What We Do
How We Do
Resources
Company
Partners
Get Started
Blog

Analysis of Leaked Conti Intrusion Procedures by eSentire’s Threat Response Unit (TRU)

BY eSentire Threat Response Unit (TRU)

March 18, 2022 | 12 MINS READ

Attacks/Breaches

Ransomware

Threat Intelligence

Threat Response Unit

Want to learn more on how to achieve Cyber Resilience?

TALK TO AN EXPERT

IN THIS POST

As defenders, often our only insight into an adversary’s tradecraft is gleaned through an analysis of intrusion artifacts following an incident. The recent leak of Conti and Trickbot materials offers a glimpse into how the group infiltrated and took control of networks in extortion attacks. While the leaked manual and forum are from early to mid-2021, they offer a snapshot of how the group trained and conducted their intrusions. The Conti team likely maintains similar, up-to-date manuals, and knowledge base articles.

Key Takeaways:

  • There is a heavy reliance on Offensive Security Tooling (OST) such as Cobalt Strike, Mimikatz, Powerview, and known attack techniques throughout the intrusion phases.
  • Dual-use tools such as 7zip, AnyDesk, Rclone, and living-off-the-land Windows utilities have been used to reduce exposure.
  • Tooling is augmented with using scripts to facilitate deployment and use. For example, Cobalt Strike is augmented with using known resources like C2Concealer and scripts compiled from public research.
Figure 1 Forum post recommending various penetration testing utilities.

Background

On February 27, 2022, a Twitter account named “ContiLeaks” began posting chat logs showing private communications between Conti members. These logs spanned between January 2021 and February 2022 and contained thousands of messages between alleged Conti members. Following this, the ContiLeaks account published additional chat logs from June 2020 to November 2020, an extract of a trickconti-forum, Rocketchat logs, and Trickbot and Conti software components among other materials.

Our Threat Response Unit (TRU), Journalists and researchers have dug through the chat logs and identified key players and organizational structure. The group operates like a structured organization, with team leaders and departments responsible for hiring talent, research & development, training, and conducting “penetration tests”.

Besides the chat logs, our attention was drawn to intrusion procedures in the form of manuals and knowledge base articles. Like a legitimate organization, Conti maintains reference material for ensuring work is done consistently and up to standards.

Figure 2 Excerpt from leaked Rocketchat logs making a case for a centralized knowledge base.


Two sources for intrusion procedures have been identified thus far:

"manual_teams_c"

“trickconti-forum”

Figure 3 August 2020 Rocketchat discussion about team composition and responsibilities.


Additionally, the forum is mentioned several times in leaked Rocketchat logs.

Figure 4 Rocketchat discussion for "trickconti" forum.

Breakdown by Intrusion Phase

Reconnaissance

During Reconnaissance, threat actors rely on the passive collection of information related to their target’s internal environment using public domain and reputational databases. This is achieved using open-source tooling such as Sub-Drill and penst-tools[.]com.

For active scanning, the Aquatone tool is used to visually inspect websites and servers for attack opportunities.

Initial Access

To gain initial access, the Conti group leverages techniques that include remote access services and compromised endpoints. The trickconti forum mentions various remote access services from Citrix, SonicWall, FortiGate and Pulse Secure.

To circumvent multi-factor authentication on VPNs, operators will attempt to intercept MFA codes from compromised email accounts or hijack browser sessions using tokens stolen from compromised endpoints.

Figure 5 Post from February 2021 discussing browser session hijacking.

Discovery

Once operators land on a compromised machine or access the network through VPN, their first step is to gain situational awareness using tools such as AdFind or Windows command line utilities such as net or nltest. AdFind is referenced heavily throughout leaked procedure documentation and would appear to be the preferred tool as of early 2021. As is a theme with other techniques, the tool is augmented through scripts to expedite data collection.

Figure 6 Sample output from AdFind tool.


Collected information includes active directory users, computers, Organizational Units (OUs), domain trusts and subnets. The data is written to text files and used in downstream attacks or information gathering.

The Invoke-ShareFinder module from PowerView is also mentioned as a means to enumerate network shares.

Credential Access and Privilege Escalation

The next step is to steal credentials and escalate their privileges to gain higher-level permissions into the system or network. Multiple known techniques are mentioned to fulfill this objective:

Kerberoast and AS-REP roast attacks are a known techniques for abusing weaknesses in Kerberos tickets to extract hashes for offline cracking. The Kerberos attacks are executed using either the Rubeus tool or Invoke-Kerberoast PowerShell module. Kerberoasting is mentioned several times in the procedure documents and is an early intrusion step conducted through a VPN session using a compromised account or through a compromised workstation using Cobalt Strike. Cracked keys can then facilitate privilege escalation activities.

Figure 7 Instructions for executing a Kerberoast and AS-REP Roast attack using the Rubeus tool.

Persistence & Command and Control

Once the threat actors have successfully escalated their privileges, the next priority is to maintain their foothold into the environment and controlling compromised systems to look normal and avoid detection. The trickconti forum contains instructions for establishing persistence through a mix of backdoor malware, webshells and remote access software. The most common tools mentioned in the guide include:

Targeting Administrators

This is a critical step, as not only do administrator accounts provide access to more sensitive systems, but their workstations also contain a wealth of information about the organization’s IT infrastructure. This guide appears identical to what was included in the leaked Conti playbook in August 2021.

