WellMail

TLS-сертификаты Digital Certificates T1596.003... Сертификаты - одна из самых сильных pivot-точек для картирования инфраструктуры хакеров.

За это время аналитик может обнаружить сервер через сканирование баз данных Scan Databases (T1596.005, Reconnaissance)

The group then deployed publicly known exploits against the vulnerable systems it found, including popular Citrix, Pulse Secure, and Fortinet devices, among others.

Specifically, APT29 uses a variety of tools and techniques, including spear phishing and custom malware known as “WellMess” and “WellMail”, according to the NCSC.

The APT29 actors then deployed custom malware, known as WellMess or WellMail, to execute commands, upload and download files, and other operational tasks on the victimized systems.

Repeated examples across many families: e.g., “APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.”; “Action RAT can use Base64 to decode actor-controlled C2 server communications.”; “Smoke Loader deobfuscates its code.”

The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.

The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.

"...accept and execute shell scripts from a remote operator."; "...receive scripts compressed (tar files)... decompress them before executing the embedded script."

Examples in the content include malware extracting or unpacking ZIP, RAR, CAB, tar.gz, and other archived content, such as 'Emotet has used a self-extracting RAR file to deliver modules to victims' and 'Rocke has extracted tar.gz files after downloading them from a C2 server.'

Known Tools: APT29 7zip - A tool that is used to compress files into an archive. Used by threat actors to compress data before exfiltration.

"...capable of ... sending and receiving files and messages."; "...receive scripts compressed (tar files). The malware will then decompress them before executing"

"...send the above data to its C2 server at the IP address, 119.81.184.11:25 over TCP port 25..."; "Note: TCP port 25 is commonly used for email (SMTP), however, the malware is only using the port for secure communications"

The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.

Multiple malware families and intrusion sets are described as encrypting C2 traffic using SSL/TLS/HTTPS (e.g., "used HTTPS for command and control", "encrypts C2 communications with TLS", "uses SSL for encrypting C2 communications", "TLS-encrypted WebSocket Protocol (WSS) for C2"). | "communicate with C2 over mutual TLS"; "client and server mutually check certificates"; "can use mutual TLS and RSA cryptography to exchange a session key".

Many entries state malware or actors can upload, transfer, send, or exfiltrate files from compromised hosts to command-and-control servers or attacker infrastructure.

MITRE ATT&CK Mappings: APT29 Exfiltration T1567: Exfiltration Over Web Service .001: Exfiltration to Code Repository .002: Exfiltration to Cloud Storage