Russian-Speaking Attacker Exposes Their Toolbox While Attempting to Deploy the Phobos Ransomware to Community College

A Russian-speaking hacker exposed their toolbox while attempting a ransomware intrusion at a U.S. Community College. The attacker unloaded an arsenal of hacker tools including:

• A binary that resembles a clipper tool (a malicious program that would let attackers steal cryptocurrency by swapping the wallet address with the attacker's address),
• Infostealer malware looking for Paypal, eBay, and PokerStars accounts, and
• A variant of the Phobos ransomware.

Since the Phobos ransomware is bought, not borrowed, this threat actor was likely acting in isolation or as part of a small independent group. Some of the custom tools and the observation of Russian language in the code observed in the incident mirrored a previous report on an unknown ransomware operation.

The threat actor used two distinct systems: a Transfer Box and a C2 Box full of intrusion tools and, presumably, exfiltrated data. The attacker’s systems were open to the internet and were scanned by various open-source tools that reported open services and exposed directories. TRU leveraged these sources to understand attacker motivation and techniques.

Transfer Box

Figure 2: Transfer box used by the attacker had a library of intrusion tools and exfiltrated data (removed).

C2 Box

The threat actor used a C2 Box for maintaining a web shell to the community college´s network. The C2 Box was also a Cobalt Strike server. However, the attacker didn’t leverage Cobalt Strike’s Beacon in the attack against the community college. Interestingly, the infrastructure existed on a range known to be managed by bulletproof hosting provider that appears to still be active on hacker forums. (Figure 3).

Russian Speaking Threat Actor Responsible

Some tools in the exposed toolbox and the code (Figure 4) in some of the deployed tools are in Cyrillic, which Slavic-speaking members of TRU identify as the Russian language and validated through Google Translate. A few tools overlap with tools observed in an incident reported by Security Joes.

Information Targets

Information stealers deployed by the threat actor had some interesting targets including crypto-wallets, PokerStars, Ebay, Neteller, and Skrill. In addition to the deployment of ransomware, these targets point to financially motivated cybercrime.

How the eSentire Threat Response Unit (TRU) Responded to this Cyber Threat

Our Threat Response Unit (TRU) combines threat intelligence obtained from research and security incidents to create practical outcomes for our customers:

• Tactical response: This incident was escalated to active incident handling in which hands-on defenders are engaged to intercept hands-on attackers and remove them from the IT environment before they can disrupt business operations.
• Operational response: The adversarial infrastructure, tactics, and other artifacts tracked by TRU are continuously swept through indicator hunts and rule deployment and our team of 24/7 Cyber SOC Analysts actively monitors these signals for disruptive attacks.
• Strategic response: TRU continues to build out its threat actor tracking capabilities as the threat landscape shifts. Deploying new threat detections and intelligence products to the SOC, and the cybersecurity community at large, are an ongoing endeavor.

Our detection content is supported by investigation runbooks, ensuring our SOC (Security Operations Center) analysts respond rapidly to any intrusion attempts related to known malware Tactics, Techniques, and Procedures. In addition, TRU closely monitors the threat landscape and constantly addresses capability gaps and conducts retroactive threat hunts to assess customer impact.

Recommendations from TRU to Protect Your Organization from This Cyber Threat

As the adversarial TTPs grow in sophistication, they lead to a certain level of difficulties at which critical business decisions must be made. Preventing the various attack paths utilized by the modern threat actor requires actively monitoring the threat landscape, developing, and deploying endpoint detection, and the ability to investigate logs & network data during active intrusions.  

Initial Access

Initial Access for ransomware operations is typically achieved using valid VPN and Active Directory (AD) user credentials, which are stolen using phishing emails, infostealer malware, social engineering tactics, and remote exploitation. Social engineering may occur through phishing and business email compromise (BEC) attempts and SEO poisoning. Remote exploitation occurs on the organizations’ Internet-facing systems when those systems are vulnerable. To increase your cyber resilience against Initial Access attempts, we recommend:

