can be found on the CISA homepage at http://www.us-cert.cisa.gov/.

References

• [1] White House Publication: How China’s Economic Aggression Threatens the Technologies and Intellectual Property of the United States and the World
• [2] Congressional Research Services: 'Made in China 2025' Industrial Policies: Issues for Congress
• [3] Council on Foreign Relations: Is ‘Made in China 2025’ a Threat to Global Trade
• [4] Mandiant: APT1 Exposing One of China’s Cyber Espionage Units
• [5] U.S. Department of Justice (DOJ) Press Release: U.S. Charges Five Chinese Military Hackers for Cyber Espionage Against U.S. Corporations and a Labor Organization for Commercial Advantage
• [6] CISA Alert TA17-117A: Intrusions Affecting Multiple Victims Across Multiple Sectors
• [7] DOJ Press Release: Deputy Attorney General Rod J. Rodenstein Announces Charges Against Chinese Hackers
• [8] CISA Awareness Briefing: Chinese Cyber Activity Targeting Managed Service Providers
• [9] DOJ Press Release: Deputy Attorney General William P. Barr Announces Indictment of Four Members of China’s Military for Hacking into Equifax
• [10] CISA Press Release: FBI and CISA Warn Against Chinese Targeting of COVID-19 Research Organizations
• [11] CISA Alert AA20-126A: APT Groups Target Healthcare and Essential Services
• [12] CISA Current Activity (CA): Chinese Malicious Cyber Activity
• [13] FireEye Advanced Persistent Threat Groups
• [14] MITRE ATT&CK: APT3
• [15] MITRE ATT&CK: APT19
• [16] MITRE ATT&CK: APT41
• [17] CISA Alert AA20-133A: Top 10 Routinely Exploited Vulnerabilities
• [18] CISA Alert AA20-020A: Critical Vulnerability in Citrix Application Delivery Controller, Gateway, and SD-WAN WANOP
• [19] CISA CA: F5 Releases Security Advisory for BIP-IP TMUI RCE Vulnerability, CVE-2020-5902
• [20] CISA Alert AA20-133A: Top 10 Routinely Exploited Vulnerabilities

Revisions

• October 1, 2020: Initial Version

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: September 22, 2020
Summary

This Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise frameworks for all referenced threat actor techniques.

This product was written by the Cybersecurity and Infrastructure Security Agency (CISA) with contributions by the Multi-State Information Sharing & Analysis Center (MS-ISAC).

CISA has observed a notable increase in the use of LokiBot malware by malicious cyber actors since July 2020. Throughout this period, CISA’s EINSTEIN Intrusion Detection System, which protects federal, civilian executive branch networks, has detected persistent malicious LokiBot activity. LokiBot uses a credential- and information-stealing malware, often sent as a malicious attachment and known for being simple, yet effective, making it an attractive tool for a broad range of cyber actors across a wide variety of data compromise use cases.

Technical Details

LokiBot—also known as Lokibot, Loki PWS, and Loki-bot—employs Trojan malware to steal sensitive information such as usernames, passwords, cryptocurrency wallets, and other credentials.

• The malware steals credentials through the use of a keylogger to monitor browser and desktop activity (Credentials from Password Stores [T1555]).
  • (Credentials from Password Stores: Credentials from Web Browsers [T1555.003])
  • (Input Capture: Keylogging [T1056.001])
• LokiBot can also create a backdoor into infected systems to allow an attacker to install additional payloads (Event Triggered Execution: Accessibility Features [T1546.008]).
• Malicious cyber actors typically use LokiBot to target Windows and Android operating systems and distribute the malware via email, malicious websites, text, and other private messages (User Execution: Malicious File [T1204.002]). See figure 1 for enterprise techniques used by LokiBot.

​

Figure 1: MITRE ATT&CK enterprise techniques used by LokiBot

Since LokiBot was first reported in 2015, cyber actors have used it across a range of targeted applications, including the following.

• February 2020: Trend Micro identified cyber actors using LokiBot to impersonate a launcher for Fortnite—a popular video game.[1]
• August 2019: FortiGuard SE researchers discovered a malspam campaign distributing LokiBot information-stealing payloads in spearphishing attack on a U.S. manufacturing company.[2]
• August 2019: Trend Micro researchers reported LokiBot malware source code being hidden in image files spread as attachments in phishing emails.[3]
• June 2019: Netskope uncovered LokiBot being distributed in a malspam campaign using ISO image file attachments.[4]
• April 2019: Netskope uncovered a phishing campaign using malicious email attachments with LokiBot malware to create backdoors onto infected Windows systems and steal sensitive information.[5]
• February 2018: Trend Micro discovered CVE-2017-11882 being exploited in an attack using Windows Installer service to deliver LokiBot malware.[6]
• October 2017: SfyLabs identified cyber actors using LokiBot as an Android banking trojan that turns into ransomware.[7]
• May 2017: Fortinet reported malicious actors using a PDF file to spread a new LokiBot variant capable of stealing credentials from more than 100 different software tools.[8]
• March 2017: Check Point discovered LokiBot malware found pre-installed on Android devices.[9]
• December 2016: Dr.Web researchers identified a new LokiBot variant targeting Android core libraries.[10]
• February 2016: Researchers discovered the LokiBot Android Trojan infecting the core Android operating system processes.[11]

MITRE ATT&CK Techniques

According to MITRE, LokiBot uses the ATT&CK techniques listed in table 1.

Table 1: LokiBot ATT&CK techniques

Technique

Use

System Network Configuration Discovery [T1016]

LokiBot has the ability to discover the domain name of the infected host.

Obfuscated Files or Information [T1027]

LokiBot has obfuscated strings with base64 encoding.

Obfuscated Files or Information: Software Packing [T1027.002]

LokiBot has used several packing methods for obfuscation.

System Owner/User Discovery [T1033]

LokiBot has the ability to discover the username on the infected host.

Exfiltration Over C2 Channel [T1041]

LokiBot has the ability to initiate contact with command and control to exfiltrate stolen data.

Process Injection: Process Hollowing [T1055.012]

LokiBot has used process hollowing to inject into legitimate Windows process vbc.exe.

Input Capture: Keylogging [T1056.001]

LokiBot has the ability to capture input on the compromised host via keylogging.

Application Layer Protocol: Web Protocols [T1071.001]

LokiBot has used Hypertext Transfer Protocol for command and control.

System Information Discovery [T1082]

LokiBot has the ability to discover the computer name and Windows product name/version.

User Execution: Malicious File [T1204.002]

LokiBot has been executed through malicious documents contained in spearphishing emails.

Credentials from Password Stores [T1555]

LokiBot has stolen credentials from multiple applications and data sources including Windows operating system credentials, email clients, File Transfer Protocol, and Secure File Transfer Protocol clients.

Credentials from Password Stores: Credentials from Web Browsers [T1555.003]

LokiBot has demonstrated the ability to steal credentials from multiple applications and data sources including Safari and Chromium and Mozilla Firefox-based web browsers.

Hide Artifacts: Hidden Files and Directories [T1564.001]

LokiBot has the ability to copy itself to a hidden file and directory.

Detection Signatures

CISA developed the following Snort signature for use in detecting network activity associated with LokiBot activity.

alert tcp any any -> any $HTTP_PORTS (msg:"Lokibot:HTTP URI POST contains '/*/fre.php' post-infection"; flow:established,to_server; flowbits:isnotset,.tagged; content:"/fre.php"; http_uri; fast_pattern:only; urilen:<50,norm; content:"POST"; nocase; http_method; pcre:"/\/(?:alien|loky\d|donep|jemp|lokey|new2|loki|Charles|sev7n|dbwork|scroll\/NW|wrk|job|five\d?|donemy|animation\dkc|love|Masky|v\d|lifetn|Ben)\/fre\.php$/iU"; flowbits:set,.tagged;classtype:http-uri; metadata:service http; metadata:pattern HTTP-P001,) Mitigations

CISA and MS-ISAC recommend that federal, state, local, tribal, territorial government, private sector users, and network administrators consider applying the following best practices to strengthen the security posture of their organization's systems. System owners and administrators should review any configuration changes prior to implementation to avoid unwanted impacts.

• Maintain up-to-date antivirus signatures and engines. See Protecting Against Malicious Code.
• Keep operating system patches up to date. See Understanding Patches and Software Updates.
• Disable file and printer sharing services. If these services are required, use strong passwords or Active Directory authentication.
• Enforce multi-factor authentication. See Supplementing Passwords for more information.
• Restrict users' ability (permissions) to install and run unwanted software applications. Do not add users to the local administrators’ group unless required.
• Enforce a strong password policy. See Choosing and Protecting Passwords.
• Exercise caution when opening email attachments, even if the attachment is expected and the sender appears to be known. See Using Caution with Email Attachments.
• Enable a personal firewall on agency workstations, configured to deny unsolicited connection requests.
• Disable unnecessary services on agency workstations and servers.
• Scan for and remove suspicious email attachments; ensure the scanned attachment is its "true file type" (i.e., the extension matches the file header).
• Monitor users' web browsing habits; restrict access to sites with unfavorable content.
• Exercise caution when using removable media (e.g., USB thumb drives, external drives, CDs).
• Scan all software downloaded from the internet prior to executing.
• Maintain situational awareness of the latest threats and implement appropriate access control lists.
• Visit the MITRE ATT&CK Techniques pages (linked in table 1 above) for additional mitigation and detection strategies.

For additional information on malware incident prevention and handling, see the National Institute of Standards and Technology Special Publication 800-83, Guide to Malware Incident Prevention and Handling for Desktops and Laptops.

Resources

Center for Internet Security Security Event Primer – Malware: https://www.cisecurity.org/white-papers/security-event-primer-malware/
MITRE ATT&CK – LokiBot: https://attack.mitre.org/software/S0447/
MITRE ATT&CK for Enterprise: https://attack.mitre.org/matrices/enterprise/

References

• [1] Trend Micro: LokiBot Impersonates Popular Game Launcher and Drops Compiled C# Code File
• [2] Fortinet: Newly Discovered Infostealer Attack Uses LokiBot
• [3] ZDNet: LokiBot Malware Now Hides its Source Code in Image Files
• [4] SecurityWeek: LokiBot and NanoCore Malware Distributed in ISO Image Files
• [5] Netskope: LokiBot & NanoCore being distributed via ISO disk image files
• [6] Trend Micro: Attack Using Windows Installer Leads to LokiBot
• [7] BleepingComputer: LokiBot Android Banking Trojan Turns Into Ransomware When You Try to Remove It
• [8] Fortinet: New Loki Variant Being Spread via PDF File
• [9] Check Point: Preinstalled Malware Targeting Mobile Users
• [10] BleepingComputer: Loki Trojan Infects Android Libraries and System Process to Get Root Privileges
• [11] New Jersey Cybersecurity & Communications Integration Cell: LokiBot 

Revisions

• September 22, 2020: Initial Version

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: September 15, 2020
Summary

This Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques.

This product was written by the Cybersecurity and Infrastructure Security Agency (CISA) with contributions from the Federal Bureau of Investigation (FBI). CISA and FBI are aware of an Iran-based malicious cyber actor targeting several U.S. federal agencies and other U.S.-based networks. Analysis of the threat actor’s indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) indicates a correlation with the group known by the names, Pioneer Kitten and UNC757. This threat actor has been observed exploiting several publicly known Common Vulnerabilities and Exposures (CVEs) dealing with Pulse Secure virtual private network (VPN), Citrix NetScaler, and F5 vulnerabilities. This threat actor used these vulnerabilities to gain initial access to targeted networks and then maintained access within the successfully exploited networks for several months using multiple means of persistence.

This Advisory provides the threat actor’s TTPs, IOCs, and exploited CVEs to help administrators and network defenders identify a potential compromise of their network and protect their organization from future attacks.

Click here for a PDF version of this report.

Technical Details

CISA and FBI are aware of a widespread campaign from an Iran-based malicious cyber actor targeting several industries mainly associated with information technology, government, healthcare, financial, insurance, and media sectors across the United States. The threat actor conducts mass-scanning and uses tools, such as Nmap, to identify open ports. Once the open ports are identified, the threat actor exploits CVEs related to VPN infrastructure to gain initial access to a targeted network. CISA and the FBI have observed the threat actor exploiting multiple CVEs, including CVE-2019-11510, CVE-2019-11539, CVE-2019-19781, and CVE-2020-5902.

After gaining initial access to a targeted network, the threat actor obtains administrator-level credentials and installs web shells allowing further entrenchment. After establishing a foothold, the threat actor’s goals appear to be maintaining persistence and exfiltrating data. This threat actor has been observed selling access to compromised network infrastructure in an online hacker forum. Industry reporting indicates that the threat actor operates as a contractor supporting Iranian government interests, but the malicious activity appears to also serve the threat actor’s own financial interests. The FBI notes this threat actor has the capability, and likely the intent, to deploy ransomware on victim networks.

CISA and FBI have observed this Iran-based threat actor relying on exploits of remote external services on internet-facing assets to gain initial access to victim networks. The threat actor also relies heavily on open-source and operating system (OS) tooling to conduct operations, such as ngrok; fast reverse proxy (FRP); Lightweight Directory Access Protocol (LDAP) directory browser; as well as web shells known as ChunkyTuna, Tiny, and China Chopper.

Table 1 illustrates some of the common tools this threat actor has used.

Table 1: Common exploit tools

Tool

Detail

ChunkyTuna web shell

ChunkyTuna allows for chunked transfer encoding hypertext transfer protocol (HTTP) that tunnels Transmission Control Protocol (TCP) streams over HTTP. The web shell allows for reverse connections to a server with the intent to exfiltrate data.

Tiny web shell

Tiny uses Hypertext Preprocessor (PHP) to create a backdoor. It has the capability to allow a threat actor remote access to the system and can also tunnel or route traffic.

China Chopper web shell

China Chopper is a web shell hosted on a web server and is mainly used for web application attacks; it is configured in a client/server relationship. China Chopper contains security scanners and can be used to upload files and brute-force passwords. FRPC FRPC is a modified version of the open-source FRP tool. It allows a system—inside a router or firewall providing Network Address Translation—to provide network access to systems/operators located outside of the victim network. In this case, FRPC was used as reverse proxy, tunneling Remote Desktop Protocol (RDP) over Transport Layer Security (TLS), giving the threat actor primary persistence. Chisel Chisel is a fast TCP tunnel over HTTP and secured via Secure Shell (SSH). It is a single executable that includes both client and server. The tool is useful for passing through firewalls, but it can also be used to provide a secure form of communication to an endpoint on a victim network. ngrok ngrok is a tool used to expose a local port to the internet. Optionally, tunnels can be secured with TLS. Nmap Nmap is used for vulnerability scanning and network discovery. Angry IP Scanner Angry IP Scanner is a scanner that can ping a range of Internet Protocol (IP) addresses to check if they are active and can also resolve hostnames, scan ports, etc. Drupwn Drupwn is a Python-based tool used to scan for vulnerabilities and exploit CVEs in Drupal devices.

Notable means of detecting this threat actor:

• CISA and the FBI note that this group makes significant use of ngrok, which may appear as TCP port 443 connections to external cloud-based infrastructure.
• The threat actor uses FRPC over port 7557.
• Malware Analysis Report MAR-10297887-1.v1 details some of the tools this threat actor used against some victims.

The following file paths can be used to detect Tiny web shell, ChunkyTuna web shell, or Chisel if a network has been compromised by this attacker exploiting CVE-2019-19781.

• Tiny web shell

       /netscaler/ns_gui/admin_ui/rdx/core/css/images/css.php
       /netscaler/ns_gui/vpn/images/vpn_ns_gui.php
       /var/vpn/themes/imgs/tiny.php

• ChunkyTuna web shell

       /var/vpn/themes/imgs/debug.php
       /var/vpn/themes/imgs/include.php
       /var/vpn/themes/imgs/whatfile

• Chisel

       /var/nstmp/chisel

MITRE ATT&CK Framework Initial Access

As indicated in table 2, the threat actor primarily gained initial access by using the publicly available exploit for CVE-2019-19781. From there, the threat actor used the Citrix environment to establish a presence on an internal network server.

Table 2: Initial access techniques

ID

Technique/Sub-Technique

Context

T1190

Exploit Public-Facing Application The threat actor primarily gained initial access by compromising a Citrix NetScaler remote access server using a publicly available exploit for CVE-2019-19781. The threat actor also exploited CVE-2019-11510, CVE-2019-11539, and CVE-2020-5902. Execution

After gaining initial access, the threat actor began executing scripts, as shown in table 3.

Table 3: Execution techniques

ID

Technique/Sub-Technique

Context

T1059.001

Command and Scripting Interpreter: PowerShell A PowerShell script (keethief and kee.ps1) was used to access KeePass data.

T1059.003

Command and Scripting Interpreter: Windows Command Shell cmd.exe was launched via sticky keys that was likely used as a password changing mechanism. Persistence

CISA observed the threat actor using the techniques identified in table 4 to establish persistence.

Table 4: Persistence techniques

ID

Technique/Sub-Technique

Context

T1053.003

Scheduled Task/Job: Cron The threat actor loaded a series of scripts to cron and ran them for various purposes (mainly to access NetScaler web forms).

T1053.005

Scheduled Task/Job: Scheduled Task The threat actor installed and used FRPC (frpc.exe) on both NetScaler and internal devices. The task was named lpupdate and the binary was named svchost, which was the reverse proxy. The threat actor executed this command daily.

T1505.003

Server Software Component: Web Shell The threat actor used several web shells on existing web servers. Both NetScaler and web servers called out for ChunkyTuna.

T1546.008

Event Triggered Execution: Accessibility Features The threat actor used sticky keys (sethc.exe) to launch cmd.exe. Privilege Escalation

CISA observed no evidence of direct privilege escalation. The threat actor attained domain administrator credentials on the NetScaler device via exploit and continued to expand credential access on the network.

Defense Evasion

CISA observed the threat actor using the techniques identified in table 5 to evade detection.

Table 5: Defensive evasion techniques

ID

Technique/Sub-Technique

Context

T1027.002

Obfuscated Files or Information: Software Packing The threat actor used base64 encoding for payloads on NetScaler during initial access, making the pre-compiled payloads easier to avoid detection.

T1027.004

Obfuscated Files or Information: Compile After Delivery The threat actor used base64 encoding schemes on distributed (uncompiled) scripts and files to avoid detection.

T1036.004

Masquerading: Masquerade Task or Service The threat actor used FRPC (frpc.exe) daily as reverse proxy, tunneling RDP over TLS. The FRPC (frpc.exe) task name was lpupdate and ran out of Input Method Editor (IME) directory. In other events, the threat actor has been observed hiding activity via ngrok.

T1036.005

Masquerading: Match Legitimate Name or Location The FRPC (frpc.exe) binary name was svchost, and the configuration file was dllhost.dll, attempting to masquerade as a legitimate Dynamic Link Library.

