Anomali Cyber Watch: Vermillion Strike, Operation Layover, New Malware Uses Windows Subsystem For Linux, and More

<p>The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: <b>APT, Cobalt Strike, ELF, Data Leak, MSHTML, Remote Code Execution, Windows Subsystem, VBScript,</b> and<b> Vulnerabilities</b>. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity.<br/> <img src="https://cdn.filestackcontent.com/D5RpGxocTDqdZKqqtjJb"/><br/> <em>Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed.</em></p> <h2>Trending Cyber News and Threat Intelligence</h2> <div class="trending-threat-article"> <h3 id="article-1"><a href="https://www.infosecurity-magazine.com/news/cisa-patch-zoho-bug-exploited-apt/" target="_blank">CISA: Patch Zoho Bug Being Exploited by APT Groups</a></h3> <p>(published: September 17, 2021)</p> <p>The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding a critical authentication bypass vulnerability, registered as “CVE-2021-4053,” that affects Zoho’s “ManageEngine ADSelfService Plus.” The vulnerability affects ManageEngine, a self-service password management and single sign-on solution from the online productivity vendor. The vulnerability is a Remote Code Execution (RCE) bypass vulnerability that could allow for remote code execution if exploited, according to the CISA. A successful exploitation of the vulnerability allows an actor to place webshells, which enable the adversary to conduct post-exploitation activities, such as compromising administrator credentials, lateral movement, and exfiltrating registry hives and Active Directory files. Zoho released a patch for this vulnerability on September 6, but CISA claimed that malicious actors might have been exploiting it as far back as August.<br/> <b>Analyst Comment:</b> Users should immediately apply the patch released by Zoho. Continuing usage of vulnerable applications will increase the likelihood that threat actors will attempt to exploit them, especially with open sources discussing the details of some vulnerabilities. These sources could allow some actors to create exploits to vulnerable software with malicious intent.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/3905353" target="_blank">[MITRE ATT&CK] Unsecured Credentials - T1552</a> | <a href="https://ui.threatstream.com/ttp/947231" target="_blank">[MITRE ATT&CK] Valid Accounts - T1078</a><br/> <b>Tags:</b> APT, Bug, Vulnerability, Zoho</p> </div> <div class="trending-threat-article"> <h3 id="article-2"><a href="https://blog.talosintelligence.com/2021/09/operation-layover-how-we-tracked-attack.html" target="_blank">Operation Layover: How We Tracked An Attack On The Aviation Industry to Five Years of Compromise</a></h3> <p>(published: September 16, 2021)</p> <p>Cisco Talos, along with Microsoft researchers, have identified a spearphishing campaign targeting the aviation sector that has been targeting aviation for at least two years. The actors behind this campaign used email spoofing to masquerade as legitimate organizations. The emails contained an attached PDF file that included an embedded link, containing a malicious VBScript which would then drop Trojan payloads on a target machine. The malware was used to spy on victims as well as to exfiltrate data including credentials, screenshots, clipboard, and webcam data. The threat actor attributed to this campaign has also been linked to crypter purchases from online forums; his personal phone number and email addresses were revealed, although these findings have not been verified. The actor is located in Nigeria and is suspected of being active since at least 2013, due to IPs connected to hosts, domains, and the attacks at large originate from this country.