HyperBro

One of the group’s immediate post-exploitation steps often includes deploying web shells ... to execute commands and upload additional payloads.

The first activity discovered was the exploitation of a Microsoft Exchange server using ProxyLogon vulnerabilities chain... On March, 4th of 2021, APT27 exploited ProxyLogon vulnerabilities chain affecting Microsoft Exchange server to gain initial access.

Sekoia established that “MìMì” Messenger’s MacOS version is trojanized since May 26, 2022 to download and execute a Mach-O binary dubbed “rshell”.

In order to execute remote command, threat actors also relied on valid credentials collected in previous stages used wmic tool to execute commands on remote hosts.

Execution T1059.001 Command and Scripting Interpreter: PowerShell ... cmd.exe /Q /c powershell Add-MpPreference -ExclusionPath C:\Windows\temp

Execution T1059.003 Command and Scripting Interpreter: Windows Command Shell ... Adversaries were wrapping their commands through calls to cmd.exe /Q /c command line.

The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.

The pattern of compromise is to use several different means to gain access to systems [5, 6], followed by the installation of HyperBro (and/or the HyperSSL variant).

Persistence T1569.002 Create or Modify System Process: Windows Service ... HyperBro also includes features for ... modifying Windows services.

The group is also known to deploy post-exploitation malware such as HYPERBRO, SysUpdate, PlugX and others through DLL sideloading, abusing trusted binaries to execute malicious code and evade detection.

Persistence T1112 ... At its first execution, the configuration is copied into the config.ini file and into the config_ registry key.

Persistence T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder ... HKCU\Software\Microsoft\Windows\CurrentVersion\Run\windefenders

The loader will then use the process hollowing technique to inject HyperBro backdoor (Stage 3).

Persistence T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder ... HKCU\Software\Microsoft\Windows\CurrentVersion\Run\windefenders

T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control (UAC bypass using CMSTPLUA COM interface)

In some cases the attackers modified a clean installer in about 90 minutes, inserting obfuscated JavaScript into electron-main.js.

Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'

Defense Evasion T1036.004 Masquerading: Masquerade Task or Service

Defense Evasion T1036.005 Masquerading: Match Legitimate Name or Location ... rename it to veeamGues.exe to hide it in plain sight.

The loader will then use the process hollowing technique to inject HyperBro backdoor (Stage 3).

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

The group is also known to deploy post-exploitation malware such as HYPERBRO, SysUpdate, PlugX and others through DLL sideloading, abusing trusted binaries to execute malicious code and evade detection.

Persistence T1112 ... At its first execution, the configuration is copied into the config.ini file and into the config_ registry key.

The group has also used backdoors with keylogging functionality, to passively capture user credentials over time.

T1570

The defendants ... conducted unauthorized intrusions into victim networks by exploiting software vulnerabilities, conducting internal reconnaissance, and deploying malware such as PlugX to establish persistent access. The indictment alleges that the group stole data from compromised networks and transferred it to servers under their control.

The group has also used backdoors with keylogging functionality, to passively capture user credentials over time.

After gaining initial access, the group proceeded to compromise five domains over nine months, before ultimately deploying HyperBro malware to exfiltrate many gigabytes of data over a 17-day period.

The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."

URLs time.ntp-server.asia C&C 45.142.214.193 C&C linux.updatelive-oline.com C&C center.veryssl.org C&C https://139.180.216.65:443/api/v2/ajax C&C

The article identifies “an actual C2 that belongs to APT27” by searching for URLs containing the “/api/v2/ajax” URI sequence. It also describes HyperBro C2 servers responding on TCP port 443 with HTTP 500 errors.

Starting closest to the actors, we see connections from Chinanet Backbone or Alibaba establishing tunnels to the management VPN nodes at DigitalOcean. From these, they create tunnels to operational nodes, which they use to SSH into the malware controllers.

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

with the attackers using the HyperBro remote access trojans (RAT) to backdoor their networks. HyperBro helps the threat actors maintain persistence on the victims' networks by acting as an in-memory backdoor with remote administration capabilities.

These communication methods support RAT-like functions and VPN-like capabilities over encrypted channels.

These malware controllers receive victim communications, but also establish tunnels to what we believe to be data exfiltration nodes... The data exfiltration tunnel path is used for carrying traffic from malware controllers back towards the actors.

The agency said the threat group's goal is to steal sensitive information... in addition to stealing business secrets and intellectual property