T1070.004

Indicator Removal on Host: File Deletion To minimize their footprint, the threat actor ran ./httpd-nscache_clean every 30 minutes, which cleaned up files on the NetScaler device. Credential Access

CISA observed the threat actor using the techniques identified in table 6 to further their credential access.

Table 6: Credential access techniques

ID

Technique/Sub-Technique

Context

T1003.001

OS Credential Dumping: LSASS Memory The threat actor used procdump to dump process memory from the Local Security Authority Subsystem Service (LSASS).

T1003.003

OS Credential Dumping: Windows NT Directory Services (NTDS) The threat actor used Volume Shadow Copy to access credential information from the NTDS file.

T1552.001

Unsecured Credentials: Credentials in Files The threat actor accessed files containing valid credentials.

T1555

Credentials from Password Stores The threat actor accessed a KeePass database multiple times and used kee.ps1 PowerShell script.

T1558

Steal or Forge Kerberos Tickets The threat actor conducted a directory traversal attack by creating files and exfiltrating a Kerberos ticket on a NetScaler device. The threat actor was then able to gain access to a domain account. Discovery

CISA observed the threat actor using the techniques identified in table 7 to learn more about the victim environments.

Table 7: Discovery techniques

ID

Technique/Sub-Technique

Context

T1018

Remote System Discovery The threat actor used Angry IP Scanner to detect remote systems.

T1083

File and Directory Discovery The threat actor used WizTree to obtain network files and directory listings.

T1087

Account Discovery The threat actor accessed ntuser.dat and UserClass.dat and used Softerra LDAP Browser to browse documentation for service accounts.

T1217

Browser Bookmark Discovery The threat actor used Google Chrome bookmarks to find internal resources and assets. Lateral Movement

CISA also observed the threat actor using open-source tools such as Plink and TightVNC for lateral movement. CISA observed the threat actor using the techniques identified in table 8 for lateral movement within the victim environment.

Table 8: Lateral movement techniques

ID

Technique/Sub-Technique

Context

T1021

Remote Services The threat actor used RDP with valid account credentials for lateral movement in the environment.

T1021.001

Remote Services: Remote Desktop Protocol The threat actor used RDP to log in and then conduct lateral movement.

T1021.002

Remote Services: SMB/Windows Admin Shares The threat actor used PsExec. and PSEXECSVC pervasively on several hosts. The threat actor was also observed using a valid account to access SMB shares.

T1021.004

Remote Services: SSH The threat actor used Plink and PuTTY for lateral movement. Artifacts of Plink were used for encrypted sessions in the system registry hive. 

T1021.005

Remote Services: Virtual Network Computing (VNC) The threat actor installed TightVNC server and client pervasively on compromised servers and endpoints in the network environment as lateral movement tool.

T1563.002

Remote Service Session Hijacking: RDP Hijacking The threat actor likely hijacked a legitimate RDP session to move laterally within the network environment. Collection

CISA observed the threat actor using the techniques identified in table 9 for collection within the victim environment.

Table 9: Collection techniques

ID

Technique/Sub-Technique

Context

T1005

Data from Local System The threat actor searched local system sources to accessed sensitive documents.

T1039

Data from Network Shared Drive The threat actor searched network shares to access sensitive documents.

T1213

Data from Information Repositories The threat actor accessed victim security/IT monitoring environments, Microsoft Teams, etc., to mine valuable information.

T1530

Data from Cloud Storage Object The threat actor obtained files from the victim cloud storage instances.

T1560.001

Archive Collected Data: Archive via Utility The threat actor used 7-Zip to archive data. Command and Control

CISA observed the threat actor using the techniques identified in table 10 for command and control (C2).

Table 10: Command and control techniques

ID

Technique/Sub-Technique

Context

T1071.001

Application Layer Protocol: Web Protocols The threat actor used various web mechanisms and protocols, including the web shells listed in table 1.

T1105

Ingress Tool Transfer The threat actor downloaded tools such as PsExec directly to endpoints and downloaded web shells and scripts to NetScaler in base64-encoded schemes.

T1572

Protocol Tunneling The threat actor used FRPC.exe to tunnel RDP over port 443. The threat actor has also been observed using ngrok for tunneling. Exfiltration

CISA currently has no evidence of data exfiltration from this threat actor but assesses that it was likely due to the use of 7-Zip and viewing of sensitive documents.

MitigationsRecommendations

CISA and FBI recommend implementing the following recommendations.

• If your organization has not patched for the Citrix CVE-2019-19781 vulnerability, and a compromise is suspected, follow the recommendations in CISA Alert AA20-031A.
• This threat actor has been observed targeting other CVEs mentioned in this report; follow the recommendations in the CISA resources provided below.
• If using Windows Active Directory and compromise is suspected, conduct remediation of the compromised Windows Active Directory forest.
  • If compromised, rebuild/reimage compromised NetScaler devices.
• Routinely audit configuration and patch management programs.
• Monitor network traffic for unexpected and unapproved protocols, especially outbound to the internet (e.g., SSH, SMB, RDP).
• Implement multi-factor authentication, especially for privileged accounts.
• Use separate administrative accounts on separate administration workstations.
• Implement the principle of least privilege on data access.
• Secure RDP and other remote access solutions using multifactor authentication and “jump boxes” for access.
• Deploy endpoint defense tools on all endpoints; ensure they work and are up to date.
• Keep software up to date.

Contact Information

To report suspicious or criminal activity related to information found in this Joint Cybersecurity Advisory, contact your local FBI field office at www.fbi.gov/contact-us/field, or the FBI’s 24/7 Cyber Watch (CyWatch) at (855) 292-3937 or by e-mail at CyWatch@fbi.gov. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact. To request incident response resources or technical assistance related to these threats, contact CISA at central@cisa.dhs.gov.

Resources

CISA Alert AA20-031A: Detecting Citrix CVE-2019-19781
CISA Alert AA20-073A: Enterprise VPN Security
CISA Alert AA20-107A: Continued Threat Actor Exploitation Post Pulse Secure VPN Patching
CISA Alert AA20-206A: Threat Actor Exploitation of F5 BIG-IP CVE-2020-5902
CISA Security Tip: Securing Network Infrastructure Devices

Revisions

• September 15, 2020: Initial Version

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: September 14, 2020
Summary

The Cybersecurity and Infrastructure Security Agency (CISA) has consistently observed Chinese Ministry of State Security (MSS)-affiliated cyber threat actors using publicly available information sources and common, well-known tactics, techniques, and procedures (TTPs) to target U.S. Government agencies. CISA has observed these—and other threat actors with varying degrees of skill—routinely using open-source information to plan and execute cyber operations. CISA leveraged the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) and Pre-ATT&CK frameworks to characterize the TTPs used by Chinese MSS-affiliated actors. This product was written by CISA with contributions by the Federal Bureau of Investigation (FBI).

Key Takeaways

• Chinese MSS-affiliated cyber threat actors use open-source information to plan and conduct cyber operations.
• Chinese MSS-affiliated cyber threat actors use readily available exploits and exploit toolkits to quickly engage target networks.
• Maintaining a rigorous patching cycle continues to be the best defense against the most frequently used attacks.
• If critical vulnerabilities remain unpatched, cyber threat actors can carry out attacks without the need to develop custom malware and exploits or use previously unknown vulnerabilities to target a network.
• This Advisory identifies some of the more common—yet most effective—TTPs employed by cyber threat actors, including Chinese MSS-affiliated cyber threat actors.

Click here for a PDF version of this report.

Technical Details

Through the operation of the National Cybersecurity Protection System (NCPS) and by fulfilling its mission as the national risk advisor, CISA has observed Chinese MSS-affiliated cyber threat actors operating from the People’s Republic of China using commercially available information sources and open-source exploitation tools to target U.S. Government agency networks.

According to a recent U.S. Department of Justice indictment, MSS-affiliated actors have targeted various industries across the United States and other countries—including high-tech manufacturing; medical device, civil, and industrial engineering; business, educational, and gaming software; solar energy; pharmaceuticals; and defense—in a campaign that lasted over ten years.[1] These hackers acted for both their own personal gain and the benefit of the Chinese MSS.[2]

According to the indictment,

To conceal the theft of information from victim networks and otherwise evade detection, the defendants typically packaged victim data in encrypted Roshal Archive Compressed files (RAR files), changed RAR file and victim documents’ names and extensions (e.g., from “.rar” to “.jpg”) and system timestamps, and concealed programs and documents at innocuous-seeming locations on victim networks and in victim networks’ “recycle bins.” The defendants frequently returned to re-victimize companies, government entities, and organizations from which they had previously stolen data, in some cases years after the initial successful data theft. In several instances, however, the defendants were unsuccessful in this regard, due to the efforts of the FBI and network defenders.

The continued use of open-source tools by Chinese MSS-affiliated cyber threat actors highlights that adversaries can use relatively low-complexity capabilities to identify and exploit target networks. In most cases, cyber operations are successful because misconfigurations and immature patch management programs allow actors to plan and execute attacks using existing vulnerabilities and known exploits. Widespread implementation of robust configuration and patch management programs would greatly increase network security. It would also reduce the speed and frequency of opportunistic attacks by forcing threat actors to dedicate time and funding to research unknown vulnerabilities and develop custom exploitation tools.

MITRE PRE-ATT&CK® Framework for Analysis

In the last 12 months, CISA analysts have routinely observed Chinese MSS-affiliated actors using the following PRE-ATT&CK® Framework TTPs.

Target Selection and Technical Information Gathering

Target Selection [TA0014] is a critical part of cyber operations. While cyber threat actors’ motivations and intents are often unknown, they often make their selections based on the target network’s security posture. Threat actors can use information sources such as Shodan, the Common Vulnerabilities and Exposure (CVE) database, and the National Vulnerabilities Database (NVD).[3][4][5]

• Shodan is an internet search engine that can be used to identify vulnerable devices connected to the internet. Shodan queries can also be customized to discover specific vulnerabilities on devices, which enables sophisticated cyber threat actors to use relatively unsophisticated techniques to execute opportunistic attacks on susceptible targets.
• The CVE database and the NVD contain detailed information about vulnerabilities in applications, appliances, and operating systems that can be exploited by cyber threat actors if they remain unpatched. These sources also provide risk assessments if any of the recorded vulnerabilities are successfully exploited.

These information sources have legitimate uses for network defense. CISA analysts are able to identify Federal Government systems that may be susceptible to exploitation attempts by using Shodan, the CVE database, and the NVD to enrich NCPS information. Unlike threat actors, CISA takes the necessary actions to notify network owners of their exposure in order to prevent an impending intrusion or quickly identify intrusions as they occur.

While using these data sources, CISA analysts have observed a correlation between the public release of a vulnerability and targeted scanning of systems identified as being vulnerable. This correlation suggests that cyber threat actors also rely on Shodan, the CVE database, the NVD, and other open-source information to identify targets of opportunity and plan cyber operations. Together, these data sources provide users with the understanding of a specific vulnerability, as well as a list of systems that may be vulnerable to attempted exploits. These information sources therefore contain invaluable information that can lead cyber threat actors to implement highly effective attacks.

CISA has observed Chinese MSS-affiliated actors using the techniques in table 1 to gather technical information to enable cyber operations against Federal Government networks (Technical Information Gathering [TA0015]).

Table 1: Technical information gathering techniques observed by CISA

MITRE ID

Name

Observation

T1245

Determine Approach/Attack Vector

The threat actors narrowed the attack vectors to relatively recent vulnerability disclosures with open-source exploits.

T1247

Acquire Open Source Intelligence (OSINT) Data Sets and Information

CISA observed activity from network proxy service Internet Protocol (IP) addresses to three Federal Government webpages. This activity appeared to enable information gathering activities.

T1254

Conduct Active Scanning

CISA analysts reviewed the network activity of known threat actor IP addresses and found evidence of reconnaissance activity involving virtual security devices.

Technical Weakness Identification

CISA analysts consistently observe targeting, scanning, and probing of significant vulnerabilities within days of their emergence and disclosure. This targeting, scanning, and probing frequently leads to compromises at the hands of sophisticated cyber threat actors. In some cases, cyber threat actors have used the same vulnerabilities to compromise multiple organizations across many sectors. Organizations do not appear to be mitigating known vulnerabilities as quickly as cyber threat actors are exploiting them. CISA recently released an alert that highlighted the top 10 vulnerabilities routinely exploited by sophisticated foreign cyber threat actors from 2016 to 2019.[6]

Additionally, table 2 provides a list of notable compromises by Chinese MSS-affiliated actors within the past 12 months.

Table 2: Significant CVEs targeted by Chinese MSS-affiliated actors in the last 12 months

Vulnerability

Observations

CVE-2020-5902: F5 Big-IP Vulnerability

CISA has conducted incident response engagements at Federal Government and commercial entities where the threat actors exploited CVE-2020-5902. This is a vulnerability in F5’s Big-IP Traffic Management User Interface that allows cyber threat actors to execute arbitrary system commands, create or delete files, disable services, and/or execute Java code.[7]

CVE-2019-19781: Citrix Virtual Private Network (VPN) Appliances

CISA has observed the threat actors attempting to discover vulnerable Citrix VPN Appliances. CVE-2019-19781 enabled the actors to execute directory traversal attacks.[8]

CVE-2019-11510: Pulse Secure VPN Servers

CISA has conducted multiple incident response engagements at Federal Government and commercial entities where the threat actors exploited CVE-2019-11510—an arbitrary file reading vulnerability affecting Pulse Secure VPN appliances—to gain access to victim networks. Although Pulse Secure released patches for CVE-2019-11510 in April 2019, CISA observed incidents where compromised Active Directory credentials were used months after the victim organization patched their VPN appliance.[9]

CVE-2020-0688: Microsoft Exchange Server

CISA has observed the actors exploiting CVE-2020-0688 for remote code execution to enable email collection of targeted networks.

 

Additionally, CISA has observed Chinese MSS-affiliated actors using the techniques listed in table 3 to identify technical weaknesses in Federal Government networks (Technical Weakness Identification [TA0018]). 

Table 3: Technical weakness identification techniques observed by CISA

MITRE ID

Name

Observation

T1288

Analyze Architecture and Configuration Posture

CISA observed the cyber actors scanning a Federal Government agency for vulnerable web servers. CISA also observed the threat actors scanning for known vulnerable network appliance CVE-2019-11510.

T1291

Research Relevant Vulnerabilities

CISA has observed the threat actors scanning and reconnaissance of Federal Government internet-facing systems shortly after the disclosure of significant CVEs.

Build Capabilities 

CISA analysts have observed cyber threat actors using command and control (C2) infrastructure as part of their cyber operations. These observations also provide evidence that threat actors can build and maintain relatively low-complexity capabilities, such as C2, to enable cyber operations against Federal Government networks (Build Capabilities [TA0024]). CISA has observed Chinese MSS-affiliated actors using the build capabilities summarized in table 4.

Table 4: Build capabilities observed by CISA

MITRE ID

Name

Observation

T1352

C2 Protocol Development

CISA observed beaconing from a Federal Government entity to the threat actors’ C2 server.

T1328

Buy Domain Name

CISA has observed the use of domains purchased by the threat actors.

T1329

Acquire and / or use of 3rd Party Infrastructure

CISA has observed the threat actors using virtual private servers to conduct cyber operations.

T1346

Obtain/Re-use Payloads

CISA has observed the threat actors use and reuse existing capabilities.

T1349

Build or Acquire Exploit

CISA has observed the threat actors using a variety of open-source and publicly available exploits and exploit code to compromise Federal Government networks.

MITRE ATT&CK Framework for Analysis

CISA has observed sophisticated cyber threat actors, including Chinese MSS-affiliated actors, using commercial and open-source tools to conduct their operations. For example, threat actors often leverage internet software repositories such as GitHub and Exploit-DB.[10][11] Both repositories are commonly used for legitimate development and penetration testing and developing open-source code, but cyber threat actors can also use them to find code to enable nefarious actions.

During incident response activities, CISA frequently observed Chinese government-affiliated actors using the open-source tools outlined in table 5.

Table 5: Common exploit tools CISA observed used by Chinese MSS-affiliated actors

Tool

Observations

Cobalt Strike

CISA has observed the threat actors using Cobalt Strike to target commercial and Federal Government networks. Cobalt Strike is a commercial penetration testing tool used to conduct red team operations. It contains a number of tools that complement the cyber threat actor’s exploitation efforts, such as a keystroke logger, file injection capability, and network services scanners. CISA observed connections from a Federal Government agency to multiple IP addresses possibly hosting Cobalt Strike team servers.

China Chopper Web Shell

CISA has observed the actors successfully deploying China Chopper against organizations’ networks. This open-source tool can be downloaded from internet software repositories such GitHub and Exploit-DB. China Chopper is a web shell hosted on a web server. It is mainly used for web application attacks, and it is configured in a client/server relationship. China Chopper contains security scanners and can be used to upload files and brute-force passwords.

Mimikatz

CISA has observed the actors using Mimikatz during their operations. This open-source tool is used to capture account credentials and perform privilege escalation with pass-the-hash attacks that allow an attacker to pass captured password hashes and authenticate to network devices.[12]

 

The following sections list the ATT&CK Framework TTPs routinely employed by Chinese government-affiliated actors to conduct cyber operations as observed by CISA analysts.

Initial Access 

In the last 12 months, CISA has observed Chinese MSS-affiliated actors use spearphishing emails with embedded links to actor-owned infrastructure and, in some cases, compromise or poison legitimate sites to enable cyber operations.

CISA has observed the threat actors using the Initial Access [TA0001] techniques identified in table 6.

Table 6: Initial access techniques observed by CISA

MITRE ID

Name

Observation

T1204.001

User Execution: Malicious Link

CISA has observed indications that users have clicked malicious links embedded in spearphishing emails that the threat actors sent

T1566.002

Phishing: Spearphishing Link

CISA analyzed network activity of a Federal Government entity and concluded that the threat actors sent a malicious email weaponized with links.

T1190

Exploit Public-Facing Application

CISA has observed the actors leveraging CVE-2019-19781 to compromise Citrix Application Delivery Controllers.

 

Cyber threat actors can continue to successfully launch these types of low-complexity attacks—as long as misconfigurations in operational environments and immature patch management programs remain in place—by taking advantage of common vulnerabilities and using readily available exploits and information.

Execution 

CISA analysts continue to observe beaconing activity indicative of compromise or ongoing access to Federal Government networks. This beaconing is a result of cyber threat actors successfully completing cyber operations that are often designed around emergent vulnerabilities and reliant on existing exploitation tools, as mentioned in this document.

CISA has observed Chinese MSS-affiliated actors using the Execution [TA0002] technique identified in table 7.

Table 7: Execution technique observed by CISA

MITRE ID

Name

Observation

T1072

Software Deployment Tools

CISA observed activity from a Federal Government IP address beaconing out to the threat actors’ C2 server, which is usually an indication of compromise.

