MalwareUsed by 1 actor

BlackWater

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

ReconHellcat

Finally, the Blackwater backdoor starts communicating with the Clouldflare Worker via JSON. Attribution Our technical findings overlap with the Tactics, Techniques and Procedures (TTPs) previously attributed to the BlackWater malware campaign first identified in March

via quointelligence blogquointelligence.eu

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

once executed by Word, it downloads an encrypted x64 executable as the final backdoor.

T1059.005Visual BasicEvidence1

The maldoc contains an obfuscated macro that retrieves the second-stage encrypted payload from one of the three hardcoded C2 URLs depending on the user’s Windows version.

Persistence

1 technique

T1137.006Add-insEvidence1

Finally, the decrypted payload is written in %APPDATA%\\Microsoft\Word\STARTUP\Moon.wll . By storing a Word add-in in such path allows Microsoft Word to load and execute it a malicious payload whenever it is launched.

Stealth

1 technique

T1497.001System ChecksEvidence1

the malicious macro checks the Windows version at the beginning of its execution, and contacts a specific URL depending of the result of this check.

Discovery

1 technique

T1497.001System ChecksEvidence1

the malicious macro checks the Windows version at the beginning of its execution, and contacts a specific URL depending of the result of this check.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

Finally, the Blackwater backdoor starts communicating with the Clouldflare Worker via JSON.

T1105Ingress Tool TransferEvidence1

The maldoc contains an obfuscated macro that retrieves the second-stage encrypted payload from one of the three hardcoded C2 URLs depending on the user’s Windows version.

T1568Dynamic ResolutionEvidence1

both the loader and the backdoor resolve the C2 hostnames via DNS-over-HTTP (DoH) by using a built-in feature of libcurl.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

quointelligence blogNews

Aug 7, 2020

BlackWater Malware Leverages Beirut Tragedy - QuoIntelligence

A multi-stage malware campaign using an obfuscated malicious Word macro to fetch an encrypted payload, drop a Word add-in (Moon.wll) for persistence/execution, then download and decrypt a final x64 backdoor. It uses Windows font files as part of its decryption scheme, communicates with C2 over JSON, and resolves C2 hostnames via DNS-over-HTTPS using libcurl.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

BlackWater

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

ReconHellcat

via quointelligence blogquointelligence.eu

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

once executed by Word, it downloads an encrypted x64 executable as the final backdoor.

T1059.005Visual BasicEvidence1

The maldoc contains an obfuscated macro that retrieves the second-stage encrypted payload from one of the three hardcoded C2 URLs depending on the user’s Windows version.

Persistence

1 technique

T1137.006Add-insEvidence1

Stealth

1 technique

T1497.001System ChecksEvidence1

the malicious macro checks the Windows version at the beginning of its execution, and contacts a specific URL depending of the result of this check.

Discovery

1 technique

T1497.001System ChecksEvidence1

the malicious macro checks the Windows version at the beginning of its execution, and contacts a specific URL depending of the result of this check.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

Finally, the Blackwater backdoor starts communicating with the Clouldflare Worker via JSON.

T1105Ingress Tool TransferEvidence1

The maldoc contains an obfuscated macro that retrieves the second-stage encrypted payload from one of the three hardcoded C2 URLs depending on the user’s Windows version.

T1568Dynamic ResolutionEvidence1

both the loader and the backdoor resolve the C2 hostnames via DNS-over-HTTP (DoH) by using a built-in feature of libcurl.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

quointelligence blogNews

Aug 7, 2020

BlackWater Malware Leverages Beirut Tragedy - QuoIntelligence

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.