<br/> <b>Analyst Comment:</b> Files that request content be enabled to properly view the document are often signs of a phishing attack. If such a file is sent to you via a known and trusted sender, that individual should be contacted to verify the authenticity of the attachment prior to opening. Thus, any such file attachment sent by unknown senders should be viewed with the utmost scrutiny, and the attachments should be avoided and properly reported to appropriate personnel.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/3906161" target="_blank">[MITRE ATT&CK] Command and Scripting Interpreter - T1059</a> | <a href="https://ui.threatstream.com/ttp/3905074" target="_blank">[MITRE ATT&CK] Phishing - T1566</a> | <a href="https://ui.threatstream.com/ttp/947205" target="_blank">[MITRE ATT&CK] User Execution - T1204</a> | <a href="https://ui.threatstream.com/ttp/3905071" target="_blank">[MITRE ATT&CK] Application Layer Protocol - T1071</a> | <a href="https://ui.threatstream.com/ttp/947149" target="_blank">[MITRE ATT&CK] Application Window Discovery - T1010</a> | <a href="https://ui.threatstream.com/ttp/3905768" target="_blank">[MITRE ATT&CK] Boot or Logon Autostart Execution - T1547</a> | <a href="https://ui.threatstream.com/ttp/3906161" target="_blank">[MITRE ATT&CK] Command and Scripting Interpreter - T1059</a> | <a href="https://ui.threatstream.com/ttp/3905036" target="_blank">[MITRE ATT&CK] Credentials from Password Stores - T1555</a> | <a href="https://ui.threatstream.com/ttp/947259" target="_blank">[MITRE ATT&CK] Data Encoding - T1132</a> | <a href="https://ui.threatstream.com/ttp/947135" target="_blank">[MITRE ATT&CK] Data from Local System - T1005</a> | <a href="https://ui.threatstream.com/ttp/3905073" target="_blank">[MITRE ATT&CK] Dynamic Resolution - T1568</a> | <a href="https://ui.threatstream.com/ttp/3904494" target="_blank">[MITRE ATT&CK] Exfiltration Over C2 Channel - T1041</a> | <a href="https://ui.threatstream.com/ttp/947195" target="_blank">[MITRE ATT&CK] File and Directory Discovery - T1083</a> | <a href="https://ui.threatstream.com/ttp/3905778" target="_blank">[MITRE ATT&CK] Impair Defenses - T1562</a> | <a href="https://ui.threatstream.com/ttp/947194" target="_blank">[MITRE ATT&CK] Indicator Removal on Host - T1070</a> | <a href="https://ui.threatstream.com/ttp/3904527" target="_blank">[MITRE ATT&CK] Ingress Tool Transfer - T1105</a> | <a href="https://ui.threatstream.com/ttp/947243" target="_blank">[MITRE ATT&CK] Input Capture - T1056</a> | <a href="https://ui.threatstream.com/ttp/947166" target="_blank">[MITRE ATT&CK] Modify Registry - T1112</a> | <a href="https://ui.threatstream.com/ttp/3905769" target="_blank">[MITRE ATT&CK] Native API - T1106</a> | <a href="https://ui.threatstream.com/ttp/3904502" target="_blank">[MITRE ATT&CK] Non-Standard Port - T1571</a> | <a href="https://ui.threatstream.com/ttp/947235" target="_blank">[MITRE ATT&CK] Obfuscated Files or Information - T1027</a> | <a href="https://ui.threatstream.com/ttp/947124" target="_blank">[MITRE ATT&CK] Peripheral Device Discovery - T1120</a> | <a href="https://ui.threatstream.com/ttp/947207" target="_blank">[MITRE ATT&CK] Process Discovery - T1057</a> | <a href="https://ui.threatstream.com/ttp/947252" target="_blank">[MITRE ATT&CK] Query Registry - T1012</a> | <a href="https://ui.threatstream.com/ttp/947162" target="_blank">[MITRE ATT&CK] Remote Services - T1021</a> | <a href="https://ui.threatstream.com/ttp/947275" target="_blank">[MITRE ATT&CK] Remote System Discovery - T1018</a> | <a href="https://ui.threatstream.com/ttp/947134" target="_blank">[MITRE ATT&CK] Replication Through Removable Media - T1091</a> | <a href="https://ui.threatstream.com/ttp/947079" target="_blank">[MITRE ATT&CK] Screen Capture - T1113</a> | <a href="https://ui.threatstream.com/ttp/947125" target="_blank">[MITRE ATT&CK] System Information Discovery - T1082</a> | <a href="https://ui.threatstream.com/ttp/947082" target="_blank">[MITRE ATT&CK] System Owner/User Discovery - T1033</a> | <a href="https://ui.threatstream.com/ttp/947184" target="_blank">[MITRE ATT&CK] Video Capture - T1125</a><br/> <b>Tags:</b> AsyncRAT, Aviation, Phishing, RAT, Malicious Document, Njrat, VBScript</p> </div> <div class="trending-threat-article"> <h3 id="article-3"><a href="https://www.bleepingcomputer.com/news/security/new-malware-uses-windows-subsystem-for-linux-for-stealthy-attacks/" target="_blank">New Malware Uses Windows Subsystem For Linux For Stealthy Attacks</a></h3> <p>(published: September 16, 2021)</p> <p>Researchers at Lumen’s Black Lotus Labs have identified a new Linux malware. The malware is created for the Windows Subsystem for Linux (WSL), possibly as a means to evade detection. The low detected files contain an embedded payload or retrieve one from a remote server, which is then injected into a running process. The loader, written in Python has the ability to kill anti-virus software, establish persistence and run a PowerShell script.<br/> <b>Analyst Comment:</b> Malware authors are always innovating new methods of evading detection. Always practice Defense in Depth (do not rely on single security mechanisms - security measures should be layered, redundant, and failsafe).<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/3906161" target="_blank">[MITRE ATT&CK] Command and Scripting Interpreter - T1059</a> | <a href="https://ui.threatstream.com/ttp/3297596" target="_blank">[MITRE ATT&CK] Software Discovery - T1518</a> | <a href="https://ui.threatstream.com/ttp/947142" target="_blank">[MITRE ATT&CK] Process Injection - T1055</a><br/> <b>Tags:</b> ELF, Linux, Powershell, Python, Windows</p> </div> <div class="trending-threat-article"> <h3 id="article-4"><a href="https://www.flashpoint-intel.com/blog/the-navalny-leaks-data-probiv-and-russian-political-influence/" target="_blank">The Navalny Leaks: Data, Probiv, and Russian Political Influence </a></h3> <p>(published: September 15, 2021)</p> <p>A database containing personal identifiable information (PII) of people making donations to the Anti-Corruption Foundation (FBK), the organisation led by opposition figure Alexey Navalny has been leaked. The information leaked includes names, birth dates, employers and financial information, and was initially leaked on 4chan imageboard. This is the latest in a series of breaches related to Navalny supporters this year.<br/> <b>Analyst Comment:</b> Politically exposed persons (PEP) are often a target of government-connected cyber groups. In the past we saw an expansion of cyber targeting when domestic targeting in Russia was later expanded to politically-motivated targeting around the World: from Ukraine to the US. People and organizations with political exposure should implement defence-in-depth protection regarding their online assets and stored PII.<br/> <b>Tags:</b> Data Breach, Dissidents, Russia</p> </div> <div class="trending-threat-article"> <h3 id="article-5"><a href="https://www.microsoft.com/security/blog/2021/09/15/analyzing-attacks-that-exploit-the-mshtml-cve-2021-40444-vulnerability/" target="_blank">Analyzing Attacks That Exploit The CVE-2021-40444 MSHTML Vulnerability</a></h3> <p>(published: September 15, 2021)</p> <p>The Microsoft MSHTML vulnerability, registered as “CVE-2021-40444”, first identified by Microsoft Threat Intelligence Center (MTIC) has been used in a small number of attacks. In research by MTIC, the campaign is believed to begin with emails impersonating agreements and contracts containing malicious documents. The documents are crafted with embedded Javascript that downloads a CAB file containing a DLL from a remote host. Once the DLL function is executed, shellcode is loaded from a remote source and into the “wabmig.exe” process.<br/> <b>Analyst Comment:</b> Microsoft have released a patch. It is highly recommended to apply the appropriate September 2021 cumulative security update (5005565, 5005566, 5005575, or 5005568). Anomali Match can enable you to detect past occurances of such attacks using retrospective search capabilities.