Credential Access 

Cyber threat actors also continue to identify large repositories of credentials that are available on the internet to enable brute-force attacks. While this sort of activity is not a direct result of the exploitation of emergent vulnerabilities, it demonstrates that cyber threat actors can effectively use available open-source information to accomplish their goals. Further, a threat actor does not require a high degree of competence or sophistication to successfully carry out this kind of opportunistic attack.

CISA has observed Chinese MSS-affiliated actors using the Credential Access [TA0006] techniques highlighted in table 8.

Table 8: Credential access techniques observed by CISA

MITRE ID

Name

Observation

T1003.001

Operating System (OS) Credential Dumping: Local Security Authority Subsystem Service (LSASS) Memory

CISA observed the threat actors using Mimikatz in conjunction with coin miner protocols and software. The actors used Mimikatz to dump credentials from the OS using a variety of capabilities resident within the tool.

T1110.004

Brute Force: Credential Stuffing

CISA observed what was likely a brute-force attack of a Remote Desktop Protocol on a public-facing server.

Discovery 

As with any cyber operation, cyber threat actors must be able to confirm that their target is online and vulnerable—there are a multitude of open-source scanning and reconnaissance tools available to them to use for this purpose. CISA consistently observes scanning activity across federal agencies that is indicative of discovery techniques. CISA has observed Chinese MSS-affiliated actors scanning Federal Government traffic using the discovery technique highlighted in table 9 (Discovery [TA0007]).

Table 9: Discovery technique observed by CISA

MITRE ID

Name

Observation

T1046

Network Service Scanning

CISA has observed suspicious network scanning activity for various ports at Federal Government entities.

Collection 

Within weeks of public disclosure of CVE-2020-0688, CISA analysts identified traffic that was indicative of Chinese MSS-affiliated threat actors attempting to exploit this vulnerability using the Collection [TA0009] technique listed in table 10.

Table 10: Collection technique observed by CISA

MITRE ID

Name

Observation

T1114

Email Collection

CISA observed the actors targeting CVE-2020-0688 to collect emails from the exchange servers found in Federal Government environments.

Command and Control 

CISA analysts often observe cyber threat actors using external proxy tools or hop points to enable their cyber operations while remaining anonymous. These proxy tools may be commercially available infrastructure as a service (IaaS) or software as a service (SaaS) in the form of a web browser promising anonymity on the internet. For example, “The Onion Router” (Tor) is often used by cyber threat actors for anonymity and C2. Actor’s carefully choose proxy tools depending on their intended use. These techniques are relatively low in complexity and enabled by commercially available tools, yet they are highly effective and often reliant upon existing vulnerabilities and readily available exploits.

CISA has observed Chinese MSS-affiliated actors using the Command and Control [TA0011] techniques listed in table 11.

Table 11: Command and control techniques observed by CISA

MITRE ID

Name

Observation

T1090.002

Proxy: External Proxy

CISA observed activity from a network proxy tool to 221 unique Federal Government agency IP addresses.

T1090.003

Proxy: Multi-hop Proxy

CISA observed activity from Tor that has resulted in confirmed compromises of internet-facing Federal Government agency systems.

T1573.002

Encrypted Channel: Asymmetric Cryptography

CISA observed activity from Tor that has resulted in confirmed compromises of internet-facing Federal Government agency systems.

Mitigations

CISA asserts with high confidence that sophisticated cyber threat actors will continue to use open-source resources and tools to target networks with a low security posture. When sophisticated cyber threat actors conduct operations against soft targets, it can negatively impact critical infrastructure, federal, and state, local, tribal, territorial government networks, possibly resulting in loss of critical data or personally identifiable information.

CISA and the FBI recommend that organizations place an increased priority on patching the vulnerabilities routinely exploited by MSS-affiliated cyber actors. See table 12 for patch information on the CVEs mentioned in this report. For more information on vulnerabilities routinely exploited by sophisticated cyber actors, see CISA Alert: Top 10 Routinely Exploited Vulnerabilities.

Table 12: Patch Information for Vulnerabilities Routinely Exploited by MSS-affiliated Cyber Actors

Vulnerability

Vulnerable Products

Patch Information

CVE-2020-5902

• Big-IP devices (LTM, AAM, Advanced WAF, AFM, Analytics, APM, ASM, DDHD, DNS, FPS, GTM, Link Controller, PEM, SSLO, CGNAT)

• F5 Security Advisory: K52145254: TMUI RCE vulnerability CVE-2020-5902

CVE-2019-19781

• Citrix Application Delivery Controller

• Citrix Gateway

• Citrix SDWAN WANOP

• Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway versions 11.1 and 12.0

• Citrix blog post: security updates for Citrix SD-WAN WANOP release 10.2.6 and 11.0.3

• Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway versions 12.1 and 13.0

• Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway version 10.5

CVE-2019-11510

• Pulse Connect Secure 9.0R1 - 9.0R3.3, 8.3R1 - 8.3R7, 8.2R1 - 8.2R12, 8.1R1 - 8.1R15

• Pulse Policy Secure 9.0R1 - 9.0R3.1, 5.4R1 - 5.4R7, 5.3R1 - 5.3R12, 5.2R1 - 5.2R12, 5.1R1 - 5.1R15

• Pulse Secure Out-of-Cycle Advisory: Multiple vulnerabilities resolved in Pulse Connect Secure / Pulse Policy Secure 9.0RX

CVE-2020-0688

• Microsoft Exchange Servers

• Microsoft Security Advisory: CVE-2020-0688: Microsoft Exchange Validation Key Remote Code Execution Vulnerability

 

CISA and the FBI also recommend that organizations routinely audit their configuration and patch management programs to ensure they can track and mitigate emerging threats. Implementing a rigorous configuration and patch management program will hamper sophisticated cyber threat actors’ operations and protect organizations’ resources and information systems. 

Contact Information

To report suspicious or criminal activity related to information found in this Joint Cybersecurity Advisory, contact your local FBI field office at www.fbi.gov/contact-us/field, or the FBI’s 24/7 Cyber Watch (CyWatch) at (855) 292-3937 or by e-mail at CyWatch@fbi.gov. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact. To request incident response resources or technical assistance related to these threats, contact CISA at central@cisa.dhs.gov.

References

• [1] U.S. Department of Justice Press Release
• [2] U.S. Department of Justice Press Release
• [3] Shodan
• [4] MITRE Common Vulnerabilities and Exposures List
• [5] National Institute of Standards and Technology National Vulnerability Database
• [6] CISA Alert AA20-133A: Top 10 Routinely Exploited Vulnerabilities
• [7] CISA Alert AA20-206A: Threat Actor Exploitation of F5 BIG-IP CVE-2020-5902
• [8] CISA Alert AA20-031A: Detecting Citrix CVE-2019-19781
• [9] CISA Alert AA20-107A: Continued Threat Actor Exploitation Post Pulse Secure VPN Patching
• [10] GitHub
• [11] Exploit-DB
• [12] What is Mimikatz: The Beginner's Guide (VARONIS)

Revisions

• September 14, 2020: Initial Version

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: September 1, 2020
Summary

This joint advisory is the result of a collaborative research effort by the cybersecurity authorities of five nations: Australia,[1] Canada,[2] New Zealand,[3][4] the United Kingdom,[5] and the United States.[6] It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

Key Takeaways

When addressing potential incidents and applying best practice incident response procedures:

• First, collect and remove for further analysis:
  • Relevant artifacts,
  • Logs, and
  • Data.
• Next, implement mitigation steps that avoid tipping off the adversary that their presence in the network has been discovered.
• Finally, consider soliciting incident response support from a third-party IT security organization to:
  • Provide subject matter expertise and technical support to the incident response,
  • Ensure that the actor is eradicated from the network, and
  • Avoid residual issues that could result in follow-up compromises once the incident is closed.

Click here for a PDF version of this report.

Technical Details

The incident response process requires a variety of technical approaches to uncover malicious activity. Incident responders should consider the following activities.

• Indicators of Compromise (IOC) Search – Collect known-bad indicators of compromise from a broad variety of sources, and search for those indicators in network and host artifacts. Assess results for further indications of malicious activity to eliminate false positives.
• Frequency Analysis – Leverage large datasets to calculate normal traffic patterns in both network and host systems. Use these predictive algorithms to identify activity that is inconsistent with normal patterns. Variables often considered include timing, source location, destination location, port utilization, protocol adherence, file location, integrity via hash, file size, naming convention, and other attributes.
• Pattern Analysis – Analyze data to identify repeating patterns that are indicative of either automated mechanisms (e.g., malware, scripts) or routine human threat actor activity. Filter out the data containing normal activity and evaluate the remaining data to identify suspicious or malicious activity.
• Anomaly Detection – Conduct an analyst review (based on the team’s knowledge of, and experience with, system administration) of collected artifacts to identify errors. Review unique values for various datasets and research associated data, where appropriate, to find anomalous activity that could be indicative of threat actor activity.

Recommended Artifact and Information Collection

When hunting and/or investigating a network, it is important to review a broad variety of artifacts to identify any suspicious activity that may be related to the incident. Consider collecting and reviewing the following artifacts throughout the investigation.

Host-Based Artifacts

• Running Processes
• Running Services
• Parent-Child Process Trees
• Integrity Hash of Background Executables
• Installed Applications
• Local and Domain Users
• Unusual Authentications
• Non-Standard Formatted Usernames
• Listening Ports and Associated Services
• Domain Name System (DNS) Resolution Settings and Static Routes
• Established and Recent Network Connections
• Run Key and other AutoRun Persistence
• Scheduled Tasks
• Artifacts of Execution (Prefetch and Shimcache)
• Event logs
• Anti-virus detections

Information to Review for Host Analysis

• Identify any process that is not signed and is connecting to the internet looking for beaconing or significant data transfers.
• Collect all PowerShell command line requests looking for Base64-encoded commands to help identify malicious fileless attacks.
• Look for excessive .RAR, 7zip, or WinZip processes, especially with suspicious file names, to help discover exfiltration staging (suspicious file names include naming conventions such as, 1.zip, 2.zip, etc.).
• Collect all user logins and look for outlier behavior, such as a time of login that is out of the ordinary for the user or a login from an Internet Protocol (IP) address not normally used by the user.
• On Linux/Unix operating systems (OSs) and services, collect all cron and systemd /etc/passwd files looking for unusual accounts and log files, such as accounts that appear to be system / proc users but have an interactive shell such as /bin/bash rather than /bin/false/nologin
• On Microsoft OSs, collect Scheduled Tasks, Group Policy Objects (GPO), and Windows Management Instrumentation (WMI) database storage on hosts of interest looking for malicious persistence.
• Use the Microsoft Windows Sysinternals Autoruns tool, which allows IT security practitioners to view—and, if needed, easily disable—most programs that automatically load onto the system.
• Check the Windows registry and Volume Shadow Copy Service for evidence of intrusion.
• Consider blocking script files like .js, .vbs, .zip, .7z, .sfx and even Microsoft Office documents or PDFs.
• Collect any scripts or binary ELF files from /dev/shm/tmp and /var/tmp.
• Kernel modules listed (lsmod) for signs of a rootkit; dmesg command output can show signs of rootkit loading and device attachment amongst other things.
• Archive contents of /var/log for all hosts.
• Archive output from journald. These logs are pretty much the same as /var/log; however, they provide some integrity checking and are not as easy to modify. This will eventually replace the /var/log contents for some aspects of the system. Check for additional Secure Shell (SSH) keys added to user’s authorized_keys.

Network-Based Artifacts

• Anomalous DNS traffic and activity, unexpected DNS resolution servers, unauthorized DNS zone transfers, data exfiltration through DNS, and changes to host files
• Remote Desktop Protocol (RDP), virtual private network (VPN) sessions, SSH terminal connections, and other remote abilities to evaluate for inbound connections, unapproved third-party tools, cleartext information, and unauthorized lateral movement
• Uniform Resource Identifier (URI) strings, user agent strings, and proxy enforcement actions for abusive, suspicious, or malicious website access
• Hypertext Transfer Protocol Secure/Secure Sockets Layer (HTTPS/SSL)
• Unauthorized connections to known threat indicators
• Telnet
• Internet Relay Chat (IRC)
• File Transfer Protocol (FTP)

Information to Review for Network Analysis

• Look for new connections on previously unused ports.
• Look for traffic patterns related to time, frequency, and byte count of the connections.
• Preserve proxy logs. Add in the URI parameters to the event log if possible.
• Disable LLMNR on the corporate network; if unable to disable, collect LLMNR (UDP port 5355) and NetBIOS-NS (UDP port 137).
• Review changes to routing tables, such as weighting, static entries, gateways, and peer relationships.

Common Mistakes in Incident Handling

After determining that a system or multiple systems may be compromised, system administrators and/or system owners are often tempted to take immediate actions. Although well intentioned to limit the damage of the compromise, some of those actions have the adverse effect of:

1. Modifying volatile data that could give a sense of what has been done; and
2. Tipping the threat actor that the victim organization is aware of the compromise and forcing the actor to either hide their tracks or take more damaging actions (like detonating ransomware).

Below—and partially listed in figure 1—are actions to avoid taking and some of the consequence of taking such actions.

• Mitigating the affected systems before responders can protect and recover data
  • This can cause the loss of volatile data such as memory and other host-based artifacts.
  • The adversary may notice and change their tactics, techniques, and procedures.
• Touching adversary infrastructure (Pinging, NSlookup, Browsing, etc.)
  • These actions can tip off the adversary that they have been detected.
• Preemptively blocking adversary infrastructure
  • Network infrastructure is fairly inexpensive. An adversary can easily change to new command and control infrastructure, and you will lose visibility of their activity.
• Preemptive credential resets
  • Adversary likely has multiple credentials, or worse, has access to your entire Active Directory.
  • Adversary will use other credentials, create new credentials, or forge tickets.
• Failure to preserve or collect log data that could be critical to identifying access to the compromised systems
  • If critical log types are not collected, or are not retained for a sufficient length of time, key information about the incident may not be determinable. Retain log data for at least one year.
• Communicating over the same network as the incident response is being conducted (ensure all communications are held out-of-band)
• Only fixing the symptoms, not the root cause
  • Playing “whack-a-mole” by blocking an IP address—without taking steps to determine what the binary is and how it got there—leaves the adversary an opportunity to change tactics and retain access to the network.

Figure 1: Common missteps to be avoided when responding to an incident

Mitigations

The following recommendations and best practices may be helpful during the investigation and remediation process. Note: Although this guidance provides best practices to mitigate common attack vectors, organizations should specific to [Client]’s network should tailor mitigations specific to their network.

General Mitigation Guidance Restrict or Discontinue Use of FTP and Telnet Services

The FTP and Telnet protocols transmit credentials in cleartext, which are susceptible to being intercepted. To mitigate this risk, discontinue FTP and Telnet services by moving to more secure file storage/file transfer and remote access services.

• Evaluate business needs and justifications to host files on alternative Secure File Transfer Protocol (SFTP) or HTTPS-based public sites.
• Use Secure Shell (SSH) for access to remote devices and servers.

Restrict or Discontinue Use of Non-approved VPN Services

• Investigate the business needs and justification for allowing traffic from non-approved VPN services.
• Identify such services across the enterprise and develop measures to add the application and browser plugins that enable non-approved VPN services to the denylist.
• Enhance endpoint monitoring to obtain visibility on devices with non-approved VPN services running. Enhanced endpoint monitoring and detection capabilities would enable an organization’s IT security personnel to manage approved software as well as identify and remove any instances of unapproved software.

Shut down or Decommission Unused Services and Systems

• Cyber actors regularly identify servers that are out of date or end of life (EOL) to gain access to a network and perform malicious activities. These present easy and safe locations to maintain persistence on a network.
• Often these services and servers are systems that have begun decommissioning, but the final stage has not been completed by shutting down the system. This means they are still running and vulnerable to compromise.
• Ensuring that decommissioning of systems has been completed or taking appropriate action to remove them from the network limits their susceptibility and reduces the investigative surface to be analyzed.

Quarantine and Reimage Compromised Hosts

Note: proceed with caution to avoid the adverse effects detailed in the Common Mistakes in Incident Handling section above.

• Reimage or remove any compromised systems found on the network.
• Monitor and educate users to be cautious of any downloads from third-party sites or vendors.
• Block the known bad domains and add a web content filtering capability to block malicious sites by category to prevent future compromise.
• Sanitize removable media and investigate network shares accessible by users.
• Improve existing network-based malware detection tools with sandboxing capabilities.

Disable Unnecessary Ports, Protocols, and Services

• Identify and disable ports, protocols, and services not needed for official business to prevent would-be attackers from moving laterally to exploit vulnerabilities. This includes external communications as well as communications between networks.
• Document allowed ports and protocols at the enterprise level.
• Restrict inbound and outbound access to ports and protocols not justified for business use.
• Restrict allowed access list to assets justified by business use.
• Enable a firewall log for inbound and outbound network traffic as well as allowed and denied traffic.

Restrict or Disable Interactive Login for Service Accounts

Service accounts are privileged accounts dedicated to certain services to perform activities related to the service or application without being tied to a single domain user. Given that services tend to be privileged accounts and thereby have administrative privileges, they are often a target for attackers aiming to obtain credentials. Interactive login to a service account not directly tied to an end-user account makes it difficult to identify accountability during cyber incidents.

• Audit the Active Directory (AD) to identify and document active service accounts.
• Restrict use of service accounts using AD group policy.
• Disallow interactive login by adding service account to a group of non-interactive login users.
• Continuously monitor service account activities by enhancing logging.
• Rotate service accounts and apply password best practices without service, degradation, or disruption.

Disable Unnecessary Remote Network Administration Tools

• If an attacker (or malware) gains access to a remote user’s computer, steals authentication data (login/password), hijacks an active remote administration session, or successfully attacks a vulnerability in the remote administration tool’s software, the attacker (or malware) will gain unrestricted control of the enterprise network environment. Attackers can use compromised hosts as a relay server for reverse connections, which could enable them to connect to these remote administration tools from anywhere.
• Remove all remote administration tools that are not required for day-to-day IT operations. Closely monitor and log events for each remote-control session required by department IT operations.

Manage Unsecure Remote Desktop Services

Allowing unrestricted RDP access can increase opportunities for malicious activity such as on path and Pass-the-Hash (PtH) attacks.

• Implement secure remote desktop gateway solutions.
• Restrict RDP service trust across multiple network zones.
• Implement privileged account monitoring and short time password lease for RDP service use.
• Implement enhanced and continuous monitoring of RDP services by enabling logging and ensure RDP logins are captured in the logs.

Credential Reset and Access Policy Review

Credential resets need to be done to strategically ensure that all the compromised accounts and devices are included and to reduce the likelihood that the attacker is able to adapt in response to this.

