BabyShark

"...using typosquatting or domains thematically aligned with their target."

"masquerading as interview requests for a legitimate German-language business newspaper" / "impersonated a senior U.S. national security official" / "claimed to originate from a Japanese diplomat"

The activity started with exploitation of a recently addressed authentication bypass in the remote desktop software ScreenConnect... The threat actor gained access to the victim workstation by exploiting the exposed setup wizard of the ScreenConnect application.

This report details a specific phishing campaign used to distribute the Agent Tesla RAT. The lure in the emails is centered around updates to COVID-specific PPE.

The messages contained an HTML attachment masquerading as a preview of an article... Clicking the “Save on Disk” button created an HTTP request to the attacker’s C&C server to download a malicious Word document with a macro.

The main purpose of these activities seems to be credentials gathering, thanks to spearphishing emails and phishing websites.

Similar to previous BabyShark variants, ReconShark relies on Windows Management Instrumentation (WMI) to query process and battery information.

“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

Most open-source reporting on APT43 tracks the group using LATEOP (known publicly as ‘BabyShark’) ... its activities are much better known for being associated with LATEOP, a backdoor based on VisualBasic scripts.

TA427 was still using BabyShark, QuasarRAT, PCRat, browser extensions (Chrome, Edge and Firefox), and numerous PowerShell scripts (keylogging, exfiltration of emails and more).

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

BabyShark... VBScript-based, sequential malware: persistent downloader / loader, executing further scripts/payloads

The double-click triggers the execution of a malicious VBS file hidden behind the image, which then downloads additional malware from an external server.

The emails contain a RAR’d or Gzip’d attachments that install the Agent Tesla RAT upon execution.

“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

In addition to downloading additional files, access specific registries and change values as shown below.

BabyShark has added a Registry key to ensure all future macros are enabled for Microsoft Word and Excel as well as for additional persistence.

The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.

“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.

The initial payload downloaded by MSHTA utility was a heavily obfuscated VB script, containing randomly generated functions and variable names along with large amounts of hexadecimal encoded code and additional junk code.

Several malicious subdomains discovered seem to spoof email or cloud service providers, but a few of them appear to target specific organizations.

Examples throughout the content include deleting tools, logs, malware-related files, staged archives, screenshots, temporary files, and exfiltrated data 'to cover their tracks,' 'reduce their footprint,' 'remove traces of activity,' or as part of 'post-intrusion cleanup.'

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.

APT29 has use mshta to execute malicious scripts on a compromised host... APT32 has used mshta.exe for code execution... APT38 has used a renamed version of mshta.exe to execute malicious HTML files... FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.

A script is written to an Alternate Data Stream (ADS) of a file located in a directory within ProgramData.

In addition to downloading additional files, access specific registries and change values as shown below.

“…uses ProcDump… (OS Credential Dumping [T1003]).”

The main purpose of these activities seems to be credentials gathering, thanks to spearphishing emails and phishing websites.

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."

AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.

The content repeatedly describes malware and threat actors collecting the victim username, identifying logged-in users, running whoami, query user, quser, or similar commands to determine the current user or user sessions.

cmd.exe /c netstat -ano>>C:\ProgramData\[RANDOM_STRING].acl

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

"deployment of the legitimate AnyDesk software for persistent remote access" / "download and install the Chrome Remote Desktop software... enabling remote control"

The main purpose of these activities seems to be credentials gathering, thanks to spearphishing emails and phishing websites.

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

Once the tool has gathered all this information, it uses the inbuilt Windows command certutil to encode the stolen information in a Privacy Enhanced Mail (PEM) certificate, which it then exfiltrates to the C2 web application.

The domain name « login-main.bigwnet.com » is a C2 server for a malicious document intitled « Speaking notes-ExMon Deterrence Summit-24-Mar-rev-26-Mar19.doc ».

AppleSeed URL structure... FlowerPower... sends it to the C2 via HTTP POST.

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

ADVSTORESHELL C2 traffic is encrypted, then encoded with Base64 encoding. APT19 HTTP malware variant used Base64 to encode communications to the C2 server. APT33 has used base64 to encode command and control traffic.

Once the tool has gathered all this information, it uses the inbuilt Windows command certutil to encode the stolen information in a Privacy Enhanced Mail (PEM) certificate, which it then exfiltrates to the C2 web application.

"leveraging GitHub as a stager... hard-coded Github Personal Access Token (PAT)... upload information" / "fetches... from Dropbox" / "Proton Drive link hosting a ZIP archive"