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947142" target="_blank">[MITRE ATT&CK] Process Injection - T1055</a> | <a href="https://ui.threatstream.com/ttp/3905074" target="_blank">[MITRE ATT&CK] Phishing - T1566</a> | <a href="https://ui.threatstream.com/ttp/3906161" target="_blank">[MITRE ATT&CK] Command and Scripting Interpreter - T1059</a><br/> <b>Tags:</b> JavaScript, Malicious Document, MSHTML, Microsoft, Process Injection, Process Hollowing</p> </div> <div class="trending-threat-article"> <h3 id="article-6"><a href="https://threatpost.com/attackers-impersonate-dot-phishing-scam/169484/" target="_blank">Attackers Impersonate DoT in Two-Day Phishing Scam</a></h3> <p>(published: September 15, 2021)</p> <p>Researchers at INKY have identified a two-day phishing campaign that involved threat actors impersonating the US Department of Transportation. The campaign targeted architecture, energy, and engineering luring victims with a bid proposal, which then led to a credential stealing page. Using newly created domains, the threat actors were able to evade detection as they didn’t appear in any threat intelligence feeds.<br/> <b>Analyst Comment:</b> Anomali Premium Domain Monitoring service notifies customers regarding registration of potential phishing domains. Customers can then automatically block such domains via Anomali Integrator.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/3905074" target="_blank">[MITRE ATT&CK] Phishing - T1566</a> | <a href="https://ui.threatstream.com/ttp/2402775" target="_blank">[MITRE PRE-ATT&CK] Spear phishing messages with text only - T1368</a><br/> <b>Tags:</b> Credential Harvesting, Phishing, US Government</p> </div> <div class="trending-threat-article"> <h3 id="article-7"><a href="https://www.zdnet.com/article/omigod-azure-users-running-linux-vms-need-to-update-now/#ftag=RSSbaffb68" target="_blank">OMIGOD: Azure Users Running Linux VMs Need to Update Now</a></h3> <p>(published: September 15, 2021)</p> <p>Security researcher Nir Ohfeld has discovered four vulnerabilities in Microsoft's Open Management Infrastructure (OMI) project that could allow an actor to gain root access on a remote machine if they sent a single packet with the authentication header removed. This is a textbook Remote Code Execution (RCE) vulnerability that you would expect to see in the 90's, but it's highly unusual to have one crop up in 2021 that can expose millions of endpoints. The vulnerability, registered as “CVE-2021-38647,” is a combination of a simple conditional statement coding mistake and an uninitialized auth struct. Any request without an Authorization header has its privileges default to “uid=0, gid=0”, which is root.<br/> <b>Analyst Comment:</b> Organisations who deliver software solutions to their customers need to perform automated static and dynamic code analysis to catch potential security vulnerabilities. Vulnerability detection and patch prioritisation need to be in place to address most critical vulnerabilities related to the customer's environment.<br/> <b>Tags:</b> Azure, Linux, VM, Vulnerability</p> </div> <div class="trending-threat-article"> <h3 id="article-8"><a href="https://www.sentinelone.com/labs/hide-and-seek-new-zloader-infection-chain-comes-with-improved-stealth-and-evasion-mechanisms/" target="_blank">Hide and Seek | New Zloader Infection Chain Comes With Improved Stealth and Evasion Mechanisms</a></h3> <p>(published: September 14, 2021)</p> <p>Researchers from SentinelLabs have discovered a new infection chain to disable Microsoft Defender Antivirus (formerly Windows Defender) on victims' computers to evade detection. The actors behind this campaign have changed the malware delivery vector from spam or phishing emails to TeamViewer Google ads published through Google Adwords, redirecting the targets to fake download sites. From there, they are tricked into downloading signed and malicious MSI installers designed to install Zloader malware payloads on their computers. The first stage dropper has been changed from the classic malicious document to a stealthy, signed MSI payload. It uses backdoored binaries and a series of living-off-the-land binaries and scripts (LOLBAS) to impair defenses and proxy the execution.