• Force password resets; revoke and issue new certificates for affected accounts/devices.
• If it is suspected that the attacker has gained access to the Domain Controller, then the passwords for all local accounts—such as Guest, HelpAssistant, DefaultAccount, System, Administrator, and kbrtgt—should be reset. It is essential that the password for the kbrtgt account is reset as this account is responsible for handling Kerberos ticket requests as well as encrypting and signing them. The account should be reset twice (as the account has a two-password history).
  • The first account reset for the kbrtgt needs to be allowed to replicate prior to the second reset to avoid any issues.
• If it is suspected that the ntds.dit file has been exfiltrated, then all domain user passwords will need to be reset.
• Review access policies to temporarily revoke privileges/access for affected accounts/devices. If it is necessary to not alert the attacker (e.g., for intelligence purposes), then privileges can be reduced for affected accounts/devices to “contain” them.

Patch Vulnerabilities

Attackers frequently exploit software or hardware vulnerabilities to gain access to a targeted system.

• Known vulnerabilities in external facing devices and servers should be patched immediately, starting with the point of compromise, if known.
  • Ensure external-facing devices have not been previously compromised while going through the patching process.
• If the point of compromise (i.e., the specific software, device, server) is known, but how the software, device, or server was exploited is unknown, notify the vendor so they can begin analysis and develop a new patch.
• Follow vendor remediation guidance including the installation of new patches as soon as they become available.

General Recommendations and Best Practices Prior to an Incident

Properly implemented defensive techniques and programs make it more difficult for a threat actor to gain access to a network and remain persistent yet undetected. When an effective defensive program is in place, attackers should encounter complex defensive barriers. Attacker activity should also trigger detection and prevention mechanisms that enable organizations to identify, contain, and respond to the intrusion quickly. There is no single technique, program, or set of defensive techniques or programs that will completely prevent all attacks. The network administrator should adopt and implement multiple defensive techniques and programs in a layered approach to provide a complex barrier to entry, increase the likelihood of detection, and decrease the likelihood of a successful attack. This layered mitigation approach is known as defense-in-depth.

User Education

End users are the frontline security of the organizations. Educating them in security principles as well as actions to take and not take during an incident will increase the organization’s resilience and might prevent easily avoidable compromises.

• Educate users to be cautious of any downloads from third-party sites or vendors.
• Train users on recognizing phishing emails. There are several systems and services (free and otherwise) that can be deployed or leveraged.
• Train users on identifying which groups/individuals to contact when they suspect an incident.
• Train users on the actions they can and cannot take if they suspect an incident and why (some users will attempt to remediate and might make things worst).

Allowlisting

• Enable application directory allowlisting through Microsoft Software Restriction Policy or AppLocker.
• Use directory allowlisting rather than attempting to list every possible permutation of applications in a network environment. Safe defaults allow applications to run from PROGRAMFILES, PROGRAMFILES(X86), and SYSTEM32. Disallow all other locations unless an exception is granted.
• Prevent the execution of unauthorized software by using application allowlisting as part of the OS installation and security hardening process.

Account Control

• Decrease a threat actor’s ability to access key network resources by implementing the principle of least privilege.
• Limit the ability of a local administrator account to log in from a local interactive session (e.g., Deny access to this computer from the network) and prevent access via an RDP session.
• Remove unnecessary accounts and groups; restrict root access.
• Control and limit local administration; e.g. implementing Just Enough Administration (JEA), just-in-time (JIT) administration, or enforcing PowerShell Constrained Language mode via a User Mode Code Integrity (UMCI) policy.
• Make use of the Protected Users Active Directory group in Windows domains to further secure privileged user accounts against pass-the-hash attacks.

Backups

• Identify what data is essential to keeping operations running; make regular backup copies.
• Test that backups are working to ensure they can restore the data in the event of an incident.
• Create offline backups to help recover from a ransomware attack or from disasters (fire, flooding, etc.).
• Securely store offline backups at an offsite location. If feasible, choose an offsite location that is at a distance from the primary location that would be unaffected in the event of a regional natural disaster.

Workstation Management

• Create and deploy a secure system baseline image to all workstations.
• Mitigate potential exploitation by threat actors by following a normal patching cycle for all OSs, applications, and software, with exceptions for emergency patches.
• Apply asset and patch management processes.
• Reduce the number of cached credentials to one (if a laptop) or zero (if a desktop or fixed asset).

Host-Based Intrusion Detection / Endpoint Detection and Response

• Configure and monitor workstation system logs through a host-based endpoint detection and response platform and firewall.
• Deploy an anti-malware solution on workstations to prevent spyware, adware, and malware as part of the OS security baseline.
  • Ensure that your anti-malware solution remains up to date.
• Monitor antivirus scan results on a regular basis.

Server Management

• Create a secure system baseline image and deploy it to all servers.
• Upgrade or decommission end-of-life non-Windows servers.
• Upgrade or decommission servers running Windows Server 2003 or older versions.
• Implement asset and patch management processes.
• Audit for and disable unnecessary services.

Server Configuration and Logging

• Establish remote server logging and retention.
• Reduce the number of cached credentials to zero.
• Configure and monitor system logs via a centralized security information and event management (SIEM) appliance.
• Add an explicit DENY for %USERPROFILE%.
• Restrict egress web traffic from servers.
• In Windows environments, use Restricted Admin mode or remote credential guard to further secure remote desktop sessions against pass-the-hash attacks.
• Restrict anonymous shares.
• Limit remote access by only using jump servers for such access.
• On Linux, use SELINUX or AppArmor in enforcing mode and/or turn on audit logging.
• Turn on bash shell logging; ship this and all logs to a remote server.
• Do not allow users to use su. Use Sudo -l instead.
• Configure automatic updates in yum or apt.
• Mount /var/tmp and /tmp as noexec.

Change Control

• Create a change control process for all implemented changes.

Network Security

• Implement an intrusion detection system (IDS).
  • Apply continuous monitoring.
  • Send alerts to a SIEM tool.
  • Monitor internal activity (this tool may use the same tap points as the netflow generation tools).
• Employ netflow capture.
  • Set a minimum retention period of 180 days.
  • Capture netflow on all ingress and egress points of network segments, not just at the Managed Trusted Internet Protocol Services or Trusted Internet Connections locations.
• Capture all network traffic
  • Retain captured traffic for a minimum of 24 hours.
  • Capture traffic on all ingress and egress points of the network.
• Use VPN
  • Maintain site-to-site VPN with customers and vendors.
  • Authenticate users utilizing site-to-site VPNs.
  • Use authentication, authorization, and accounting for controlling network access.
  • Require smartcard authentication to an HTTPS page in order to control access. Authentication should also require explicit rostering of permitted smartcard distinguished names to enhance the security posture on both networks participating in the site-to-site VPN.
• Establish appropriate secure tunneling protocol and encryption.
• Strengthen router configuration (e.g., avoid enabling remote management over the internet and using default IP ranges, automatically log out after configuring routers, and use encryption.).
• Turn off Wi-Fi protected setup, enforce the use of strong passwords, and keep router firmware up-to-date.
• Improve firewall security (e.g., enable automatic updates, revise firewall rules as appropriate, implement allowlists, establish packet filtering, enforce the use of strong passwords, encrypt networks).
  • Whenever possible, ensure access to network devices via external or untrusted networks (specifically the internet) is disabled.
• Manage access to the internet (e.g., providing internet access from only devices/accounts that need it, proxying all connections, disabling internet access for privileged/administrator accounts, enabling policies that restrict internet access using a blocklist, a resource allowlist, content type, etc.)
  • Conduct regular vulnerability scans of the internal and external networks and hosted content to identify and mitigate vulnerabilities.
  • Define areas within the network that should be segmented to increase the visibility of lateral movement by a threat and increase the defense-in-depth posture.
  • Develop a process to block traffic to IP addresses and domain names that have been identified as being used to aid previous attacks.
• Evaluate and consider the security configurations of Microsoft Office 365 (O365) and other cloud collaboration service platforms prior to deployment.
  • Use multi-factor authentication. This is the best mitigation technique to protect against credential theft for O365 administrators and users.
  • Protect Global Admins from compromise and use the principle of “Least Privilege.”
  • Enable unified audit logging in the Security and Compliance Center.
  • Enable alerting capabilities.
  • Integrate with organizational SIEM solutions.
  • Disable legacy email protocols, if not required, or limit their use to specific users.

Network Infrastructure Recommendations

• Create a secure system baseline image and deploy it to all networking equipment (e.g., switches, routers, firewalls).
• Remove unnecessary OS files from the internetwork operating system (IOS). This will limit the possible targets of persistence (i.e., files to embed malicious code) if the device is compromised and will align with National Security Agency Network Device Integrity best practices.
• Remove vulnerable IOS OS files (i.e., older iterations) from the device’s boot variable (i.e., show boot or show bootvar).
• Update to the latest available operating system for IOS devices.
• On devices with a Secure Sockets Layer VPN enabled, routinely verify customized web objects against the organization’s known good files for such VPNs, to ensure the devices remain free of unauthorized modification.
• Ensure that any incident response tools that point to external domains are either removed or updated to point to internal security tools. If this is not done and an external domain to which a tool points expires, a malicious threat actor may register it and start collecting telemetry from the infrastructure.

Host Recommendations

• Implement policies to block workstation-to-workstation RDP connections through a Group Policy Object on Windows, or by a similar mechanism.
• Store system logs of mission critical systems for at least one year within a SIEM tool.
• Review the configuration of application logs to verify that recorded fields will contribute to an incident response investigation.

User Management

• Reduce the number of domain and enterprise administrator accounts.
• Create non-privileged accounts for privileged users and ensure they use the non- privileged accounts for all non-privileged access (e.g., web browsing, email access).
• If possible, use technical methods to detect or prevent browsing by privileged accounts (authentication to web proxies would enable blocking of Domain Administrators).
• Use two-factor authentication (e.g., security tokens for remote access and access to any sensitive data repositories).
• If soft tokens are used, they should not exist on the same device that is requesting remote access (e.g., a laptop) and instead should be on a smartphone, token, or other out-of-band device.
• Create privileged role tracking.
• Create a change control process for all privilege escalations and role changes on user accounts.
• Enable alerts on privilege escalations and role changes.
• Log privileged user changes in the network environment and create an alert for unusual events.
• Establish least privilege controls.
• Implement a security-awareness training program.

Segregate Networks and Functions

Proper network segmentation is a very effective security mechanism to prevent an intruder from propagating exploits or laterally moving around an internal network. On a poorly segmented network, intruders are able to extend their impact to control critical devices or gain access to sensitive data and intellectual property. Security architects must consider the overall infrastructure layout, segmentation, and segregation. Segregation separates network segments based on role and functionality. A securely segregated network can contain malicious occurrences, reducing the impact from intruders, in the event that they have gained a foothold somewhere inside the network.

Physical Separation of Sensitive Information

Local Area Network (LAN) segments are separated by traditional network devices such as routers. Routers are placed between networks to create boundaries, increase the number of broadcast domains, and effectively filter users’ broadcast traffic. These boundaries can be used to contain security breaches by restricting traffic to separate segments and can even shut down segments of the network during an intrusion, restricting adversary access.

Recommendations:

• Implement Principles of Least Privilege and need-to-know when designing network segments.
• Separate sensitive information and security requirements into network segments.
• Apply security recommendations and secure configurations to all network segments and network layers.

Virtual Separation of Sensitive Information

As technologies change, new strategies are developed to improve IT efficiencies and network security controls. Virtual separation is the logical isolation of networks on the same physical network. The same physical segmentation design principles apply to virtual segmentation but no additional hardware is required. Existing technologies can be used to prevent an intruder from breaching other internal network segments.

Recommendations:

• Use Private Virtual LANs to isolate a user from the rest of the broadcast domains.
• Use Virtual Routing and Forwarding (VRF) technology to segment network traffic over multiple routing tables simultaneously on a single router.
• Use VPNs to securely extend a host/network by tunneling through public or private networks.

Additional Best Practices

• Implement a vulnerability assessment and remediation program.
• Encrypt all sensitive data in transit and at rest.
• Create an insider threat program.
• Assign additional personnel to review logging and alerting data.
• Complete independent security (not compliance) audits.
• Create an information sharing program.
• Complete and maintain network and system documentation to aid in timely incident response, including:
  • Network diagrams,
  •  Asset owners,
  • Type of asset, and
  • An up-to-date incident response plan.

Resources

• CISA Insights
• CISA Alert: Using Rigorous Credential Control to Mitigate Trusted Network Exploitation
• CISA Alert: Microsoft Office 365 Security Recommendations
• CISA Incident Handling Overview for Election Officials
• Preparing for and Responding to Cyber Security Incidents (ACSC)
• Strategies to Mitigate Cyber Security Incidents (ACSC)
• Managing Cyber Security Incidents (ACSC)
• Incident Management (UK NCSC)
• Incident Management: Be Resilient, Be Prepared (NZ NCSC)
• Canadian Centre for Cyber Security Publications
• Baseline Cyber Security Controls for Small and Medium Organizations (Canada)
• Guideline on Network Security Zones (Canada)
• Network Security Zoning - Design Considerations for Placement of Services within Zones (Canada)

References

• [1] Australian Cyber Security Centre (ACSC)
• [2] Canada’s Communication Security Establishment
• [3] New Zealand National Cyber Security Centre (NZ NCSC)
• [4] New Zealand CERT NZ
• [5] United Kingdom National Cyber Security Centre (UK NCSC)
• [6] United States Cybersecurity and Infrastructure Security Agency (CISA)

Revisions

• September 1, 2020: Initial Version

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: August 26, 2020
Summary

This Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques.

This joint advisory is the result of analytic efforts among the Cybersecurity and Infrastructure Security Agency (CISA), the Department of the Treasury (Treasury), the Federal Bureau of Investigation (FBI) and U.S. Cyber Command (USCYBERCOM). Working with U.S. government partners, CISA, Treasury, FBI, and USCYBERCOM identified malware and indicators of compromise (IOCs) used by the North Korean government in an automated teller machine (ATM) cash-out scheme—referred to by the U.S. Government as “FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks.”

CISA, Treasury, FBI, and USCYBERCOM highlight the cyber threat posed by North Korea—formally known as the Democratic People’s Republic of Korea (DPRK)—and provide recommended steps to mitigate the threat.

Refer to the following Malware Analysis Reports for associated IOCs: CROWDEDFLOUNDER, ECCENTRICBANDWAGON, ELECTRICFISH, FASTCash for Windows, HOPLIGHT, and VIVACIOUSGIFT.

Click here for a PDF version of this report.

!!!WARNING!!! Since February 2020, North Korea has resumed targeting banks in multiple countries to initiate fraudulent international money transfers and ATM cash outs. The recent resurgence follows a lull in bank targeting since late 2019. This advisory provides an overview of North Korea’s extensive, global cyber-enabled bank robbery scheme, a short profile of the group responsible for this activity, in-depth technical analysis, and detection and mitigation recommendations to counter this ongoing threat to the Financial Services sector. !!!WARNING!!!

 

Technical Details

North Korea's intelligence apparatus controls a hacking team dedicated to robbing banks through remote internet access. To differentiate methods from other North Korean malicious cyber activity, the U.S. Government refers to this team as BeagleBoyz, who represent a subset of HIDDEN COBRA activity. The BeagleBoyz overlap to varying degrees with groups tracked by the cybersecurity industry as Lazarus, Advanced Persistent Threat 38 (APT38), Bluenoroff, and Stardust Chollima and are responsible for the FASTCash ATM cash outs reported in October 2018, fraudulent abuse of compromised bank-operated SWIFT system endpoints since at least 2015, and lucrative cryptocurrency thefts. This illicit behavior has been identified by the United Nations (UN) DPRK Panel of Experts as evasion of UN Security Council resolutions, as it generates substantial revenue for North Korea. North Korea can use these funds for its UN-prohibited nuclear weapons and ballistic missile programs. Additionally, this activity poses significant operational risk to the Financial Services sector and erodes the integrity of the financial system.

The BeagleBoyz’s bank robberies pose severe operational risk for individual firms beyond reputational harm and financial loss from theft and recovery costs. The BeagleBoyz have attempted to steal nearly $2 billion since at least 2015, according to public estimates. Equally concerning, these malicious actors have manipulated and, at times, rendered inoperable, critical computer systems at banks and other financial institutions.  

• In 2018, a bank in Africa could not resume normal ATM or point of sale services for its customers for almost two months following an attempted FASTCash incident.
• The BeagleBoyz often put destructive anti-forensic tools onto computer networks of victim institutions. Additionally, in 2018, they deployed wiper malware against a bank in Chile that crashed thousands of computers and servers to distract from efforts to send fraudulent messages from the bank’s compromised SWIFT terminal.

North Korea’s widespread international bank robbery scheme that exploits critical banking systems may erode confidence in those systems and presents risks to financial institutions across the world. Any BeagleBoyz robbery directed at one bank implicates many other financial services firms in both the theft and the flow of illicit funds back to North Korea. BeagleBoyz activity fits a known North Korean pattern of abusing the international financial system for profit.

• Fraudulent ATM cash outs have affected upwards of 30 countries in a single incident. The conspirators have withdrawn cash from ATM machines operated by various unwitting banks in multiple countries, including in the United States.
• The BeagleBoyz also use unwitting banks, including banks in the United States, for their SWIFT fraud scheme. These banks are custodians of accounts belonging to victim banks or unknowingly serve as a pass-through for the fraud. Most infamously, the BeagleBoyz stole $81 million from the Bank of Bangladesh in 2016. The Federal Reserve Bank of New York stopped the remainder of this attempted $1 billion theft after detecting anomalies in the transfer instructions they had received.

FASTCash Update

North Korea’s BeagleBoyz are responsible for the sophisticated cyber-enabled ATM cash-out campaigns identified publicly as “FASTCash” in October 2018. Since 2016, the BeagleBoyz have perpetrated the FASTCash scheme, targeting banks’ retail payment system infrastructure (i.e., switch application servers processing International Standards Organization [ISO] 8583 messages, which is the standard for financial transaction messaging).

Since the publication of the in October 2018, there have been two particularly significant developments in the campaign: (1) the capability to conduct the FASTCash scheme against banks hosting their switch applications on Windows servers, and (2) an expansion of the FASTCash campaign to target interbank payment processors.

• In October 2018, the U.S. Government identified malware used in the FASTCash scheme that has the capability to manipulate AIX servers running a bank's switch application to intercept financial request messages and reply with fraudulent, but legitimate-looking, affirmative response messages to enable extensive ATM cash outs. The U.S. Government has since identified functionally equivalent malware for the Windows operating system. Please see the Technical Analysis section below for more information about the ISO 8583 malware for Windows.
• The BeagleBoyz initially targeted switch applications at individual banks with FASTCash malware but, more recently, have targeted at least two regional interbank payment processors. This suggests the BeagleBoyz are exploring upstream opportunities in the payments ecosystem.

For more information about FASTCash, please see https://www.us-cert.gov/ncas/alerts/TA18-275A.

