Loading malware…
LookBack is a modular, C++ remote access Trojan for Windows used in cyberespionage and information-gathering operations, notably against U.S. electric utilities in campaigns identified in 2019. It is associated with TA410, including its LookingFrog subgroup, and with activity tracked as TALONITE. Observed delivery involved spearphishing emails impersonating engineering, licensing, and energy-certification organizations. Malicious Microsoft Word attachments used obfuscated VBA macros to drop, decode, and execute its components.
LookBack combines a remote-access module, a communications module, a modified library loader, and a command-and-control proxy. Its communications module uses a custom binary socket protocol and modified RC4 encryption to exchange data with a local proxy, which forwards traffic to external command-and-control infrastructure over HTTP. The proxy masquerades as a legitimate Notepad++ updater, while the loader decrypts and loads embedded malicious components. LookBack uses DLL side-loading and registry-based logon persistence.
Its capabilities include collecting system, process, service, and file information; capturing desktop screenshots and credentials; executing commands; controlling the mouse; deleting files; rebooting the host; and removing itself. These functions support host surveillance and remote control. Although deployed against utilities, the documented TALONITE activity did not establish penetration of control-system networks or disruptive ICS operations. Similarities to APT10 tradecraft do not establish attribution to APT10 or a particular state sponsor.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The group uses phishing techniques with either malicious documents or executables. TALONITE uses two custom malware families that both feature multiple components known as LookBack and FlowCloud.
rule apt_Windows_TA410_LookBack_decryption ... description = "Matches encryption/decryption function used by LookBack." ... rule apt_Windows_TA410_LookBack_loader ... description = "Matches the modified function in LookBack libcurl loader." ... rule apt_Windows_TA410_LookBack_HTTP ... description = "Matches LookBack's hardcoded HTTP request"
From August to September 2019, researchers at Proofpoint identified a phishing campaign they call LookBack, utilizing spoofed network infrastructure and emails to deliver malware to electric utilities.
Proofpoint researchers reported that LookBack malware was targeting the United States (U.S.) utilities sector between July and August 2019... both LookBack and FlowCloud malware can be attributed to a single threat actor we are calling TA410.
42 distinct techniques documented for this family, organized by ATT&CK tactic.
The phishing emails originated from what appears to be an actor-controlled domain: globalenergycertification[.]net... it masqueraded as the legitimate domain for Global Energy Certification (“GEC”).
Based on the capabilities of LookBack and FlowCloud, both of which facilitate various means of credential capture, Dragos assesses with high confidence that TALONITE lateral movement incorporates credential reuse.
Exploit public facing app: LookingFrog and JollyFrog • CVE-2019-0604 • ProxyLogon (March 2021) • ProxyShell (August 2021)
The group uses phishing techniques with either malicious documents or executables.
TALONITE gains initial enterprise network access via spearphishing activity that leverages malicious documents and executables.
The phishing emails appeared to impersonate a US-based engineering licensing board with emails originating from what appears to be an actor-controlled domain, nceess[.]com.
Its capabilities include... executing commands...
The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.
TALONITE TTPs from MITRE ATT&CK ... EXECUTION ... T1106 Native API
Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution.
Based on the capabilities of LookBack and FlowCloud, both of which facilitate various means of credential capture, Dragos assesses with high confidence that TALONITE lateral movement incorporates credential reuse.
Across the content, malware repeatedly 'adds Registry Run keys', 'creates Registry entries', 'modifies the Windows Registry', or 'overwrites registry keys' to maintain persistence.
Both malware types are Remote Access Trojans (RAT) that contain capabilities to establish persistence within the environment.
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
Based on the capabilities of LookBack and FlowCloud, both of which facilitate various means of credential capture, Dragos assesses with high confidence that TALONITE lateral movement incorporates credential reuse.
Both malware types are Remote Access Trojans (RAT) that contain capabilities to establish persistence within the environment.
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
threat actors appeared to utilize many concatenation commands within the macro to obfuscate the VBA function. It is possible these concatenations were an attempt to evade static signature detection for the macro strings...
actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.
Akira has used legitimate names and locations for files to evade defenses.
Examples throughout the content include deleting tools, logs, malware-related files, staged archives, screenshots, temporary files, and exfiltrated data 'to cover their tracks,' 'reduce their footprint,' 'remove traces of activity,' or as part of 'post-intrusion cleanup.'
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
Based on the capabilities of LookBack and FlowCloud, both of which facilitate various means of credential capture, Dragos assesses with high confidence that TALONITE lateral movement incorporates credential reuse.
The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.
This file is next saved as a portable executable file named “gup.exe” and executed using a version of the certutil.exe tool named “Temptcm.tmp”.
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v CurlUpdate /f /d rundll32.exe C:\Users\Public\libcurl.dll,#52
Across the content, malware repeatedly 'adds Registry Run keys', 'creates Registry entries', 'modifies the Windows Registry', or 'overwrites registry keys' to maintain persistence.
Its capabilities include... deleting files... Noteworthy malware commands include: Read files Delete files Write to files
LookBack Capabilities • User Activity ... FlowCloud Capabilities • User Activity
Its capabilities include an enumeration of services...
TALONITE TTPs from MITRE ATT&CK ... DISCOVERY ... T1046 Network Scanning Service
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
LookBack Capabilities • System Information ... FlowCloud Capabilities • System Information
The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.
TALONITE TTPs from MITRE ATT&CK ... COLLECTION ... T1005 Data from Local System
LookBack Capabilities • User Activity ... FlowCloud Capabilities • User Activity
The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."
Analysts have determined that the LookBack samples from recent campaigns utilize the same command and control (C&C) server, 103.253.41[.]45, observed in July campaigns. The LookBack beacon is identifiable via the URL format below: C&C URL format: http://%s/status[.]gif?r=%d
The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.
TALONITE TTPs from MITRE ATT&CK ... COMMAND & CONTROL ... T1090 Proxy
Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Operation Honeybee, the threat actors used a Visual Basic script embedded within a Word document to download an implant.
Both malware types are Remote Access Trojans (RAT) that contain capabilities to establish persistence within the environment.
The content is a catalog of malware and threat groups that encrypt command-and-control communications using algorithms such as DES, AES, RC4, XOR, Blowfish, RSA, Camellia, RC2, RC6, and custom ciphers.
Its capabilities include... rebooting the machine and deleting itself from an infected host.
32 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
33 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.