The trickconti forum contains a page aptly called “Hunt Administrator” which describes in detail how to identify and rank administrative network users.

Figure 9 Snippet of forum post titled "Hunt Administrator"


Information about administrators is obtained using output from the AdFind tool (executed as part of initial network discovery) or using Windows utilities through a Cobalt Strike session. Example commands include:

This data is then manually inspected and validated. Operators are instructed to look for indicators such as group membership, department or job title. Results are validated by checking the account status/last logon time and LinkedIn if needed.

Figure 10 Guidance on validating active administrator accounts.
Figure 11 Sample output from net command included in the post for demonstration purposes.


Once administrator accounts are identified, PowerSploit’s Find-DomainUserLocation is used to identify systems where the account is logged in. The guide instructs operators to remotely extract files from admin workstations using impersonation tokens and either the net Windows utility or Cobalt Strike’s file browser. It clearly warns the operator against deploying a Cobalt Strike beacon directly to the system to avoid raising alarms.

Standard user directories such as OneDrive or Documents are reviewed for files of interest such as password lists. Application folders (AppData\Local and AppData\Roaming) are checked for custom configurations. Browser history and login data from Chrome, Edge and Firefox are extracted for useful information such as the location of backup and virtualization servers. Local Outlook data files are extracted for further analysis.

Exfiltration

The next step is to exfiltrate the data from the organization’s network by packaging it using compression and encryption to avoid detection. In addition to using the TOR backdoor tool, the guide mentioned two other tools:

Figure 12 Rclone instructions.

Inhibit Recovery

Destroying or encrypting backups is typically a late-stage action performed prior-to or during the encryption stage. Doing so inhibits recovery options for the victim organization, giving Conti the upper hand in negotiations. Backups can also be targeted for data theft. The trickconti forum mentions various backup solutions including:

In general, operators are instructed to identify backup software from browsing history, running processes, authentication logs, etc. Stolen credentials lists, such as hashes taken from NTDS, and account lists are checked for possible backup service accounts containing common string identifiers for a given backup solution. Once obtained, credentials for backup accounts are used to access and modify backups to inhibit recovery. For more information, see https://www.advintel.io/post/backup-removal-solutions-from-conti-ransomware-with-love.

Figure 13 Guidance on picking out account tied to backup services.


The forum also contained a post on recovering passwords from Veeam backup servers.

Figure 14 Veeam password recovery steps.


This is a known technique documented as early as 2019 in Veeam’s forums and explained in detail here. It’s likely this step is taken to obtain credentials not tied to active directory, such as other backups or infrastructure. A 2020 post on Veeam’s forums by a victim of ransomware describes a similar scenario where non-AD credentials stored in Veeam were used to access secondary backup storage devices. Advice is given to operators to disable notifications on backup servers to avoid detection:

Figure 15 Disabling notifications on backup servers.


Finally, the trickconti forum contains instructions for targeting virtualized infrastructure from VMware and Microsoft. Once administrative access is achieved to virtualization platforms, snapshots and backups are destroyed and servers are locked.

In a May 2021 post, a user describes the process for accessing vSphere and identifying backups for virtual machines by examining the license level and authentication logs from backup services:

Figure 16 vSphere instructions.
Figure 17 Additional guidance on encrypting backups tied to virtual machines.
Figure 18 Hyper-V Instructions.

How eSentire is Responding

Our Threat Response Unit combines intelligence gleaned from research, security incidents, and the external threat landscape to create actionable outcomes for our customers. We are taking a holistic response approach to combat modern ransomware by deploying countermeasures across the ransomware attack cycle using:

Our detection content is backed by investigation runbooks, ensuring our SOC cyber analysts respond rapidly to any intrusion attempt tied to known ransomware tactics, techniques, and procedures. In addition, our Threat Response Unit closely monitors the ransomware threat landscape and addresses capability gaps and conducts retroactive threat hunts to assess customer impact.

Recommendations from eSentire’s Threat Response Unit (TRU)

While the TTPs used by adversaries grow in sophistication, they lead to a limited set of choke points at which critical business decisions must be made. Intercepting the various attack paths utilized by the modern threat actor requires actively monitoring the threat landscape, developing, and deploying endpoint detection, and the ability to investigate logs & network data during active intrusions.

We recommend implementing the following controls, mapped to specific tactics leveraged by threat actors, to help secure your organization against the most impactful techniques mentioned in the leaked Conti documents:

Initial Access

Credential Access & Privilege Escalation

Compromise Administrators

Exfiltrate Data

Inhibit Recovery

If you’re not currently engaged with a Managed Detection and Response provider, we highly recommend you partner with us for security services in order to disrupt threats before they impact your business.

Want to learn more? Connect with an eSentire Security Specialist.

eSentire Unit
eSentire Threat Response Unit (TRU)

The eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your organization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7 Security Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. By providing complete visibility across your attack surface and performing global threat sweeps and proactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending your organization against known and unknown threats.

Read the Latest from eSentire