BEAGLEBOYZ Profile

The BeagleBoyz, an element of the North Korean government’s Reconnaissance General Bureau, have likely been active since at least 2014. As opposed to typical cybercrime, the group likely conducts well-planned, disciplined, and methodical cyber operations more akin to careful espionage activities. Their malicious cyber operations have netted hundreds of millions of U.S. dollars and are likely a major source of funding for the North Korean regime. The group has always used a calculated approach, which allows them to sharpen their tactics, techniques, and procedures while evading detection. Over time, their operations have become increasingly complex and destructive. The tools and implants employed by this group are consistently complex and demonstrate a strong focus on effectiveness and operational security.

Community Identifiers

The BeagleBoyz overlap to varying degrees with groups tracked by the cybersecurity industry as: APT38 (FireEye), Bluenoroff (Kaspersky), Lazarus Group (ESTSecurity), and Stardust Chollima (CrowdStrike).

Targeted Nations

The BeagleBoyz likely have targeted financial institutions in the following nations from 2015 through 2020: Argentina, Brazil, Bangladesh, Bosnia and Herzegovina, Bulgaria, Chile, Costa Rica, Ecuador, Ghana, India, Indonesia, Japan, Jordan, Kenya, Kuwait, Malaysia, Malta, Mexico, Mozambique, Nepal, Nicaragua, Nigeria, Pakistan, Panama, Peru, Philippines, Singapore, South Africa, South Korea, Spain, Taiwan, Tanzania, Togo, Turkey, Uganda, Uruguay, Vietnam, Zambia (figure 1).

Figure 1: Nations probably targeted by BeagleBoyz since 2015

Anatomy of a BeagleBoyz Bank Heist

Figure 2 provides a graphical depiction of a BeagleBoyz bank heist. The next section describes in detail the end-to-end actions the BeagleBoyz take to rob financial institutions with a malicious cyber operation.

Figure 2: BeagleBoyz Bank Heist overview

Technical Analysis

The BeagleBoyz use a variety of tools and techniques to gain access to a financial institution’s network, learn the topology to discover key systems, and monetize their access. The technical analysis below represents an amalgamation of multiple known incidents, rather than details of a single operation. These findings are presented to highlight the group’s ability to tailor their techniques to different targets and to adapt their methods over time. Consequently, there is a need for layered mitigations to effectively defend against this activity, as relying solely on network signature detection will not sufficiently protect against North Korea’s BeagleBoyz.

Initial Access

The BeagleBoyz have used a variety of techniques, such as spearphishing and watering holes, to enable initial access into targeted financial institutions. Towards the end of 2018 through 2019 and in early 2020, the BeagleBoyz demonstrated the use of social engineering tactics by carrying out job-application themed phishing attacks using the following publicly available malicious files.

MD5: b484b0dff093f358897486b58266d069
MD5: f34b72471a205c4eee5221ab9a349c55
MD5: 4c26b2d0e5cd3bfe0a3d07c4b85909a4
MD5: 52ec074d8cb8243976963674dd40ffe7
MD5: d1d779314250fab284fd348888c2f955
MD5: 41fd85ff44107e4604db2f00e911a766
MD5: cf733e719e9677ebfbc84a3ab08dd0dc
MD5: 01d397df2a1cf1d4c8e3615b7064856c

The BeagleBoyz may also be working with or contracting out to criminal hacking groups, like TA505, for initial access development. The third party typically uses commodity malware to establish initial access on a victim’s network and then turns over the access to the BeagleBoyz for follow-on exploitation, which may not occur until months later.

The BeagleBoyz have also used the following techniques to gain an initial foothold on a targeted computer network (Initial Access [TA0001]).

• Email an attachment with malware to a specific individual, company, or industry (Phishing: Spearphishing Attachment [T1566.001])
• Compromise a website visited by users in specific communities, industries, or regions (Drive-by Compromise [T1189])
• Exploit a weakness (a bug, glitch, or design vulnerability) in an internet-facing computer system (such as a database or web server) (Exploit Public Facing Application [T1190])
• Steal the credentials of a specific user or service account to bypass access controls and gain increased privileges (Valid Accounts [T1078])
• Breach organizations that have access to the intended victim’s organization and exploit their trusted relationship (Trusted Relationship [T1199])
• Use remote services to initially access and persist within a victim’s network (External Remote Services [T1133])

Execution

The BeagleBoyz selectively exploit victim computer systems after initially compromising a computer connected to a financial institution’s corporate network. After gaining initial access to a financial institution’s corporate network, the BeagleBoyz are selective in which victim systems they further exploit. The BeagleBoyz use a variety of techniques to run their code on local and remote victim systems [Execution [TA0002]).

• Use command-line interfaces to interact with systems and execute other software (Command and Scripting Interpreter [T1059])
• Use scripts (e.g., VBScript and PowerShell) to speed up operational tasks, reduce the time required to gain access to critical resources, and bypass process monitoring mechanisms by directly interacting with the operating system (OS) at an Application Programming Interface (API) level instead of calling other programs (Command and Scripting Interpreter: PowerShell [T1059.001], Command and Scripting Interpreter: Visual Basic [T1059.005])
• Rely upon specific user actions, such as opening a malicious email attachment (User Execution [T1204])
• Exploit software vulnerabilities to execute code on a system (Exploitation for Client Execution [T1203])
• Create new services or modify existing services to execute executables, commands, or scripts (System Services: Service Execution [T1569.002])
• Employ the Windows module loader to load Dynamic Link Libraries (DLLs) from arbitrary local paths or arbitrary Universal Naming Convention (UNC) network paths and execute arbitrary code on a system (Shared Modules [T1129])
• Use the Windows API to execute arbitrary code on the victim's system (Native API [T1106])
• Use a system's graphical user interface (GUI) to search for information and execute files (Remote Services [T1021])
• Use the Task Scheduler to run programs at system startup or on a scheduled basis for persistence, conduct remote execution for lateral movement, gain SYSTEM privileges for privilege escalation, or run a process under the context of a specified account (Scheduled Task/Job [T1053])
• Abuse compiled Hypertext Markup Language (HTML) files (.chm), commonly distributed as part of the Microsoft HTML Help system, to conceal malicious code (Signed Binary Proxy Execution: Compiled HTML File [T1218.001])
• Abuse Windows rundll32.exe to execute binaries, scripts, and Control Panel Item files (.CPL) and execute code via proxy to avoid triggering security tools (Signed Binary Proxy Execution: Rundl32 [T1218.001])
• Exploit cron in Linux and launchd in macOS systems to create pre-scheduled and periodic background jobs (Scheduled Task/Job: Cron [T1053.003], Scheduled Task/Job: Launchd [T1053.004])

Persistence

The BeagleBoyz use many techniques to maintain access on compromised networks through system restarts, changed credentials, and other interruptions that could affect their access (Persistence [TA0003]).

• Add an entry to the “run keys” in the Registry or an executable to the startup folder to execute malware as the user logs in under the context of the user’s associated permissions levels (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder [T1547.001])
• Install a new service that can be configured to execute at startup using utilities to interact with services or by directly modifying the Registry (Create or Modify System Process: Windows Service [T1543.003])
• Compromise an openly accessible web server with a web script (known as web shell) to use the web server as a gateway into a network and to serve as redundant access or persistence mechanism (Server Software Component: Web Shell [T1505.003])
• Manipulate accounts (e.g., modifying permissions, modifying credentials, adding or changing permission groups, modifying account settings, or modifying how authentication is performed) to maintain access to credentials and certain permission levels within an environment (Account Manipulation [T1098])
• Steal the credentials of a specific user or service account to bypass access controls and retain access to remote systems and externally available services (Valid Accounts [T1078])
• Use the Task Scheduler to run programs at system startup or on a scheduled basis for persistence, conduct remote execution for lateral movement, gain SYSTEM privileges for privilege escalation, or run a process under the context of a specified account (Scheduled Task/Job [T1053])
• Abuse the Windows DLLs search order and programs that ambiguously specify DLLs to gain privilege escalation and persistence (Hijack Execution Flow: DLL Search Order Hijacking [T1056.004])
• Exploit hooking to load and execute malicious code within the context of another process to mask the execution, allow access to the process’s memory, and, possibly, gain elevated privileges (Input Capture: Credential API Hooking [T1574.001])
• Use remote services to persist within a victim’s network (External Remote Services [T1133])

Privilege Escalation

The BeagleBoyz often seek access to financial institutions’ systems that have tiered user and system accounts with customized privileges. The BeagleBoyz must overcome these restrictions to access necessary systems, monitor normal user behavior, and install and execute additional malicious tools. To do so, the BeagleBoyz have used the following techniques to gain higher-level permissions on a system or network (Privilege Escalation [TA0004]).

• Inject code into processes to evade process-based defenses and elevate privileges (Process Injection [T1055])
• Install a new service that can be configured to execute at startup using utilities to interact with services or by directly modifying the Registry (Create or Modify System Process: Windows Service [T1543.003])
• Compromise an openly accessible web server with web shell to use the web server as a gateway into a network (Server Software Component: Web Shell [T1505.003])
• Use the Task Scheduler to run programs at system startup or on a scheduled basis for persistence, conduct remote execution as part of lateral movement, gain SYSTEM privileges for privilege escalation, or run a process under the context of a specified account (Scheduled Task/Job [T1053])
• Steal the credentials of a specific user or service account to bypass access controls and grant increased privileges (Valid Accounts [T1078])
• Exploit hooking to load and execute malicious code within the context of another process to mask the execution, allow access to the process’s memory, and, possibly, gain elevated privileges (Input Capture: Credential API Hooking [T1574.001])
• Perform Sudo (sometimes referred to as “super user do”) caching or use the Soudoers file to elevate privileges in Linux and macOS systems (Abuse Elevation Control Mechanism: Sudo and Sudo Caching [T1548.003])
• Execute malicious payloads by hijacking the search order used to load DLLs (Hijack Execution Flow: DLL Search Order Hijacking [T1574.001])

Defense Evasion

Throughout their exploitation of a financial institution’s computer network, the BeagleBoyz have used different techniques to avoid detection by OS security features, system and network security software, and system audits (Defense Evasion [TA0005]).

• Exploit code signing certificates to masquerade malware and tools as legitimate binaries and bypass security policies that allow only signed binaries to execute on a system (Subvert Trust Controls Signing [T1553.002])
• Remove malware, tools, or other non-native files dropped or created throughout an intrusion to reduce their footprint or as part of the post-intrusion cleanup process (Indicator Removal on Host: File Deletion [T1070.004])
• Inject code into processes to evade process-based defenses (Process Injection [T1055])
• Use scripts (such as VBScript and PowerShell) to bypass process monitoring mechanisms by directly interacting with the OS at an API level instead of calling other programs (Command and Scripting Interpreter: PowerShell [T1059.001], Command and Scripting Interpreter: Visual Basic [T1059.005])
• Attempt to make an executable or file challenging to discover or analyze by encrypting, encoding, or obfuscating its contents on the system or in transit (Obfuscated Files or Information [T1027])
• Use external previously compromised web services to relay commands to a victim system (Web Service [T1102])
• Use software packing to change the file signature, bypass signature-based detection, and decompress the executable code in memory (Unsecured Credentials: Private Keys [T1552.004])
• Use obfuscated files or information to hide intrusion artifacts (Deobfuscate/Decode Files or Information [T1140])
• Modify the data timestamps (the modify, access, create, and change times fields) to mimic files that are in the same folder, making them appear inconspicuous to forensic analysts or file analysis tools (Indicator Removal on Host: Remove Timestamp [T1070.006])
• Abuse Windows utilities to implement arbitrary execution commands and subvert detection and mitigation controls (such as Group Policy) that limit or prevent the usage of cmd.exe or file extensions commonly associated with malicious payloads (Indirect Command Execution [T1202])
• Use various methods to prevent their commands from appearing in logs and clear command history to remove activity traces (Indicator Removal on Host: Clear Command History [T1070.003])
• Disable security tools to avoid possible detection of tools and events (Impair Defenses: Disable or Modify Tools [T1562.001])
• Steal the credentials of a specific user or service account to bypass access controls and grant increased privileges (Valid Accounts [T1078])
• Delete or alter generated artifacts on a host system, including logs and potentially captured files, to remove traces of activity (Indicator Removal on Host: File Deletion [T1070.004])
• Abuse compiled HTML files (.chm), commonly distributed as part of the Microsoft HTML Help system, to conceal malicious code (Signed Binary Proxy Execution: Compiled HTML File [T1218.001])
• Prepend a space to all their terminal commands to operate without leaving traces in the HISTCONTROL environment, which is configured to ignore commands that start with a space (Impair Defenses: HISTCONTROL [T1562.003])
• Modify malware so it has a different signature and re-use it in cases when the group determines it was quarantined (Obfuscated Files or Information: Indicator Removal from Tools [T1027.005])
• Attempt to block indicators or events typically captured by sensors from being gathered and analyzed (Impair Defenses: Indicator Blocking [T1562.006])
• Use the Windows DLLs search order and programs that ambiguously specify DLLs to gain privilege escalation and persistence (Hijack Execution Flow: DLL Search Order Hijacking [T1574.001])
• Manipulate or abuse the attributes or location of an executable (masquerading) to better blend in with the environment and increase the chances of deceiving a security analyst or product (Masquerading [T1036])
• Exploit rootkits to hide programs, files, network connections, services, drivers, and other system components (Rootkit [T1014])
• Abuse the Windows rundll32.exe to execute binaries, scripts, and .CPL files, and execute code via proxy to avoid triggering security tools (Signed Binary Proxy Execution: Rundl32 [T1218.001])

Credential Access

The BeagleBoyz may use malware like ECCENTRICBANDWAGON to log key strokes and take screen captures. The U.S. Government has identified some ECCENTRICBANDWAGON samples that have the ability to RC4 encrypt logged data, but the tool has no network functionality. The implant uses specific formatting for logged data and saves the file locally; another tool obtains the logged data. The implant also contains no mechanism for persistence or self-loading and expects a specific configuration file to be present on the system. A full technical report for ECCENTRICBANDWAGON is available at https://us-cert.cisa.gov/northkorea.

The BeagleBoyz may not always need to use custom keyloggers like ECCENTRICBANDWAGON or other tools to obtain credentials from a compromised system. Depending on the victim’s environment, the BeagleBoyz have used the following techniques to steal credentials (Credential Access [TA0006]).

• Capture user input, such as keylogging (the most prevalent type of input capture), to obtain credentials for valid accounts and information collection (Input Capture [T1056])
• Obtain account login and password information, generally in the form of a hash or a clear text password, from the operating system and software (OS Credential Dumping [T1056])
• Gather private keys from compromised systems to authenticate to remote services or decrypt other collected files (Unsecured Credentials: Private Keys [T1552.004])
• Manipulate default, domain, local, and cloud accounts to maintain access to credentials and certain permission levels within an environment (Account Manipulation [T1098])
• Abuse hooking to load and execute malicious code within the context of another process to mask the execution, allow access to the process's memory, and, possibly, gain elevated privileges (Input Capture: Credential API Hooking [T1056.004])
• Use brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable (Brute Force [T1110])

Discovery

Once inside a financial institution’s network, the BeagleBoyz appear to seek two specific systems—the SWIFT terminal and the server hosting the institution’s payment switch application. As they progress through a network, they learn about the systems they have accessed in order to map the network and gain access to the two goal systems. To do so, the BeagleBoyz have used the following techniques to gain knowledge about the systems and internal network (Discovery [TA0007]).

• Attempt to get detailed information about the operating system and hardware, such as version, patches, hotfixes, service packs, and architecture (System Information Discovery [T1082])
• Enumerate files and directories or search in specific locations of a host or network share for particular information within a file system (File and Directory Discovery [T1083])
• Get a list of security software, configurations, defensive tools, and sensors installed on the system (Software Discovery: Security Software Discovery [T1518.001])
• Procure information about running processes on a system to understand standard software running on network systems (Process Discovery [T1057])
• Identify primary users, currently logged in users, sets of users that commonly use a system, or active or inactive users (System Owner/User Discovery [T1033])
• Enumerate browser bookmarks to learn more about compromised hosts, reveal personal information about users, and expose details about internal network resources (Browser Bookmark Discovery [T1217])
• Look for information on network configuration and system settings on compromised systems, or perform remote system discovery (System Network Configuration Discovery [T1016])
• Interact with the Windows Registry to gather information about the system, configuration, and installed software (Query Registry [T1012])
• Get a list of open application windows to learn how the system is used or give context to data collected (Application Window Discovery [T1010])
• Attempt to get a listing of local system or domain accounts in the compromised system (Account Discovery [T1087])
• Obtain a list of network connections to and from the compromised system or remote system by querying for information over the network (System Network Connections Discovery [T1049])

Lateral Movement

To access a compromised financial institution’s SWIFT terminal and the server hosting the institution’s payment switch application, the BeagleBoyz leverage harvested credentials and take advantage of the accessibility of these critical systems from other systems in the institution’s corporate network. Specifically, the BeagleBoyz have been known to create firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443. Depending on the configuration of compromised systems and the security environment of the victim’s computer network, the BeagleBoyz have used the following techniques to enter and control remote systems on a compromised network (Lateral Movement [TA0008]).

• Copy files from one system to another to stage adversary tools or other files throughout an operation (Ingress Tool Transfer [T1105])
• Use Remote Desktop Protocol (RDP) to log into an interactive session with a system desktop GUI on a remote system (Remote Services: Remote Desktop Protocol [T1021.001])
• Employ hidden network shares, in conjunction with administrator-level valid accounts, to remotely access a networked system over Server Message Block (SMB) in order to interact with systems using remote procedure calls (RPCs), transfer files, and run transferred binaries through remote execution (Remote Services: SMB/Windows Admin Shares [T1021.002])
• Exploit valid accounts to log into a service specifically designed to accept remote connections and perform actions as the logged-on user (Remote Services [T1021])

Collection

Depending on various environmental attributes the BeagleBoyz encounter during their exploitation, they may deploy a variety of reconnaissance tools or use commonly available administrative tools for malicious purposes.

The BeagleBoyz, like other sophisticated cyber actors, also appear to use resident, legitimate administrative tools for reconnaissance purposes when they are available; this is commonly known as “living off the land.” PowerShell appears to be a popular otherwise-legitimate tool the BeagleBoyz favor for reconnaissance activities. For example, the BeagleBoyz often use publicly available code from PowerShell Empire for malicious purposes.

The BeagleBoyz have used the following techniques to gather information from exploited systems (Collection [TA0009]).

• Use automated methods, such as scripts, for collecting data (Automated Collection [T1119])
• Capture user input to obtain credentials and collect information (Input Capture [T1056])
• Collect local systems data from a compromised system (Data from Local System [T1005])
• Take screen captures of the desktop (Screen Capture [T1113])
• Collect data stored in the Windows clipboard from users (Clipboard Data [T1115])

Command and Control

The BeagleBoyz likely change tools—such as CROWDEDFLOUNDER and HOPLIGHT—over time to maintain remote access to financial institution networks and to interact with those systems.