• Endpoint Monitoring: Deploy an Endpoint Detection and Response solution for 24/7 endpoint monitoring to workstations, ensure the endpoints leverage rules around User Execution and Windows Proxy Execution.
• Cybersecurity Awareness Training: Ensure your employees understand the dangers of phishing emails and business email compromise (BEC) attacks and malicious web browser downloads through Phishing and Security Awareness Training (PSAT). Your IT cybersecurity team should have a reporting process in place that does not punish users in case they accidentally click on a malicious link as punishing users discourages reporting.
• Email Filtering Appliances: Email filtering appliances can detect and stop spam mail.
• Network Monitoring: Automatically block known malicious infrastructure and investigate suspicious packet behavior using a Network Detection and Response solution to help disrupt cyberattacks before they lead to infections.
• Vulnerability Management: Adopt a comprehensive vulnerability management program so you have an updated inventory for all your assets, identify existing vulnerabilities and which ones can be exploited, and prioritize them based on the threat landscape. Different vulnerabilities have a different probability of being exploited with varying degrees of consequences. Knowing the types of vulnerabilities and the state of exploit maturity among threat actors can help prioritize patch management. In addition, you must consider misconfigurations since misconfiguring an Internet-facing device can sometimes have the same consequences of a vulnerability.

Lateral Movement

It’s important to understand that you can’t assume that every Initial Access vector can be stopped. Given sufficient time and size of organization, some fraction of employees will inevitably download and execute malware and give their credentials to phishing campaigns, resulting in threat actors gaining access and moving laterally across your environment. Some administrators will miss a patch or misconfiguration because there can be many patches to prioritize at different times in the year as the cybercrime seasons change. Therefore, we recommend:

• Endpoint Monitoring: Ensure endpoint coverage is extended to domain controllers, email servers, and other internal systems with increased privileges where threat actors will attempt to pivot to. Ensure some endpoint monitoring around administrative commands pertaining to credential access, environment discovery, and lateral movement.
• Log Monitoring: Ensure security logs are collected for workstations, servers, and domain controllers. Hands-on ransomware intruders will sometimes register their own VM in the VPN pool. These attackers become hard to trace without AD log files. Logs from privileged network appliances, like IIS, Citrix, and Exchange can sometimes be the only source of telemetry for how those appliances are abused by active intruders.

Impact

Impact happens when the ransomware operation is successful. There are various levels and markers of success, from exfiltration to disrupting business directly through ransomware. Therefore, we recommend:

• Endpoint Monitoring: Ensure there are endpoint rules around finding and deleting backups, credential access, and exfiltration.
• Network Monitoring: Flow data can help investigate details about exfiltration, such as how much data was sent or received between hostile Ips and assets.
• Incident Response: Be ready to engage a Digital Forensics and Incident Response provider so you can gain peace of mind knowing that you’re prepared for even the most advanced cyberattack.

eSentire’s Threat Response Unit (TRU) is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats.

If you are not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption.

Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. Connect with an eSentire Security Specialist.

Attack Details Appendix

1. Attempted ransomware deployment
   1. Phobos variant
2. Intrusion Actions
   1. Initial Access
      1. T1078.004 – Citrix Credentials
   2. Ingress Tool Transfer
      1. T1105 – Citrix Workspace
   3. Persistence
      1. T1505.003 – Reverse Shell via 64-bit netcat
   4. Network Discovery
      1. T1046 – netscan.exe for Network Service Discovery
      2. T1046 – sd.exe – Network Service Discovery
      3. T1135 – NS v.2.exe for Network Share Discovery
   5. Lateral Movement
      1. T1021.002 – psexec.exe
      2. T1021.001 – rdp.exe (presumed lateral)
      3. T1021 – AnyDesk
   6. Credential Theft
      1. T1110 – Local Bruteforce
      2. T1003 – mimikatz
   7. Collection (TA0009)
      1. Infostealer targets:
         1. 1. Browser passwords
         2. 2. Crypto wallets
         3. 3. E-Bay
         4. 4. PokerStars
         5. 5. Paypal
         6. 6. Neteller
         7. 7. Skrill
   8. Exfiltration
      1. T1048 – FileZilla
      2. T1048 – AnyDesk
   9. Defense Evasion
      1. T1562 – Disable Defender via Modify Registry
      2. T1548.002 – Disable UAC via Modify Registry
      3. T1562 – Disable firewall with netsh (Phobos)
   10. Impact
       1. T1490 – Attepmted to delete shadow copies (backups)
       2. T1486 – Phobos Ransomware
   11. Actor Toolbox was expansive
       1. Attack Server
          1. GUI applications
             1. VNC
             2. RDP
             3. AnyDesk
          2. Netbios
          3. SMB
          4. Exposed folder full of tools and potentially exfiltrated data
       2. Command and Control Server had other servers embedded in it
          1. The servers hosted Cobalt Strike.
          2. Cobalt Strike wasn’t used in this incident.