<br/> <b>Analyst Comment:</b> Windows event logs monitoring through SIEM can help to identify security configuration changes on endpoints. Application & Device monitoring policies should be set to ensure no untrusted process can modify important registry or config files.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947145" target="_blank">[MITRE ATT&CK] Signed Binary Proxy Execution - T1218</a> | <a href="https://ui.threatstream.com/ttp/947142" target="_blank">[MITRE ATT&CK] Process Injection - T1055</a> | <a href="https://ui.threatstream.com/ttp/947161" target="_blank">[MITRE ATT&CK] Man in the Browser - T1185</a> | <a href="https://ui.threatstream.com/ttp/3904494" target="_blank">[MITRE ATT&CK] Exfiltration Over C2 Channel - T1041</a><br/> <b>Tags:</b> Malware, Terdot, Windows Defender, Zloader</p> </div> <div class="trending-threat-article"> <h3 id="article-9"><a href="https://www.intezer.com/blog/malware-analysis/vermilionstrike-reimplementation-cobaltstrike/" target="_blank">Vermilion Strike: Linux and Windows Re-implementation of Cobalt Strike</a></h3> <p>(published: September 13, 2021)</p> <p>Researchers at Intezer have discovered an undetected ELF Cobalt Strike beacon. First found in August 2021, the beacon named Vermillion Strike shares infrastructure and functionality with Windows Cobalt Strike, and is a reimplementation for Linux. Vermillion Strike’s functionality includes: get/change working directory, append/write to file, list files, retrieve disk partition, upload files to C2. The malware appears to be targeting multiple industries including advisory, financial, IT, government and telecom companies.<br/> <b>Analyst Comment:</b> Users should be aware of the growing Linux threats. Anomali Match can be used to quickly search your infrastructure for known IOCs, in combination with a TIP (such as Anomali ThreatStream) to ingest and add context to IOCs and threat actors.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/3904494" target="_blank">[MITRE ATT&CK] Exfiltration Over C2 Channel - T1041</a> | <a href="https://ui.threatstream.com/ttp/3905071" target="_blank">[MITRE ATT&CK] Application Layer Protocol - T1071</a> | <a href="https://ui.threatstream.com/ttp/947259" target="_blank">[MITRE ATT&CK] Data Encoding - T1132</a> | <a href="https://ui.threatstream.com/ttp/3297570" target="_blank">[MITRE ATT&CK] File and Directory Permissions Modification - T1222</a> | <a href="https://ui.threatstream.com/ttp/3906161" target="_blank">[MITRE ATT&CK] Command and Scripting Interpreter - T1059</a> | <a href="https://ui.threatstream.com/ttp/3906164" target="_blank">[MITRE ATT&CK] Abuse Elevation Control Mechanism - T1548</a> | <a href="https://ui.threatstream.com/ttp/947269" target="_blank">[MITRE ATT&CK] Access Token Manipulation - T1134</a> | <a href="https://ui.threatstream.com/ttp/947189" target="_blank">[MITRE ATT&CK] Account Discovery - T1087</a> | <a href="https://ui.threatstream.com/ttp/3905071" target="_blank">[MITRE ATT&CK] Application Layer Protocol - T1071</a> | <a href="https://ui.threatstream.com/ttp/947257" target="_blank">[MITRE ATT&CK] BITS Jobs - T1197</a> | <a href="https://ui.threatstream.com/ttp/3906161" target="_blank">[MITRE ATT&CK] Command and Scripting Interpreter - T1059</a> | <a href="https://ui.threatstream.com/ttp/3905040" target="_blank">[MITRE ATT&CK] Create or Modify System Process - T1543</a> | <a href="https://ui.threatstream.com/ttp/947135" target="_blank">[MITRE ATT&CK] Data from Local System - T1005</a> | <a href="https://ui.threatstream.com/ttp/947136" target="_blank">[MITRE