Pirated Windows OS Backdoored with CryptoMiner and Xtreme RAT

Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.

We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.

Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.

In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.

Here’s the latest from our TRU Team…

What did we find?

• Xtreme RAT and Cryptominer have been delivered in pirated Windows operating system software.
• Several malicious Windows services on the system were responsible for modifying system permissions, disabling Windows Defender, and retrieving payloads from msz[.]su.
  • This behavior is identical to what was described by Minerva Labs in mid-2021.
• Xtreme RAT gains persistence on the host by service creations. We have observed the following service names used:
  • Registration for device management
  • Previous Versions Library
• TRU had observed several instances of this threat dating from late 2021 to early 2022. In these instances, our MDR for Endpoint service was deployed to systems suspected of operating pirated versions of Microsoft’s Windows operating system.

How did we find it?

• BlueSteel, our machine learning engine that automates malicious PowerShell detections, identified PowerShell activity associated with the malware’s persistence mechanism.

What did we do?

• Our team of 24/7 Cyber SOC Analysts investigated and contained the threat rapidly on the customer’s behalf.
• The SOC alerted the customer’s team about the malicious endpoint activity and provided recommendations on next steps for remediation and further forensic investigation in follow-up communications.

What can you learn from this TRU positive?

• The backdoored OS contains the necessary tools to monetize infected systems.
• Cryptominer, RAT, and adware all provide various means to monetize infected systems through abuse of system resources, fraud, advertisements, etc.
• The infection scheme and malware deployed aren’t overly sophisticated; it’s likely the threat actors are focused on poorly secured personal devices that can quietly generate revenue over time.

Recommendations from our Threat Response Unit (TRU) Team:

Protecting against these threats requires a multi-layered defense approach to defend endpoints from malware and detect or block unauthorized login activity against applications and remote access services. Therefore, we recommend:

• Always using trusted sources for downloading and acquiring software.
• Protecting endpoints against malware:
  • Ensure antivirus signatures are up to date.
  • Use a Next-Gen AV (NGAV) or an Endpoint Detection and Response (EDR) tool to detect and contain threats.
  • Limit or disable macros across the organization. See UK's National Cyber Centre guidance on Macro Security.
• Establishing a strong password policy that includes rotating passwords every 60-90 days, using password managers, and checking for unusual connections/logons through the corporate VPN or Remote Desktop.
  • Using Multi-Factor Authentication (MFA) services may reduce the impact of stolen credentials, but solely relying on MFA isn’t enough to deter threat actors from gaining access to your environment.
  • Adopt a defense-in-depth strategy that includes identity-based threat detection and response to allow your team to minimize attacker dwell time and identify insider threats that elude signature-based detections.

Ask Yourself…

• Can your employees identify websites hosting pirated software?
• Can you respond to remote access Trojans in a timely manner before it causes further damage?
• What level of visibility do you have across your endpoint and network environment, and at the identity-level, to detect malicious behavior at scale?

eSentire’s Threat Response Unit (TRU) is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats.

If you are not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption.

Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. Connect with an eSentire Security Specialist.

To learn how your organization can build cyber resilience and prevent business disruption with eSentire’s Next Level MDR, connect with an eSentire Security Specialist now.

GET STARTED

ABOUT ESENTIRE’S THREAT RESPONSE UNIT (TRU)

The eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your organization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7 Security Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. By providing complete visibility across your attack surface and performing global threat sweeps and proactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending your organization against known and unknown threats.