Analysis of the following CROWDEDFLOUNDER samples was first released in October 2018 as part of the FASTCash campaign.

MD5 hash: 5cfa1c2cb430bec721063e3e2d144feb
MD5 hash: 4f67f3e4a7509af1b2b1c6180a03b3e4

The BeagleBoyz have used CROWDEDFLOUNDER as a remote access trojan (RAT) since at least 2018. The implant is designed to operate on Microsoft Windows hosts and can upload and download files, launch a remote command shell, inject into victim processes, obtain user and host information, and securely delete files. The implant may be packed with Themida to degrade or prevent effective reverse engineering or evade detection on a Windows host. It can be set to act in beacon or listening modes, depending on command line arguments or configuration specifications. The implant obfuscates network communications using a simple encoding algorithm. The listening mode of CROWDEDFLOUNDER facilitates proxies like ELECTRICFISH (discussed below) with tunneling traffic in a victim’s network.

More recently, the U.S. Government has found HOPLIGHT malware on victim systems, suggesting the BeagleBoyz are using HOPLIGHT for similar purposes. HOPLIGHT has the same basic RAT functionality as the CROWDEDFLOUNDER implant. In addition, HOPLIGHT has the capability to create fraudulent Transport Layer Security (TLS) sessions to obfuscate command and control (C2) connections, making detection and tracking of the malware’s communications difficult.

Full technical reports for CROWDEDFLOUNDER and HOPLIGHT are available at https://us-cert.cisa.gov/northkorea.

The BeagleBoyz use network proxy tunneling tools—including VIVACIOUSGIFT and ELECTRICFISH—to tunnel communications from non-internet facing systems like an ATM switch application server or a SWIFT terminal to internet-facing systems. The BeagleBoyz use these network proxy tunneling tools, likely placed at or near a victim’s network boundary, to tunnel other protocols such as RDP and Secure Shell or other implant traffic out from the internal network.

It appears that as the BeagleBoyz change proxy tools, there is some overlap between their use of older and newer malware. For example, the BeagleBoyz appear to have begun using ELECTRICFISH as they wound down use of VIVACIOUSGIFT. There has been a noticeable decline in ELECTRICFISH use following the U.S. Government’s disclosure of it in May 2019.

Full technical reports for VIVACIOUSGIFT and ELECTRICFISH are available at https://us-cert.cisa.gov/northkorea.

In addition to these tools, the BeagleBoyz have used the following techniques to communicate with financial institution victim systems under their control (Command and Control [TA0011]).

• Employ known encryption algorithms to conceal C2 traffic (Encrypted Channel [T1573])
• Communicate over commonly used standard application layer protocols and ports to avoid detection or detailed inspection and to blend with existing traffic (Application Layer Protocol [T1071])
• Encode C2 information using standard data encoding systems such as the American Standard Code for Information Interchange (ASCII), Unicode, Base64, Multipurpose Internet Mail Extensions, and 8-bit Unicode Transformation Format systems or other binary-to-text and character encoding systems (Data Encoding: Standard Encoding [T1132.001])
• Copy files between systems to stage adversary tools or other files (Ingress Transfer Tool [T1105])
• Use external previously compromised web services to relay commands to victim systems (Web Service [T1102])
• Employ a custom C2 protocol that mimics well-known protocols, or develop custom protocols (including raw sockets) to supplement protocols provided by another standard network stack (Non-Application Layer Protocol [T1095])
• Obfuscate C2 communications (but not necessarily encrypt them) to hide commands and make the content less conspicuous and more challenging to discover or decipher (Data Obfuscation [T1101])
• Employ connection proxies to direct network traffic between systems, act as an intermediary for network communications to a C2 server, or avoid direct connections to its infrastructure (Proxy [T1090])
• Exploit legitimate desktop support and remote access software to establish an interactive C2 channel to target systems within networks (Remote Access Software [T1219])

Cryptocurrency Exchange Heists

In addition to robbing traditional financial institutions, the BeagleBoyz target cryptocurrency exchanges to steal large amounts of cryptocurrency, sometimes valued at hundreds of millions of dollars per incident. Cryptocurrency offers the BeagleBoyz an irreversible method of theft that can be converted into fiat currency because the permanent nature of cryptocurrency transfers do not allow for claw-back mechanisms. Working with U.S. Government partners, CISA, Treasury, FBI, and USCYBERCOM identified COPPERHEDGE as the tool of choice for the BeagleBoyz to exploit cryptocurrency exchanges. COPPERHEDGE is a full-featured remote access tool capable of running arbitrary commands, performing system reconnaissance, and exfiltrating data. Full technical analysis of COPPERHEDGE is available at https://us-cert.cisa.gov/northkorea.

Exfiltration

During a cyber operation, the BeagleBoyz need to exfiltrate a variety of data from compromised systems. In addition to the C2 tools noted that have built-in exfiltration features, such as CROWDEDFLOUNDER and HOPLIGHT, the BeagleBoyz use the following techniques to steal data from a network (Exfiltration [TA0010]).

• Compress and encrypt collected data before exfiltration to minimize the amount of data sent over the web and make it portable, less conspicuous, and less detectable (Archive Collected Data [T1560])
• Steal collected data via scripts (although this may require other exfiltration techniques) (Automated Exfiltration [T1020])
• Encode data using the same protocol as the C2 channel and exfiltrate it over the C2 channel (Exfiltration Over C2 Channel [T1041])

Impact

The U.S. Government has observed the BeagleBoyz successfully monetize illicit access to financial institutions’ SWIFT terminals to enable wire fraud and gain access to the institutions’ payment switch application servers, which allowed fraudulent ATM cash outs. After gaining access to either one or both of these operationally critical systems, the BeagleBoyz monitor the systems to learn about their configurations and legitimate use patterns, and then they deploy bespoke tools to facilitate illicit monetization.

The cybersecurity community and Financial Services sector have released substantial information on the BeagleBoyz manipulation of compromised SWIFT terminals, describing their ability to monitor these systems, send fraudulent messages, and attempt to hide the fraudulent activity from detection. The discussion below focuses on the custom tools used to manipulate payment switch applications for ATM cash outs.

The BeagleBoyz use FASTCash malware to intercept financial request messages and reply with fraudulent but legitimate-looking affirmative response messages in the ISO 8583 format. The BeagleBoyz have functionally equivalent FASTCash malware for both UNIX and Windows that they deploy depending on the operating system running on the server hosting the bank’s payment switch application.

FASTCash for UNIX is composed of AIX executable files designed to inject code and libraries into a currently running process. One AIX executable provides export functions, which allows an application to manipulate transactions on financial systems using the ISO 8583 international standard for financial transaction card-originated interchange messaging. The injected executables interpret financial request messages and construct fraudulent financial response messages. For more details on FASTCash for UNIX malware, please see the FASTCash report at https://www.us-cert.gov/ncas/alerts/TA18-275A.

The BeagleBoyz use FASTCash for Windows to manipulate transactions processed by a switch application running on a Windows box. FASTCash for Windows is also specific to the ISO 8583 message format. The BeagleBoyz appear to have modified publicly available source code to write parts of the tool, likely to speed development. The malware contains code probably taken from open-source repositories on the internet to create hashmaps and hook functions and to parse ISO 8583 messages.

FASTCash for Windows injects itself into software running on a Windows platform. The malware then takes control of the software’s network send and receive functions, allowing it to manipulate ISO 8583 messages. The U.S. Government has identified two variants of FASTCash for Windows. One variant supports ASCII encoding. The BeagleBoyz appear to have modified the second variant’s message parsing code to support Extended Binary Coded Decimal Interchange Code (EBCIDC) encoding. Both ASCII and EBCDIC are character encoding formats.  

FASTCash for Windows malware uses code from github.com/petewarden/c_hashmap for hashmaps, code from Microsoft's Detours Library at github.com/Microsoft/Detours for hooking, and code from to parse ISO 8583 messages.

The malware hooks onto the send and receive function of the switch application so that it can process inbound request messages as they are received. FASTCash for Windows inspects the inbound message, probably looking for specific account numbers. If the account number matches an expected number, the malware constructs a fraudulent response message. If the account number does not match an expected number, the malware allows the request to pass through normally. If the malware constructs a fraudulent response message, it then sends it back to the acquirer without any further processing by the switch application, leaving the issuer without any awareness of the fraudulent transaction.

Full technical reports for FASTCash and FASTCash for Windows malware are available at https://us-cert.cisa.gov/northkorea.

The BeagleBoyz have used the following techniques to manipulate business and operational processes for monetary or destructive purposes (Impact [TA0040]).

• Corrupt or wipe data storage, data structures, and Master Boot Records (MBR) to interrupt network availability, services, and resources (Disk Wipe: Disk Structure Wipe [T1561.002], Data Destruction [T1485])
• Encrypt data on target systems and withhold access to the decryption key until a ransom is paid, or render data permanently inaccessible if the ransom is not paid (Data Encrypted for Impact [T1486])
• Stop, disable, or render services unavailable on a system to damage the environment or inhibit incident response (Service Stop [T1489])
• Insert, delete, or modify data at rest, in transit, or in use to manipulate outcomes, hide activity, and affect the business process, organizational understanding, and decision-making (Data Manipulation: Stored Data Manipulation [T1565.001], Data Manipulation: Transmitted Data Manipulation [T1565.002], Data Manipulation: Runtime Data Manipulation [T1565.003])

Mitigations

• Contact law enforcement, CISA, or Treasury immediately regarding any identified activity related to BeagleBoyz. (Refer to the Contact Information section.)
• Incorporate IOCs identified in CISA’s Malware Analysis Reports on https://us-cert.cisa.gov/northkorea into intrusion detection systems and security alert systems to enable active blocking or reporting of suspected malicious activity.

Recommendations for all Financial Institutions

• Verify compliance with Federal Financial Institutions Examination Council (FFIEC) handbooks, especially those related to Information Security and Payment Systems.
  • https://ithandbook.ffiec.gov/
• Verify compliance with industry security standards for critical systems, such as those available at:  
  • https://www.pcisecuritystandards.org
  • https://www.swift.com/myswift/customer-security-programme-csp/swift-customer-security-controls-framework

Recommendations for Institutions with Retail Payment Systems

Require chip and personal identification number (PIN) cryptogram validation.

• Implement chip and PIN requirements for debit cards.
• Validate card-generated authorization request cryptograms.
• Use issuer-generated authorization response cryptograms for response messages.
• Require card-generated authorization response cryptogram validation to verify legitimate response messages.

Isolate payment system infrastructure.

• Require multi-factor authentication for any user to access the switch application server.
• Confirm perimeter security controls prevent internet hosts from accessing the private network infrastructure servicing your payment switch application server.
• Confirm perimeter security controls prevent all hosts outside of authorized endpoints from accessing your system, especially if your payment switch application server is internet accessible.

Logically segregate your operating environment.

• Use firewalls to divide your operating environment into enclaves.
• Use access control lists to permit/deny specific traffic from flowing between those enclaves.
• Give special considerations to segregating enclaves holding sensitive information (e.g., card management systems) from enclaves requiring internet connectivity (e.g., email).

Encrypt data in transit.

• Secure all links to payment system engines with a certificate-based mechanism, such as Mutual Transport Layer Security, for all external and internal traffic external.
• Limit the number of certificates that can be used on the production server and restrict access to those certificates.

Monitor for anomalous behavior as part of layered security.

• Configure the switch application server to log transactions and routinely audit transaction and system logs.
• Develop a baseline of expected software, users, and logons and monitor switch application servers for unusual software installations, updates, account changes, or other activities outside of expected behavior.
• Develop a baseline of expected transaction participants, amounts, frequency, and timing. Monitor and flag anomalous transactions for suspected fraudulent activity.

Recommendations for Organizations with ATM or Point of Sale Devices

Validate issuer responses to financial request messages.

• Implement chip and PIN requirements for debit cards.
• Require and verify message authentication codes on issuer financial request response messages.
• Perform authorization response cryptogram validation for chip and PIN transactions.

Recommendations for All Organizations

Users and administrators should use the following best practices to strengthen the security posture of their organization’s systems:

• Maintain up-to-date antivirus signatures and engines.
• Keep operating system patches up to date.
• Disable file and printer sharing services. If these services are required, use strong passwords or Active Directory authentication.
• Restrict users’ ability (permissions) to install and run unwanted software applications. Do not add users to the local administrators’ group unless required.
• Enforce a strong password policy and require regular password changes.
• Exercise caution when opening email attachments even if the attachment is expected and the sender appears to be known.
• Enable a personal firewall on agency workstations and configure it to deny unsolicited connection requests.
• Disable unnecessary services on agency workstations and servers.
• Scan for and remove suspicious email attachments; ensure the scanned attachment is its “true file type” (i.e., the extension matches the file header).
• Monitor users' web browsing habits; restrict access to sites with unfavorable content.
• Exercise caution when using removable media (e.g., USB thumb drives, external drives, CDs).
• Scan all software downloaded from the internet before executing.
• Maintain situational awareness of the latest threats.
• Implement appropriate access control lists.

Additional information on malware incident prevention and handling can be found in National Institute of Standards and Technology Special Publication 800-83, Guide to Malware Incident Prevention and Handling for Desktops and Laptops.

 

Contact Information

Recipients of this report are encouraged to contribute any additional information that they may have related to this threat.

For any questions related to this report or to report an intrusion and request resources for incident response or technical assistance, please contact:

• CISA (888-282-0870 or Central@cisa.dhs.gov),
• The FBI through the FBI Cyber Division (855-292-3937 or CyWatch@fbi.gov) or a local field office, or
• Treasury Office of Cybersecurity and Critical Infrastructure Protection (Treasury OCCIP) (202-622-3000 or OCCIP-Coord@treasury.gov).

DISCLAIMER   This information is provided "as is" for informational purposes only. The United States Government does not provide any warranties of any kind regarding this information. In no event shall the United States Government or its contractors or subcontractors be liable for any damages, including but not limited to, direct, indirect, special or consequential damages, arising out of, resulting from, or in any way connected with this information, whether or not based upon warranty, contract, tort, or otherwise, whether or not arising out of negligence, and whether or not injury was sustained from, or arose out of the results of, or reliance upon the information.

 

The United States Government does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply their endorsement, recommendation, or favoring by the United States Government.

 

Revisions

• August 26, 2020: Initial Version

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: August 14, 2020
Summary

This Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques.

The Cybersecurity and Infrastructure Security Agency (CISA) has observed cyber actors using emails containing a Microsoft Word document with a malicious Visual Basic Application (VBA) macro code to deploy KONNI malware. KONNI is a remote administration tool (RAT) used by malicious cyber actors to steal files, capture keystrokes, take screenshots, and execute arbitrary code on infected hosts.

Technical Details

KONNI malware is often delivered via phishing emails as a Microsoft Word document with a malicious VBA macro code (Phishing: Spearphising Attachment [T1566.001]). The malicious code can change the font color from light grey to black (to fool the user to enable content), check if the Windows operating system is a 32-bit or 64-bit version, and construct and execute the command line to download additional files (Command and Scripting Interpreter: Windows Command Shell [T1059.003]).

Once the VBA macro constructs the command line, it uses the certificate database tool CertUtil to download remote files from a given Uniform Resource Locator. It also incorporates a built-in function to decode base64-encoded files. The Command Prompt silently copies certutil.exe into a temp directory and renames it to evade detection.

The cyber actor then downloads a text file from a remote resource containing a base64-encoded string that is decoded by CertUtil and saved as a batch (.BAT) file. Finally, the cyber actor deletes the text file from the temp directory and executes the .BAT file.

MITRE ATT&CK Techniques

According to MITRE, KONNI uses the ATT&CK techniques listed in table 1.

Table 1: KONNI ATT&CK techniques

Technique Use

System Network Configuration Discovery [T1016]

KONNI can collect the Internet Protocol address from the victim’s machine.

System Owner/User Discovery [T1033]

KONNI can collect the username from the victim’s machine.

Masquerading: Match Legitimate Name or Location [T1036.005]

KONNI creates a shortcut called Anti virus service.lnk in an apparent attempt to masquerade as a legitimate file.

Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol [T1048.003]

KONNI has used File Transfer Protocol to exfiltrate reconnaissance data out.

Input Capture: Keylogging  [T1056.001]

KONNI has the capability to perform keylogging.

Process Discovery [T1057]

KONNI has used tasklist.exe to get a snapshot of the current processes’ state of the target machine.

Command and Scripting Interpreter: PowerShell [T1059.001]

KONNI used PowerShell to download and execute a specific 64-bit version of the malware.

Command and Scripting Interpreter: Windows Command Shell  [T1059.003]

KONNI has used cmd.exe to execute arbitrary commands on the infected host across different stages of the infection change.

Indicator Removal on Host: File Deletion [T1070.004]

KONNI can delete files.

Application Layer Protocol: Web Protocols [T1071.001]

KONNI has used Hypertext Transfer Protocol for command and control.

System Information Discovery [T1082]

KONNI can gather the operating system version, architecture information, connected drives, hostname, and computer name from the victim’s machine and has used systeminfo.exe to get a snapshot of the current system state of the target machine.

File and Directory Discovery [T1083]

A version of KONNI searches for filenames created with a previous version of the malware, suggesting different versions targeted the same victims and the versions may work together.

Ingress Tool Transfer [T1105]

KONNI can download files and execute them on the victim’s machine.

Modify Registry [T1112]

KONNI has modified registry keys of ComSysApp service and Svchost on the machine to gain persistence.

Screen Capture [T1113]

KONNI can take screenshots of the victim’s machine.

Clipboard Data [T1115]

KONNI had a feature to steal data from the clipboard.

Data Encoding: Standard Encoding [T1132.001]

KONNI has used a custom base64 key to encode stolen data before exfiltration.

Access Token Manipulation: Create Process with Token [T1134.002]

KONNI has duplicated the token of a high integrity process to spawn an instance of cmd.exe under an impersonated user.

Deobfuscate/Decode Files or Information [T1140]

KONNI has used CertUtil to download and decode base64 encoded strings.

Signed Binary Proxy Execution: Rundll32 [T1218.011]

KONNI has used Rundll32 to execute its loader for privilege escalation purposes.

Event Triggered Execution: Component Object Model Hijacking [T1546.015]

KONNI has modified ComSysApp service to load the malicious DLL payload.

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder [T1547.001]

A version of KONNI drops a Windows shortcut into the Startup folder to establish persistence.

Boot or Logon Autostart Execution: Shortcut Modification [T1547.009]

A version of KONNI drops a Windows shortcut on the victim’s machine to establish persistence.

Abuse Elevation Control Mechanism: Bypass User Access Control [T1548.002]

KONNI bypassed User Account Control with the "AlwaysNotify" settings.

Credentials from Password Stores: Credentials from Web Browsers [T1555.003]

KONNI can steal profiles (containing credential information) from Firefox, Chrome, and Opera.

