BackConnect

The attacks start with an email bombing campaign, followed by direct contact via Teams, where the attacker impersonates an IT staff.

S-RM has already observed that certain Black Basta ransomware members appear to have moved to Cactus Ransomware based on the use of a version of BackConnect malware previously only seen in Black Basta attacks as well as other tactics, techniques and procedure (TTP) similarities like the use of social engineering attacks with email flooding for Microsoft Quick Assist access.

After having failed to buy an iPhone through the hacked computer the attacker instead deploys three reverse shell sessions using the BackConnect C2 channel.

the attacker used the command type kb052117-01.bpx kb052123-02.bpx > pack.zip ... The file arch1271.cab was extracted ... via cmd.exe

The attacker also added the following registry entry to store their BackConnect IPs: reg add "HKCU\SOFTWARE\TitanPlus" /v 1 /t REG_SZ /d "38.180.25.3A443;45.8.157.199A443;5.181.3.164A443" /f

The OneDriveStandaloneUpdater.exe process was later launched noninteractively via cmd.exe with the following command-line instruction: "...\OneDriveStandaloneUpdater.exe" -Embedding.

The attacker also added the following registry entry to store their BackConnect IPs: reg add "HKCU\SOFTWARE\TitanPlus" /v 1 /t REG_SZ /d "38.180.25.3A443;45.8.157.199A443;5.181.3.164A443" /f

These three commands are issued in the first reverse shell session: net group "domain admins" /dom arp -a dir \\172.16.0.12\c$

These three commands are issued in the first reverse shell session: net group "domain admins" /dom ... In the second shell session the attacker first runs these three commands: shell net group "domain admins" /dom

These three commands are issued in the first reverse shell session: net group "domain admins" /dom arp -a dir \\172.16.0.12\c$

...and then starts a file manager session through the BackConnect C2 channel. 15:40 Deploy Cobalt Strike ... In the second shell session the attacker first runs these three commands: shell net group "domain admins" /dom net group "domain admins" /dom nltest /domain_trusts /all_trusts

These three commands are issued in the first reverse shell session: net group "domain admins" /dom arp -a dir \\172.16.0.12\c$

The BackConnect C2 server tells the bot to sleep for 60 seconds two times before launching a reverse VNC session ... The keylog of the attacker above reveals that the attacker is typing “iphone 14 apple store buy”.

the attacker concatenates the two .bpx files into “pack.zip”. In this case, the attacker used the command type kb052117-01.bpx kb052123-02.bpx > pack.zip

IcedID ... connects to these four IcedID servers used for payload delivery and C2 ... Shortly after the IcedID C2 traffic has been started the IcedID bot also initiates BackConnect C2 connections ... After the DLL gets executed the victim PC establishes Cobalt Strike beacon C2 connections to clouditsoft[.]com on port 8008.

After gaining initial access, the attacker downloaded two different malicious .bpx files from a commercial cloud storage provider.

Follow the TCP stream for the first result ... This stream reveals encoded or otherwise encrypted TCP traffic ... Follow the TCP stream for the second frame ... This reveals encoded or encrypted data followed by a command to reveal all hosts under the domain controller

The BackConnect C2 server tells the bot to sleep for 60 seconds two times before launching a reverse VNC session with command 0x11.

we discuss how the Black Basta and Cactus ransomware groups utilized the BackConnect malware to maintain persistent control and exfiltrate sensitive data from compromised machines.