Keeping up with ongoing attacks and investigations is an important function in cyber-security. Nearly every day a new attack is spotted, a new blog is posted, or a new vulnerability is released. Anyone who works in cyber-security should be reviewing threat intelligence reports, gleaning them for indicators of compromise and then updating their own systems and protective devices with the information gathered. Not doing this is missing the boat and standing on a short pier!
As an example, Huntress, a well-known cyber-security company, recently posted a blog with some very interesting details about an attack they investigated. This attack was a bit out of the ordinary in that the attackers were not after ransomware or even the customer’s data, they were setting up a phishing stager! Yes, you read that right. A phishing stager. Phishing is still a very lucrative vector for cyber-criminals, but not one that many cyber-security defenders pay much attention to in their environments.
Now, as Huntress had their tools installed on the network, they immediately began to get alerts and observe highly suspicious activity. I would like to note here that their client was a small company, around 25 endpoints. It is here that cyber criminals will often focus their efforts. Smaller companies routinely have a much smaller defense budget and thus are more open to attacks of this nature and the evil doers know this. If you have a small business, you really should take the time to read the blog and use it to engage with your executives, board of directors, or whomever makes decisions regarding your budget. Being underfunded and open to an attack of this nature is not a good business decision (to say the least)!
Fig. 1 – Clip from the Huntress Blog
In the clip above, I circled and underlined some of the important items. Below is a listing with a few of my own thoughts:
- First, you can see the phishing stager being set up on the victim’s terminal server.
- Next Huntress observed a “legitimate” bulk email software application called Gammadyne Mailer, on this system. I put legitimate in quotation marks because it is only legitimate if the business actually uses that piece of software! If they didn’t, then it is NOT legit, it is suspicious.
- Huntress also recovered six target lists, which the attackers had stored on the compromised server, with over 8 million email addresses! That is a lot of future, potential victims!
- The phishing lure was a free gift survey! There is the social engineering side of the attack. Everyone loves a “free” gift and attackers routinely use it to get unsuspecting or greedy folks, to clickety, click!
- Next, we see that the payload in the phishing emails pointed back to a compromised Bolivian government website! Yes, even governments can be victims and, in this case, not only was the website compromised, but it now became a facet of the attackers’ infrastructure!
- Huntress did not sit on what they had discovered, rather they reached out to the Bolivian governments CSIRT and provided them with the intel they needed to resecure that compromised web site and close that attack vector.
All of this is fascinating to read about. Another piece of information that caught my eye, was that when the alerts started flowing in, Huntress analysts immediately identified a suspicious log in! This was from a Windows Security audit log entry, Event ID 4624, a successful login. They were able to capture the source IP as well, which came back to 212.93.152[.]37, a Romanian IP address. They knew this was suspicious, because they had prior intelligence from a previous attack! Thankfully, they had that little bit of intel and were able to spot this entry, even though it was logged as a “successful” login, which many would have overlooked!
An interesting aside, when you look this IP up in Virus Total, it shows as benign! See below:
Fig. 2 – Virus Total Lookup
So, if you didn’t have the intel, you would probably assume that this was a legitimate login and never pay it any attention! Only to find out later that this was where the attack originated. So, what can you do?
- Geo block country IP ranges that you do not do business with! That is probably the easiest first step available! If you do not do business with Romania, well, then block that range!
- Ensure that you are storing Window System logs so that they can be reviewed, historically! Many attacks have been going on for months and if you do not have the logs stored, you are blind to what has been happening with your systems and to your data!
Fig. 3 – A Table View presenting history of attack
I really, really, liked this report. Especially the details that the Huntress analysts included in the blog. As you can see above, a full timeline was available to the hunters and defenders, once they had an Endpoint Protection Service running! I know that many small businesses fail to utilize EDRs and this present problems with responding to and investigating attacks, which are a certainty, in the world today!
Huntress provides an extensive list of Indicators of compromise, which I encourage all cyber-security operators to review and use to the best of their abilities! I also encourage you to take this blog and use it to get a better investment in your security program. You really can not afford to not have an EDR in the world today. Since you must get buy in from your board, use this type of research and information to build your case! If you need a hand, feel free to reach out to me and I can assist you as well.
Carpe Diem!
Leave a Reply