Detection Signatures

CISA developed the following Snort signatures for use in detecting KONNI malware exploits.

alert tcp any any -> any $HTTP_PORTS (msg:"HTTP URI contains '/weget/*.php' (KONNI)"; sid:1; rev:1; flow:established,to_server; content:"/weget/"; http_uri; depth:7; offset:0; fast_pattern; content:".php"; http_uri; distance:0; within:12; content:!"Referrer|3a 20|"; http_header; classtype:http-uri; priority:2; metadata:service http;)

alert tcp any any -> any $HTTP_PORTS (msg:"KONNI:HTTP header contains 'User-Agent|3a 20|HTTP|0d 0a|'"; sid:1; rev:1; flow:established,to_server; content:"User-Agent|3a 20|HTTP|0d 0a|"; http_header; fast_pattern:only; content:"POST"; nocase; http_method; classtype:http-header; priority:2; metadata:service http;)

alert tcp any any -> any $HTTP_PORTS (msg:"KONNI:HTTP URI contains '/weget/(upload|uploadtm|download)'"; sid:1; rev:1; flow:established,to_server; content:"/weget/"; http_uri; fast_pattern:only; pcre:"/^\/weget\x2f(?:upload|uploadtm|download)\.php/iU"; content:"POST"; http_method; classtype:http-uri; priority:2; reference:url,blog.talosintelligence.com/2017/07/konni-references-north-korean-missile-capabilities.html; metadata:service http;)

Mitigations

CISA recommends that users and administrators consider using the following best practices to strengthen the security posture of their organization's systems. Any configuration changes should be reviewed by system owners and administrators prior to implementation to avoid unwanted impacts.

• Maintain up-to-date antivirus signatures and engines. See Protecting Against Malicious Code.
• Keep operating system patches up to date. See Understanding Patches and Software Updates.
• Disable file and printer sharing services. If these services are required, use strong passwords or Active Directory authentication.
• Restrict users' ability (permissions) to install and run unwanted software applications. Do not add users to the local administrators’ group unless required.
• Enforce a strong password policy. See Choosing and Protecting Passwords.
• Exercise caution when opening email attachments, even if the attachment is expected and the sender appears to be known. See Using Caution with Email Attachments.
• Enable a personal firewall on agency workstations, configured to deny unsolicited connection requests.
• Disable unnecessary services on agency workstations and servers.
• Scan for and remove suspicious email attachments; ensure the scanned attachment is its "true file type" (i.e., the extension matches the file header).
• Monitor users' web browsing habits; restrict access to sites with unfavorable content.
• Exercise caution when using removable media (e.g., USB thumb drives, external drives, CDs).
•  Scan all software downloaded from the internet prior to executing.
• Maintain situational awareness of the latest threats and implement appropriate access control lists.
• Visit the MITRE ATT&CK Techniques pages (linked in table 1 above) for additional mitigation and detection strategies.

For additional information on malware incident prevention and handling, see the National Institute of Standards and Technology Special Publication 800-83, "Guide to Malware Incident Prevention and Handling for Desktops and Laptops."

Resources

• d-hunter – A Look Into KONNI 2019 Campaign
• MITRE ATT&CK – KONNI
• MITRE ATT&CK for Enterprise

Revisions

• August 14, 2020: Initial Version

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: August 12, 2020
Summary

The Cybersecurity and Infrastructure Security Agency (CISA) is currently tracking an unknown malicious cyber actor who is spoofing the Small Business Administration (SBA) COVID-19 loan relief webpage via phishing emails. These emails include a malicious link to the spoofed SBA website that the cyber actor is using for malicious re-directs and credential stealing.

For a downloadable copy of IOCs, see STIX file.

Technical Details

CISA analysts observed an unknown malicious cyber actor sending a phishing email to various Federal Civilian Executive Branch and state, local, tribal, and territorial government recipients. The phishing email contains:

• A subject line, SBA Application – Review and Proceed
• A sender, marked as disastercustomerservice@sba[.]gov
• Text in the email body urging the recipient to click on a hyperlink to address:
  hxxps://leanproconsulting[.]com.br/gov/covid19relief/sba.gov
• The domain resolves to IP address: 162.214.104[.]246

Figure 1 is a screenshot of the webpage arrived at by clicking on the hyperlink.

​

Figure 1: Webpage arrived at via malicious hyperlink.

Indicators of Compromise

CISA observed the following additional indicators of compromise.
162[.]214[.]104[.]246
152[.]199[.]21[.]175
13[.]86[.]113[.]170
13[.]69[.]66[.]140
52[.]129[.]92[.]13
185[.]60[.]217[.]28   
23.63.253[.]11
192.64.119[.]222
142[.]11[.]196[.]128
admin@columbiadb[.]com
disastercustomerservice@sba-gov-us[.]xyz
leanproconsulting[.]com[.]br
ci-mpsnare[.]iovation[.]com
www[.]leanproconsulting[.]com[.]br
dc[.]services[.]visualstudio[.]com
scontent-ber1-1[.]xx[.]fbcdn[.]net  
isrg.trustid.ocsp[.]identrust[.]com
www.sba-gov-us[.]xyz
hxxp://www[.]leanproconsulting[.]com[.]br/wp-content/uploads/2018/08/Lean-Pro-Consulting_2018v3[.]png
hxxp://www[.]leanproconsulting[.]com[.]br/wp-content/uploads/2018/08/Consultorias_lean[.]gif
hxxp://www[.]leanproconsulting[.]com[.]br/wp-content/uploads/2018/08/Treinamentos_Lean[.]gif
hxxp://www[.]leanproconsulting[.]com[.]br/wp-content/uploads/2018/08/Auditorias_lean[.]gif
1d38c3dcc5f78b571df164d28689029380dec30c
e9ea1de80c556afcb17f3597018901965b0a0d4d5bed9bf8c44ab5831276d624
3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670
8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba
20082887a470f83d94ff7ff32311f574

For a downloadable copy of IOCs, see STIX file.

Mitigations

CISA recommends using the following best practices to strengthen the security posture of an organization's systems. System owners and administrators should review any configuration change prior to implementation to avoid unwanted impacts.

• Include warning banners for all emails external to the organization.
• Maintain up-to-date antivirus signatures and engines. See Protecting Against Malicious Code.
• Ensure systems have the latest security updates. See Understanding Patches and Software Updates.
• Disable file and printer sharing services. If these services are required, use strong passwords or Active Directory authentication.
• Restrict users' permissions to install and run unwanted software applications. Do not add users to the local administrators’ group unless required.
• Enforce a strong password policy. See Choosing and Protecting Passwords.
• Exercise caution when opening email attachments, even if the attachment is expected and the sender appears to be known. See Using Caution with Email Attachments.
• Enable a personal firewall on agency workstations that is configured to deny unsolicited connection requests.
• Disable unnecessary services on agency workstations and servers.
• Scan for and remove suspicious email attachments; ensure the scanned attachment is its "true file type" (i.e., the extension matches the file header).
• Monitor users' web browsing habits; restrict access to sites with unfavorable content.
• Exercise caution when using removable media (e.g., USB thumb drives, external drives, CDs).
• Scan all software downloaded from the internet prior to executing.
• Maintain situational awareness of the latest threats and implement appropriate Access Control Lists (ACLs). Sign up to receive CISA’s alerts on security topics and threats.
• Sign up for CISA’s free vulnerability scanning and testing services to help organizations secure internet-facing systems from weak configuration and known vulnerabilities. Email vulnerability_info@cisa.dhs.gov to sign up. See https://www.cisa.gov/cyber-resource-hub for more information about vulnerability scanning and other CISA cybersecurity assessment services.

Resources

• CISA Binding Operational Directive 18-01
• CISA Insights: Enhance Email and Web Security
• CISA Tip: Using Caution with Email Attachments
• CISA Alert (AA20-099A): COVID-19 Exploited by Malicious Cyber Actors
• CISA Tip: Avoiding Social Engineering and Phishing Attacks
• VirusTotal

Revisions

• August 12, 2020: Initial Version

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: July 27, 2020
Summary

This is a joint alert from the United States Cybersecurity and Infrastructure Security Agency (CISA) and the United Kingdom’s National Cyber Security Centre (NCSC).

CISA and NCSC are investigating a strain of malware known as QSnatch, which attackers used in late 2019 to target Network Attached Storage (NAS) devices manufactured by the firm QNAP.  

All QNAP NAS devices are potentially vulnerable to QSnatch malware if not updated with the latest security fixes. The malware, documented in open-source reports, has infected thousands of devices worldwide with a particularly high number of infections in North America and Europe. Further, once a device has been infected, attackers can prevent administrators from successfully running firmware updates.

This alert summarizes the findings of CISA and NCSC analysis and provides mitigation advice.

Technical DetailsCampaigns  

CISA and NCSC have identified two campaigns of activity for QSnatch malware. The first campaign likely began in early 2014 and continued until mid-2017, while the second started in late 2018 and was still active in late 2019. The two campaigns are distinguished by the initial payload used as well as some differences in capabilities. This alert focuses on the second campaign as it is the most recent threat.  

It is important to note that infrastructure used by the malicious cyber actors in both campaigns is not currently active, but the threat remains to unpatched devices.  

Although the identities and objectives of the malicious cyber actors using QSnatch are currently unknown, the malware is relatively sophisticated, and the cyber actors demonstrate an awareness of operational security.

Global distribution of infections  

Analysis shows a significant number of infected devices. In mid-June 2020, there were approximately 62,000 infected devices worldwide; of these, approximately 7,600 were in the United States and 3,900 were in the United Kingdom. Figure 1 below shows the location of these devices in broad geographic terms.

Figure 1: Locations of QNAP NAS devices infected by QSnatch

Delivery and exploitation

The infection vector has not been identified, but QSnatch appears to be injected into the device firmware during the infection stage, with the malicious code subsequently run within the device, compromising it. The attacker then uses a domain generation algorithm (DGA)—to establish a command and control (C2) channel that periodically generates multiple domain names for use in C2 communications—using the following HTTP GET request:

HTTP GET https://[generated-address]/qnap_firmware.xml?=t[timestamp][1]

Malware functionalities  

Analysis shows that QSnatch malware contains multiple functionalities, such as:  

• CGI password logger  
  • This installs a fake version of the device admin login page, logging successful authentications and passing them to the legitimate login page.
• Credential scraper
• SSH backdoor  
  • This allows the cyber actor to execute arbitrary code on a device.
• Exfiltration
  • When run, QSnatch steals a predetermined list of files, which includes system configurations and log files. These are encrypted with the actor’s public key and sent to their infrastructure over HTTPS.
• Webshell functionality for remote access

Persistence

The malware appears to gain persistence by preventing updates from installing on the infected QNAP device. The attacker modifies the system host’s file, redirecting core domain names used by the NAS to local out-of-date versions so updates can never be installed.  

Samples

The following tables provide hashes of related QSnatch samples found in open-source malware repositories. File types fall into two buckets: (1) shell scripts (see table 1) and (2) shell script compiler (SHC)-compiled executable and linking format (ELF) shell scripts (see table 2). One notable point is that some samples intentionally patch the infected QNAP for Samba remote code execution vulnerability CVE-2017-7494.  

Table 1: QSnatch samples – shell scripts

SH Samples (SHA256) 09ab3031796bea1b8b79fcfd2b86dac8f38b1f95f0fce6bd2590361f6dcd6764 3c38e7bb004b000bd90ad94446437096f46140292a138bfc9f7e44dc136bac8d 8fd16e639f99cdaa7a2b730fc9af34a203c41fb353eaa250a536a09caf78253b 473c5df2617cee5a1f73880c2d66ad9668eeb2e6c0c86a2e9e33757976391d1a 55b5671876f463f2f75db423b188a1d478a466c5e68e6f9d4f340396f6558b9f 9526ccdeb9bf7cfd9b34d290bdb49ab6a6acefc17bff0e85d9ebb46cca8b9dc2 4b514278a3ad03f5efb9488f41585458c7d42d0028e48f6e45c944047f3a15e9 fa3c2f8e3309ee67e7684abc6602eea0d1d18d5d799a266209ce594947269346 18a4f2e7847a2c4e3c9a949cc610044bde319184ef1f4d23a8053e5087ab641b 9791c5f567838f1705bd46e880e38e21e9f3400c353c2bf55a9fa9f130f3f077 a569332b52d484f40b910f2f0763b13c085c7d93dcdc7fea0aeb3a3e3366ba5d a9364f3faffa71acb51b7035738cbd5e7438721b9d2be120e46b5fd3b23c6c18 62426146b8fcaeaf6abb24d42543c6374b5f51e06c32206ccb9042350b832ea8 5cb5dce0a1e03fc4d3ffc831e4a356bce80e928423b374fc80ee997e7c62d3f8 5130282cdb4e371b5b9257e6c992fb7c11243b2511a6d4185eafc0faa0e0a3a6 15892206207fdef1a60af17684ea18bcaa5434a1c7bdca55f460bb69abec0bdc 3cb052a7da6cda9609c32b5bafa11b76c2bb0f74b61277fecf464d3c0baeac0e 13f3ea4783a6c8d5ec0b0d342dcdd0de668694b9c1b533ce640ae4571fdbf63c

 

Table 2: QSnatch samples – SHC-compiled ELF shell scripts

SH Samples (SHA256) 18a4f2e7847a2c4e3c9a949cc610044bde319184ef1f4d23a8053e5087ab641b 3615f0019e9a64a78ccb57faa99380db0b36146ec62df768361bca2d9a5c27f2 845759bb54b992a6abcbca4af9662e94794b8d7c87063387b05034ce779f7d52 6e0f793025537edf285c5749b3fcd83a689db0f1c697abe70561399938380f89 Mitigations

As stated above, once a device has been infected, attackers have been known to make it impossible for administrators to successfully run the needed firmware updates. This makes it extremely important for organizations to ensure their devices have not been previously compromised. Organizations that are still running a vulnerable version must run a full factory reset on the device prior to completing the firmware upgrade to ensure the device is not left vulnerable.

The usual checks to ensure that the latest updates are installed still apply. To prevent reinfection, this recommendation also applies to devices previously infected with QSnatch but from which the malware has been removed.

To prevent QSnatch malware infections, CISA and NCSC strongly recommend that organizations take the recommended measures in QNAP’s November 2019 advisory.[2]

CISA and NCSC also recommend organizations consider the following mitigations:  

• Verify that you purchased QNAP devices from reputable sources.  
  • If sources are in question, run a full factory reset on the device prior to completing the firmware upgrade. For additional supply chain recommendations, see CISA’s tip on Securing Network Infrastructure Devices.
• Block external connections when the device is intended to be used strictly for internal storage.

References

• [1] QSnatch - Malware designed for QNAP NAS devices
• [2] QNAP: Security Advisory for Malware QSnatch

Revisions

• July 27, 2020: Initial Version

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: July 24, 2020
Summary

The Cybersecurity and Infrastructure Security Agency (CISA) is issuing this alert in response to recently disclosed exploits that target F5 BIG-IP devices that are vulnerable to CVE-2020-5902. F5 Networks, Inc. (F5) released a patch for CVE-2020-5902 on June 30, 2020.[1] Unpatched F5 BIG-IP devices are an attractive target for malicious actors. Affected organizations that have not applied the patch to fix this critical remote code execution (RCE) vulnerability risk an attacker exploiting CVE-2020-5902 to take control of their system. Note: F5’s security advisory for CVE-2020-5902 states that there is a high probability that any remaining unpatched devices are likely already compromised.

CISA expects to see continued attacks exploiting unpatched F5 BIG-IP devices and strongly urges users and administrators to upgrade their software to the fixed versions. CISA also advises that administrators deploy the signature included in this Alert to help them determine whether their systems have been compromised.

This Alert also provides additional detection measures and mitigations for victim organizations to help recover from attacks resulting from CVE-2020-5902. CISA encourages administrators to remain aware of the ramifications of exploitation and to use the recommendations in this alert to help secure their organization’s systems against attack.

Background

CISA has conducted incident response engagements at U.S. Government and commercial entities where malicious cyber threat actors have exploited CVE-2020-5902—an RCE vulnerability in the BIG-IP Traffic Management User Interface (TMUI)—to take control of victim systems. On June 30, F5 disclosed CVE-2020-5902, stating that it allows attackers to, “execute arbitrary system commands, create or delete files, disable services, and/or execute arbitrary Java code.”

On July 4, open-source reporting indicated a proof-of-concept code was available and threat actors were exploiting the vulnerability by attempting to steal credentials. On July 5, security researchers posted exploits that would allow threat actors to exfiltrate data or execute commands on vulnerable devices. The risk posed by the vulnerability is critical.

Technical Details

CISA has observed scanning and reconnaissance, as well as confirmed compromises, within a few days of F5’s patch release for this vulnerability. As early as July 6, 2020, CISA has seen broad scanning activity for the presence of this vulnerability across federal departments and agencies—this activity is currently occurring as of the publication of this Alert.

CISA has been working with several entities across multiple sectors to investigate potential compromises relating to this vulnerability. CISA has confirmed two compromises and is continuing to investigate.  CISA will update this Alert with any additional actionable information.

Detection Methods

CISA recommends administrators see the F5 Security Advisory K52145254 for indicators of compromise and F5’s CVE-2020-5902 IoC Detection Tool.[2] CISA also recommends organizations complete the following actions in conducting their hunt for this exploit:

• Quarantine or take offline potentially affected systems
• Collect and review artifacts such as running processes/services, unusual authentications, and recent network connections
• Deploy the following CISA-created Snort signature to detect malicious activity:
  
  alert tcp any any -> any $HTTP_PORTS (msg:"BIG-IP:HTTP URI GET contains '/tmui/login.jsp/..|3b|/tmui/':CVE-2020-5902"; sid:1; rev:1; flow:established,to_server; content:"/tmui/login.jsp/..|3b|/tmui/"; http_uri; fast_pattern:only; content:"GET"; nocase; http_method; priority:2; reference:url,github.com/yassineaboukir/CVE-2020-5902; reference:cve,2020-5902; metadata:service http;)

Mitigations

CISA strongly urges organizations that have not yet done so to upgrade their BIG-IP software to the corresponding patches for CVE-2020-5902. If organizations detect evidence of CVE-2020-5902 exploitation after patching and applying the detection measures in this alert, CISA recommends taking immediate action to reconstitute affected systems.

Should an organization’s IT security personnel discover system compromise, CISA recommends they:

• Reimage compromised hosts
• Provision new account credentials
• Limit access to the management interface to the fullest extent possible
• Implement network segmentation
  • Note: network segmentation is a very effective security mechanism to help prevent an intruder from propagating exploits or laterally moving within an internal network. Segregation separates network segments based on role and functionality. A securely segregated network can limit the spread of malicious occurrences, reducing the impact from intruders that gain a foothold somewhere inside the network.

