HyperBro

MITRE ATT&CK Techniques list includes "T1583.003 Acquire Infrastructure: Virtual Private Server"

"The main command and control (C&C) server ... belongs to a Ukrainian ISP, specifically to a MikroTik router ... Researchers believe the Mikrotik router was explicitly hacked for the campaign"

One of the group’s immediate post-exploitation steps often includes deploying web shells ... to execute commands and upload additional payloads.

“...redirected users to malicious sites hosting exploitation tools such as ScanBox and BEeF...” | “...used access to the data center to add JavaScript code to government sites, which redirected users to malicious sites...”

The first activity discovered was the exploitation of a Microsoft Exchange server using ProxyLogon vulnerabilities chain... On March, 4th of 2021, APT27 exploited ProxyLogon vulnerabilities chain affecting Microsoft Exchange server to gain initial access.

Sekoia established that “MìMì” Messenger’s MacOS version is trojanized since May 26, 2022 to download and execute a Mach-O binary dubbed “rshell”.

One of the Able update servers was likely compromised in order to deploy HyperBro and Tmanger.

"The initial attack vector ... is unclear, but researchers believe LuckyMouse possibly had conducted watering hole or phishing attacks to compromise accounts belonging to employees"

In order to execute remote command, threat actors also relied on valid credentials collected in previous stages used wmic tool to execute commands on remote hosts.

Execution T1059.001 Command and Scripting Interpreter: PowerShell ... cmd.exe /Q /c powershell Add-MpPreference -ExclusionPath C:\Windows\temp

Execution T1059.003 Command and Scripting Interpreter: Windows Command Shell ... Adversaries were wrapping their commands through calls to cmd.exe /Q /c command line.

The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.

The pattern of compromise is to use several different means to gain access to systems [5, 6], followed by the installation of HyperBro (and/or the HyperSSL variant).

Able Desktop trojanized installer is executed by the user.

Persistence T1569.002 Create or Modify System Process: Windows Service ... HyperBro also includes features for ... modifying Windows services.

The group is also known to deploy post-exploitation malware such as HYPERBRO, SysUpdate, PlugX and others through DLL sideloading, abusing trusted binaries to execute malicious code and evade detection.

Persistence T1112 ... At its first execution, the configuration is copied into the config.ini file and into the config_ registry key.

Persistence T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder ... HKCU\Software\Microsoft\Windows\CurrentVersion\Run\windefenders

The loader will then use the process hollowing technique to inject HyperBro backdoor (Stage 3).

MITRE ATT&CK Techniques list includes "T1055.003 ... Thread Execution Hijacking"

GuLoader has the ability to inject shellcode into donor processes that is started in a suspended state. Cardinal RAT injects into a newly spawned process created from a native Windows executable. Pandora can start and inject code into a new svchost process. ShadowPad has injected an install module into a newly created process.

Persistence T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder ... HKCU\Software\Microsoft\Windows\CurrentVersion\Run\windefenders

T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control (UAC bypass using CMSTPLUA COM interface)

In some cases the attackers modified a clean installer in about 90 minutes, inserting obfuscated JavaScript into electron-main.js.

"Sandworm Team used UPX to pack a copy of Mimikatz"; "APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium"; "Lazarus Group packed malicious .db files with Themida to evade detection."

Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'

The launcher starts by instantiating the CLoadInfo object... Directory to copy all files %PROGRAMDATA%\Test\ ... Name of the legitimate executable dlpumgr32.exe ... Lastly, the launcher starts a suspended process with the command line “C:\Windows\system32\svchost.exe -k LocalServices,”and injects the appropriate shellcode into it.

Defense Evasion T1036.004 Masquerading: Masquerade Task or Service

Defense Evasion T1036.005 Masquerading: Match Legitimate Name or Location ... rename it to veeamGues.exe to hide it in plain sight.

The loader will then use the process hollowing technique to inject HyperBro backdoor (Stage 3).

MITRE ATT&CK Techniques list includes "T1055.003 ... Thread Execution Hijacking"

GuLoader has the ability to inject shellcode into donor processes that is started in a suspended state. Cardinal RAT injects into a newly spawned process created from a native Windows executable. Pandora can start and inject code into a new svchost process. ShadowPad has injected an install module into a newly created process.

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

The group is also known to deploy post-exploitation malware such as HYPERBRO, SysUpdate, PlugX and others through DLL sideloading, abusing trusted binaries to execute malicious code and evade detection.

“...HyperBro, a remote access trojan that operated via an ‘in-memory’ state, leaving minimal traces on disk...”

Persistence T1112 ... At its first execution, the configuration is copied into the config.ini file and into the config_ registry key.

The group has also used backdoors with keylogging functionality, to passively capture user credentials over time.

"actors used the following command ... to obtain information about services: net start"; "APT1 used the commands net start and tasklist to get a listing of the services on the system"; "OilRig has used sc query on a victim to gather information about services"; "Indrik Spider has used the win32_service WMI class to retrieve a list of services"

MITRE ATT&CK Techniques list includes "T1010 Application Window Discovery"

T1570

The defendants ... conducted unauthorized intrusions into victim networks by exploiting software vulnerabilities, conducting internal reconnaissance, and deploying malware such as PlugX to establish persistent access. The indictment alleges that the group stole data from compromised networks and transferred it to servers under their control.

The group has also used backdoors with keylogging functionality, to passively capture user credentials over time.

After gaining initial access, the group proceeded to compromise five domains over nine months, before ultimately deploying HyperBro malware to exfiltrate many gigabytes of data over a 17-day period.

The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."

MITRE ATT&CK Techniques list includes "T1115 Clipboard Data"

MITRE ATT&CK Techniques list includes "T1213 Data from Information Repositories"

URLs time.ntp-server.asia C&C 45.142.214.193 C&C linux.updatelive-oline.com C&C center.veryssl.org C&C https://139.180.216.65:443/api/v2/ajax C&C

The article identifies “an actual C2 that belongs to APT27” by searching for URLs containing the “/api/v2/ajax” URI sequence. It also describes HyperBro C2 servers responding on TCP port 443 with HTTP 500 errors.

“...hacked a MikroTik router to host the command and control server of the HyperBro RAT.”

Starting closest to the actors, we see connections from Chinanet Backbone or Alibaba establishing tunnels to the management VPN nodes at DigitalOcean. From these, they create tunnels to operational nodes, which they use to SSH into the malware controllers.

MITRE ATT&CK Techniques list includes "T1095 Non-Application Layer Protocol"

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

with the attackers using the HyperBro remote access trojans (RAT) to backdoor their networks. HyperBro helps the threat actors maintain persistence on the victims' networks by acting as an in-memory backdoor with remote administration capabilities.

These communication methods support RAT-like functions and VPN-like capabilities over encrypted channels.

These malware controllers receive victim communications, but also establish tunnels to what we believe to be data exfiltration nodes... The data exfiltration tunnel path is used for carrying traffic from malware controllers back towards the actors.

The agency said the threat group's goal is to steal sensitive information... in addition to stealing business secrets and intellectual property