ATT&CK] Deobfuscate/Decode Files or Information - T1140</a> | <a href="https://ui.threatstream.com/ttp/3904531" target="_blank">[MITRE ATT&CK] Encrypted Channel - T1573</a> | <a href="https://ui.threatstream.com/ttp/947244" target="_blank">[MITRE ATT&CK] Exploitation for Client Execution - T1203</a> | <a href="https://ui.threatstream.com/ttp/947233" target="_blank">[MITRE ATT&CK] Exploitation for Privilege Escalation - T1068</a> | <a href="https://ui.threatstream.com/ttp/3905778" target="_blank">[MITRE ATT&CK] Impair Defenses - T1562</a> | <a href="https://ui.threatstream.com/ttp/947194" target="_blank">[MITRE ATT&CK] Indicator Removal on Host - T1070</a> | <a href="https://ui.threatstream.com/ttp/3904527" target="_blank">[MITRE ATT&CK] Ingress Tool Transfer - T1105</a> | <a href="https://ui.threatstream.com/ttp/947243" target="_blank">[MITRE ATT&CK] Input Capture - T1056</a> | <a href="https://ui.threatstream.com/ttp/947161" target="_blank">[MITRE ATT&CK] Man in the Browser - T1185</a> | <a href="https://ui.threatstream.com/ttp/947166" target="_blank">[MITRE ATT&CK] Modify Registry - T1112</a> | <a href="https://ui.threatstream.com/ttp/3905769" target="_blank">[MITRE ATT&CK] Native API - T1106</a> | <a href="https://ui.threatstream.com/ttp/947276" target="_blank">[MITRE ATT&CK] Network Service Scanning - T1046</a> | <a href="https://ui.threatstream.com/ttp/947123" target="_blank">[MITRE ATT&CK] Network Share Discovery - T1135</a> | <a href="https://ui.threatstream.com/ttp/947250" target="_blank">[MITRE ATT&CK] Standard Non-Application Layer Protocol - T1095</a> | <a href="https://ui.threatstream.com/ttp/947235" target="_blank">[MITRE ATT&CK] Obfuscated Files or Information - T1027</a> | <a href="https://ui.threatstream.com/ttp/947114" target="_blank">[MITRE ATT&CK] Office Application Startup - T1137</a> | <a href="https://ui.threatstream.com/ttp/3905348" target="_blank">[MITRE ATT&CK] OS Credential Dumping - T1003</a> | <a href="https://ui.threatstream.com/ttp/947207" target="_blank">[MITRE ATT&CK] Process Discovery - T1057</a> | <a href="https://ui.threatstream.com/ttp/947142" target="_blank">[MITRE ATT&CK] Process Injection - T1055</a> | <a href="https://ui.threatstream.com/ttp/3905068" target="_blank">[MITRE ATT&CK] Protocol Tunneling - T1572</a> | <a href="https://ui.threatstream.com/ttp/3905359" target="_blank">[MITRE ATT&CK] Proxy - T1090</a> | <a href="https://ui.threatstream.com/ttp/947252" target="_blank">[MITRE ATT&CK] Query Registry - T1012</a> | <a href="https://ui.threatstream.com/ttp/947162" target="_blank">[MITRE ATT&CK] Remote Services - T1021</a> | <a href="https://ui.threatstream.com/ttp/947275" target="_blank">[MITRE ATT&CK] Remote System Discovery - T1018</a> | <a href="https://ui.threatstream.com/ttp/947153" target="_blank">[MITRE ATT&CK] Scheduled Transfer - T1029</a> | <a href="https://ui.threatstream.com/ttp/947079" target="_blank">[MITRE ATT&CK] Screen Capture - T1113</a> | <a href="https://ui.threatstream.com/ttp/3905372" target="_blank">[MITRE ATT&CK] Subvert Trust Controls - T1553</a> | <a href="https://ui.threatstream.com/ttp/947187" target="_blank">[MITRE ATT&CK] System Network Configuration Discovery - T1016</a> | <a href="https://ui.threatstream.com/ttp/947200" target="_blank">[MITRE ATT&CK] System Network Connections Discovery - T1049</a> | <a href="https://ui.threatstream.com/ttp/3905344" target="_blank">[MITRE ATT&CK] System Services - T1569</a> | <a href="https://ui.threatstream.com/ttp/3904552" target="_blank">[MITRE ATT&CK] Use Alternate Authentication Material - T1550</a> | <a href="https://ui.threatstream.com/ttp/947231" target="_blank">[MITRE ATT&CK] Valid Accounts - T1078</a> | <a href="https://ui.threatstream.com/ttp/947077" target="_blank">[MITRE ATT&CK] Windows Management Instrumentation - T1047</a><br/> <b>Tags:</b> Cobalt Strike, ELF, Linux, Vermilion Strike</p> </div>