Contact Information

Recipients of this report are encouraged to contribute any additional information that they may have related to this threat. For any questions related to this report, please contact CISA at

• Phone: (888) 282-0870
• Email: CISAServiceDesk@cisa.dhs.gov

 

References

• [1] F5 Security Advisory K52145254
• [2] F5 Security Advisory K52145254
• CISA Factsheet: Guidance for F5 BIG-IP TMUI Vulnerability (CVE-2020-5902)

Revisions

• July 24, 2020: Initial Version

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: July 23, 2020
Summary

Note: This Activity Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise and ATT&CK for Industrial Control Systems frameworks for all referenced threat actor techniques and mitigations.

Over recent months, cyber actors have demonstrated their continued willingness to conduct malicious cyber activity against critical infrastructure (CI) by exploiting internet-accessible operational technology (OT) assets.[1] Due to the increase in adversary capabilities and activity, the criticality to U.S. national security and way of life, and the vulnerability of OT systems, civilian infrastructure makes attractive targets for foreign powers attempting to do harm to U.S. interests or retaliate for perceived U.S. aggression. OT assets are critical to the Department of Defense (DoD) mission and underpin essential National Security Systems (NSS) and services, as well as the Defense Industrial Base (DIB) and other critical infrastructure. At this time of heightened tensions, it is critical that asset owners and operators of critical infrastructure take the following immediate steps to ensure resilience and safety of U.S. systems should a time of crisis emerge in the near term. The National Security Agency (NSA) along with the Cybersecurity and Infrastructure Security Agency (CISA) recommend that all DoD, NSS, DIB, and U.S. critical infrastructure facilities take immediate actions to secure their OT assets.

Internet-accessible OT assets are becoming more prevalent across the 16 U.S. CI sectors as companies increase remote operations and monitoring, accommodate a decentralized workforce, and expand outsourcing of key skill areas such as instrumentation and control, OT asset management/maintenance, and in some cases, process operations and maintenance. Legacy OT assets that were not designed to defend against malicious cyber activities, combined with readily available information that identifies OT assets connected via the internet (e.g., Shodan,[2] Kamerka [3]), are creating a “perfect storm” of 1) easy access to unsecured assets, 2) use of common, open-source information about devices, and 3) an extensive list of exploits deployable via common exploit frameworks [4] (e.g., Metasploit,[5] Core Impact,[6] and Immunity Canvas [7]). Observed cyber threat activities can be mapped to the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) for Industrial Controls Systems (ICS) framework.[8] It is important to note that while the behavior may not be technically advanced, it is still a serious threat because the potential impact to critical assets is so high.

Click here for a PDF version of this report.

Technical DetailsRecently Observed Tactics, Techniques, and Procedures

• Spearphishing [T1192] to obtain initial access to the organization’s information technology (IT) network before pivoting to the OT network.
• Deployment of commodity ransomware to Encrypt Data for Impact [T1486] on both networks.
• Connecting to Internet Accessible PLCs [T883] requiring no authentication for initial access.
• Utilizing Commonly Used Ports [T885] and Standard Application Layer Protocols [T869], to communicate with controllers and download modified control logic.
• Use of vendor engineering software and Program Downloads [T843].
• Modifying Control Logic [T833] and Parameters [T836] on PLCs.

Impacts

• Impacting a Loss of Availability [T826] on the OT network.
• Partial Loss of View [T829] for human operators.
• Resulting in Loss of Productivity and Revenue [T828].
• Adversary Manipulation of Control [T831] and disruption to physical processes.
   

MitigationsHave a Resilience Plan for OT

Since the Ukraine cyberattack of 2015 organizations must assume in their planning of not only a malfunctioning or inoperative control system, but a control system that is actively acting contrary to the safe and reliable operation of the process. Organizations need an OT resilience plan that allows them to:

• Immediately disconnect systems from the Internet that do not need internet connectivity for safe and reliable operations. Ensure that compensating controls are in place where connectivity cannot be removed.
• Plan for continued manual process operations should the ICS become unavailable or need to be deactivated due to hostile takeover.
• Remove additional functionality that could induce risk and attack surface area.
• Identify system and operational dependencies.
• Restore OT devices and services in a timely manner. Assign roles and responsibilities for OT network and device restoration.
• Backup “gold copy” resources, such as firmware, software, ladder logic, service contracts, product licenses, product keys, and configuration information. Verify that all “gold copy” resources are stored off-network and store at least one copy in a locked tamperproof environment (e.g., locked safe).
• Test and validate data backups and processes in the event of data loss due to malicious cyber activity.

Exercise your Incident Response Plan

In a state of heightened tensions and additional risk and exposure, it is critical to have a well-exercised incident response plan that is developed before an incident.

• Conduct a tabletop exercise, including executive personnel, to test your existing incident response plan.
• Be sure to include your public affairs and legal teams in your exercise in addition to your IT, OT, and executive management.
• Discuss key decisions points in the response plan and identify who has the authority to make key decisions under what circumstances.
• Ensure your plan takes into account a scenario inclusive of the TTPs above and where the control system is actively operating counter to safe and reliable operations.
• Partner with third parties for support. Review service contracts and government services for emergency incident response and recovery support.

Harden Your Network

• Remote connectivity to OT networks and devices provides a known path that can be exploited by cyber actors. External exposure should be reduced as much as possible.
• Remove access from networks, such as non-U.S. IP addresses, if applicable, that do not have legitimate business reasons to communicate with the system.
• Use publicly available tools, such as Shodan, to discover internet-accessible OT devices. Take corrective actions to eliminate or mitigate internet-accessible connections immediately. Best practices include:
  • Fully patch all Internet-accessible systems.
  • Segment networks to protect PLCs and workstations from direct exposure to the internet. Implement secure network architectures utilizing demilitarized zones (DMZs), firewalls, jump servers, and/or one-way communication diodes.
  • Ensure all communications to remote devices use a virtual private network (VPN) with strong encryption further secured with multifactor authentication.
  • Check and validate the legitimate business need for such access.
  • Filter network traffic to only allow IP addresses that are known to need access, and use geo-blocking where appropriate.
  • Connect remote PLCs and workstations to network intrusion detection systems where feasible.
  • Capture and review access logs from these systems.
  • Encrypt network traffic preferably using NIAP-validated VPN products and/or CNSSP- or NIST-approved algorithms when supported by OT system components to prevent sniffing and man-in-the-middle tactics. Available at: https://niap-ccevs.org.
• Use the validated inventory to investigate which OT devices are internet-accessible.
• Use the validated inventory to identify OT devices that connect to business, telecommunications, or wireless networks.
• Secure all required and approved remote access and user accounts.
  • Prohibit the use of default passwords on all devices, including controllers and OT equipment.
  • Remove, disable, or rename any default system accounts wherever possible, especially those with elevated privileges or remote access.
  • Enforce a strong password security policy (e.g., length, complexity).
  • Require users to change passwords periodically, when possible.
  • Enforce or plan to implement two-factor authentication for all remote connections.
• Harden or disable unnecessary features and services (e.g., discovery services, remote management services, remote desktop services, simulation, training, etc.).

Create an Accurate “As-operated” OT Network Map Immediately

An accurate and detailed OT infrastructure map provides the foundation for sustainable cyber-risk reduction.

• Document and validate an accurate “as-operated” OT network map.
  • Use vendor-provided tools and procedures to identify OT assets.
  • Use publicly available tools, such as Wireshark,[9] NetworkMiner,[10] GRASSMARLIN,[11] and/or other passive network mapping tools.
  • Physically walk down to check and verify the OT infrastructure map.
• Create an asset inventory.
  • Include OT devices assigned an IP address.
  • Include software and firmware versions.
  • Include process logic and OT programs.
  • Include removable media.
  • Include standby and spare equipment.
• Identify all communication protocols used across the OT networks.
  • Use vendor-provided tools and procedures to identify OT communications.
  • Use publicly available tools, such as Wireshark,[9] NetworkMiner,[10] GRASSMARLIN,[11] and/or other passive network mapping tools.
• Investigate all unauthorized OT communications.
• Catalog all external connections to and from the OT networks.
  • Include all business, vendor, and other remote access connections.
  • Review service contracts to identify all remote connections used for third-party services.

Understand and Evaluate Cyber-risk on “As-operated” OT Assets

Informed risk awareness can be developed using a variety of readily available resources, many of which include specific guidance and mitigations.

• Use the validated asset inventory to investigate and determine specific risk(s) associated with existing OT devices and OT system software.
  • Vendor-specific cybersecurity and technical advisories.
  • CISA Advisories [12].
  • Department of Homeland Security – Cybersecurity and Infrastructure Security Agency Cyber Security Evaluation Tool [13].
  • MITRE Common Vulnerabilities and Exposures (CVE) for both Information Technology and OT devices and system software [14]. Available at https://cve.mitre.org.
  • National Institute of Standards and Technology – National Vulnerability Database [15]. Available at https://nvd.nist.gov.
• Implement mitigations for each relevant known vulnerability, whenever possible (e.g., apply software patches, enable recommended security controls, etc.).
• Audit and identify all OT network services (e.g., system discovery, alerts, reports, timings, synchronization, command, and control) that are being used.
  • Use vendor provided programming and/or diagnostic tools and procedures.

Implement a Continuous and Vigilant System Monitoring Program

A vigilant monitoring program enables system anomaly detection, including many malicious cyber tactics like “living off the land” techniques within OT systems.

• Log and review all authorized external access connections for misuse or unusual activity.
• Monitor for unauthorized controller change attempts.
  • Implement integrity checks of controller process logic against a known good baseline.
  • Where possible, ensure process controllers are prevented from remaining in remote program mode while in operation.
  • Lock or limit set points in control processes to reduce the consequences of unauthorized controller access.

Contact InformationCISA

CISA encourages recipients of this report to contribute any additional information that they may have related to this threat. For any questions related to this report, please contact CISA at

• 1-888-282-0870 (From outside the United States: +1-703-235-8832)
• CISAServiceDesk@cisa.dhs.gov

CISA encourages you to report any suspicious activity, including cybersecurity incidents, possible malicious code, software vulnerabilities, and phishing-related scams. Reporting forms can be found at http://www.us-cert.gov/.

CISA strives to make this report a valuable tool for our partners and welcomes feedback on how this publication could be improved. You can help by answering a few short questions about this report at the following URL: https://www.us-cert.gov/forms/feedback.

NSA Cybersecurity

Client Requirements / General Cybersecurity Inquiries: Cybersecurity Requirements Center, 410-854-4200, Cybersecurity_Requests@nsa.gov
Media inquiries / Press Desk: 443-634-0721, MediaRelations@nsa.gov

  Registered Trademarks

• Shodan is a registered trademark of Shodan Limited Liability Company.
• Metasploit is a registered trademark of Rapid7 Limited Liability Company.
• Core Impact is a registered trademark of Help/Systems, Limited Liability Company.
• Canvas is a registered trademark of Immunity Products, Limited Liability Company.
• MITRE is a registered trademark of The MITRE Corporation.
• ATT&CK is a registered trademark of The MITRE Corporation.
• Wireshark is a registered trademark of Wireshark Foundation, Inc.

Disclaimer of Endorsement

The information and opinions contained in this document are provided "as is" and without any warranties or guarantees. Reference herein to any specific commercial product, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.

References

• [1] Lyngaas, S. Israeli official confirms attempted cyberattack on water systems. Cyberscoop, 28 May, 2020.
• [2] Shodan
• [3] Kamerka
• [4] Fireeye (2020).Monitoring ICS Cyber Operation Tools and Software Exploit Modules to Anticipate Future Threats.
• [5] Metasploit
• [6] Core Impact
• [7] Immunity CANVAS
• [8] MITRE ATT&CK for Industrial Control Systems
• [9] Wireshark
• [10] NetworkMiner
• [11] GRASSMARLIN
• [12] CISA Advisories
• [13] CISA Cyber Security Evaluation Tool
• [14] MITRE Common Vulnerabilities and Exposures
• [15] National Institute of Standards and Technology National Vulnerability Database

Revisions

• July 23, 2020: Initial Version

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: July 16, 2020
Summary

This Activity Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK™) and Pre-ATT&CK frameworks. See the MITRE ATT&CK for Enterprise and Pre-ATT&CK frameworks for referenced threat actor techniques.

Attributing malicious cyber activity that uses network tunneling and spoofing techniques to a specific threat actor is difficult. Attribution requires analysis of multiple variables, including location. Because threat actors can use these techniques to obfuscate their location, it is not possible to identify the true physical location of malicious activity based solely on the geolocation of Internet Protocol (IP). This Alert discusses how threat actors use these obfuscation techniques to mislead incident responders.

Technical DetailsGeolocation

The geolocation of an IP address is often obtained with publicly available information (WHOIS registration) or proprietary information. The level of geographic precision varies widely across sources; some provide country and locality details, while others provide neighborhood-level detail. Additionally, the accuracy of this information varies by source.

However, even if the geolocation of an IP address is accurate, the threat actor may not be physically located near it; instead, they may be hiding their true location through the use of spoofing and network tunnels.

Spoofing

A threat actor can spoof packets with an arbitrary source IP address, which in turn geolocates to a specific country (see figure 1). The actor's physical location may be elsewhere. The actor then initiates their malicious activity. Network defenders see packets originating from a source IP address that did not generate the traffic. This technique is most common with connectionless activities, such as distributed Endpoint Denial of Service [T1499] and Network Denial of Service [T1498]— including DNS amplification—attacks.

Figure 1: IP spoofing

Encapsulating Network Tunnels

A network tunnel encapsulates network traffic between two points (see figure 2). Often network tunnels are used for legitimate purposes, such as secure remote administration or creating virtual private networks (VPNs). However, a malicious cyber actor can use this technique to mask their true source IP address and, therefore, their physical location. The threat actor accomplishes masking by using virtual private servers (VPSs), which can be purchased through commercial providers. The threat actor will initiate a remote network tunnel from their computer to the VPS and then use the VPS to initiate malicious activity. Network defenders see the IP address, as well as geolocation information of the VPS. Attempts to identify the cyber actor’s physical location by using the geolocation of the VPS will be inaccurate. Network tunneling is common with malicious Connection Proxy [T1090] activities.

Figure 2: Network tunnel encapsulation

The ease with which IP addresses can be spoofed and the possibility that activity could be tunneled through a network to intentionally mask the true source prevents any attempt to identify the physical location of the activity based solely on the geolocation of the IP address.

Mitigations

In addition to being knowledgeable about threat actor obfuscation techniques, CISA encourages incident responders to review the following best practices to strengthen the security posture of their systems. Any configuration changes should be reviewed by system owners and administrators prior to implementation to avoid unwanted impacts.

• Maintain up-to-date antivirus signatures and engines. See Protecting Against Malicious Code.
• Ensure systems have the latest security updates. See Understanding Patches and Software Updates.
• Disable file and printer sharing services. If these services are required, use strong passwords or Active Directory authentication.
• Restrict users' permissions to install and run unwanted software applications. Do not add users to the local administrators’ group unless required.
• Enforce a strong password policy. See Choosing and Protecting Passwords.
• Exercise caution when opening email attachments, even if the attachment is expected and the sender appears to be known. See Using Caution with Email Attachments.
• Enable a personal firewall on agency workstations that is configured to deny unsolicited connection requests.
• Disable unnecessary services on agency workstations and servers.
• Scan for and remove suspicious email attachments; ensure the scanned attachment is its "true file type" (i.e., the extension matches the file header).
• Monitor users' web browsing habits; restrict access to sites with unfavorable content.
• Exercise caution when using removable media (e.g., USB thumb drives, external drives, CDs).
• Scan all software downloaded from the internet prior to executing.
• Maintain situational awareness of the latest threats and implement appropriate Access Control Lists (ACLs).

Additional Information

Sign up to receive CISA’s alerts on security topics and threats.

Sign up for CISA’s free vulnerability scanning and testing services to help organizations secure internet-facing systems from weak configuration and known vulnerabilities. Email vulnerability_info@cisa.dhs.gov to sign up. See https://www.cisa.gov/cyber-resource-hub  for more information about vulnerability scanning and other CISA cybersecurity assessment services.

Acknowledgements

Palo Alto Networks and IBM contributed to this Alert.

References

• Cloudflare Blog: The real cause of large DDoS - IP Spoofing
• Cisco Configuration Guide: Implementing Tunnels

Revisions

• July 16, 2020: Initial Version

This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: July 13, 2020
Summary

On July 13, 2020 EST, SAP released a security update to address a critical vulnerability, CVE-2020-6287, affecting the SAP NetWeaver Application Server (AS) Java component LM Configuration Wizard. An unauthenticated attacker can exploit this vulnerability through the Hypertext Transfer Protocol (HTTP) to take control of trusted SAP applications.

Due to the criticality of this vulnerability, the attack surface this vulnerability represents, and the importance of SAP’s business applications, the Cybersecurity and Infrastructure Security Agency (CISA) strongly recommends organizations immediately apply patches. CISA recommends organizations prioritize patching internet-facing systems, and then internal systems.

Organizations that are unable to immediately patch should mitigate the vulnerability by disabling the LM Configuration Wizard service (see SAP Security Note #2939665). Should these options be unavailable or if the actions will take more than 24 hours to complete, CISA strongly recommends closely monitoring your SAP NetWeaver AS for anomalous activity.

CISA is unaware of any active exploitation of these vulnerabilities at the time of this report. However, because patches have been publicly released, the underlying vulnerabilities could be reverse-engineered to create exploits that target unpatched systems.
 

Technical DetailsAffected Systems

This vulnerability is present by default in SAP applications running on top of SAP NetWeaver AS Java 7.3 and any newer versions (up to SAP NetWeaver 7.5). Potentially vulnerable SAP business solutions include any SAP Java-based solutions such as (but not limited to):

• SAP Enterprise Resource Planning,
• SAP Product Lifecycle Management,
• SAP Customer Relationship Management,
• SAP Supply Chain Management,
• SAP Supplier Relationship Management,
• SAP NetWeaver Business Warehouse,
• SAP Business Intelligence,
• SAP NetWeaver Mobile Infrastructure,
• SAP Enterprise Portal,
• SAP Process Orchestration/Process Integration),
• SAP Solution Manager,
• SAP NetWeaver Development Infrastructure,
• SAP Central Process Scheduling,
• SAP NetWeaver Composition Environment, and
• SAP Landscape Manager.

Attack Surface

The vulnerability was identified in a component that is part of the SAP NetWeaver AS Java. This technology stack is part of the SAP Solution Manager, which is a support and system management suite.

The SAP NetWeaver AS for Java technology supports the SAP Portal component, which may therefore be affected by this vulnerability and is typically exposed to the internet. Passive analysis of internet-facing applications indicates that a number of such applications are connected to the internet and could be affected by this vulnerability.

Description

On July 13, 2020 EST, SAP released the patch for a critical vulnerability, CVE-2020-6287, affecting its NetWeaver AS for Java component. This vulnerability can lead to compromise of vulnerable SAP installations, including the modification or extraction of highly sensitive information, as well as the disruption of critical business processes. A remote, unauthenticated attacker can exploit this vulnerability thro