What We Do
How we do it
Resources
TRU INTELLIGENCE CENTER
Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
View Threat Intelligence Resources →
SECURITY ADVISORIES
Nov 21, 2022
ProxyNotShell Exploit Released
THE THREAT eSentire is aware of public Proof-of-Concept (PoC) exploit code for the ProxyNotShell Exchange vulnerabilities (CVE-2022-41040 [CVSS:8.8], CVE-2022-41082 [CVSS:8.0]). The publication of…
Read More
View all Advisories →
Company
ABOUT ESENTIRE
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1500+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
LATEST PRESS RELEASE
Nov 07, 2022
Global Cybersecurity Leader eSentire Partners with InfoTrust to Deliver 24/7 Multi-Signal MDR and IR Services Across Australia
Waterloo, ON and Sydney, Australia – November 9, 2022 – eSentire, Inc., the Authority in Managed Detection and Response (MDR), today announced it has expanded its presence in Australia via a strategic partnership with InfoTrust. InfoTrust is a leading specialized cybersecurity provider that combines next-generation security controls, with the InfoTrust “Connective Tissue” of customer success,…
Read More
Partners
PARTNER PROGRAM
e3 Ecosystem
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Learn more
ECOSYSTEM PARTNER RESOURCES
Apply to become an e3 ecosystem partner with eSentire, the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Search
Resources
Blog — Oct 03, 2022

Russian-Speaking Attacker Exposes Their Toolbox While Attempting to Deploy the Phobos Ransomware to Community College

9 minutes read
Speak With A Security Expert Now

A Russian-speaking hacker exposed their toolbox while attempting a ransomware intrusion at a U.S. Community College. The attacker unloaded an arsenal of hacker tools including:

Since the Phobos ransomware is bought, not borrowed, this threat actor was likely acting in isolation or as part of a small independent group. Some of the custom tools and the observation of Russian language in the code observed in the incident mirrored a previous report on an unknown ransomware operation.

The threat actor used two distinct systems: a Transfer Box and a C2 Box full of intrusion tools and, presumably, exfiltrated data. The attacker’s systems were open to the internet and were scanned by various open-source tools that reported open services and exposed directories. TRU leveraged these sources to understand attacker motivation and techniques.

Key Points

  1. A Russian-speaking attacker exposed their arsenal including a Cobalt Strike instruction manual. Organizations can use this arsenal to perform gap analysis on their cybersecurity defenses.
  2. The threat actor attempted to deploy crypto-stealers, wallet-stealers, and a variant of the Phobos ransomware.
  3. The toolbox appears to also be used for exfiltration and included references to infrastructure from other schools in Argentina and some unknown infrastructure in Kenya.
  4. The threat actor attempted several intrusion actions in the cyberattack and had many defense evasion tools in their arsenal. However, these types of cyberattacks are challenging to intercept with just anti-virus tools and password policies.
  5. The eSentire Threat Response Unit (TRU) assesses with medium confidence that the threat actor was acting independently. This is notable as TRU had previously indicated a high probability of Russians engaging in ransomware attacks as the economy faltered in Russia due to the ongoing conflict between Russia and Ukraine. Ransomware and extortion are lucrative endeavours, and cybercriminals of all types incorporate it into their attacks nowadays, from independent solo actors that run the whole attack chain to ransomware gangs that have specialized and independent teams that help conduct ransomware attacks, also known as Ransomware-as-a-Service (RaaS).

Transfer Box

The threat actor used a box containing several services for lateral movement via GUI-based applications such as Remote Desktop, VNC, and AnyDesk (Figure 1). They also had the 445 and 1139 exposed, likely for SMB-based ingress of tools and exfiltration of data.

The transfer box also had a directory structure with an exposed folder containing a long list of intrusion tools and exfiltrated network data (Figure 2, exfiltrated data removed). The presumed exfiltrated data was titled with IP addresses which pointed to a university in Argentina.

Port Service
22 SSH
1139 NetBios
445 SMB
3389 RDP
5901 VNC
7070 AnyDesk

Figure 1: Transfer box services

* [AirVPN_Belgium_UDP-443.ovpn](AirVPN_Belgium_UDP-443.ovpn)
* [AirVPN_Canada_UDP-443.ovpn](AirVPN_Canada_UDP-443.ovpn)
* [AirVPN_Latvia_UDP-443.ovpn](AirVPN_Latvia_UDP-443.ovpn)
* [AirVPN_Norway_UDP-443.ovpn](AirVPN_Norway_UDP-443.ovpn)
* [any.exe](any.exe)
* [APS.exe](APS.exe)
* [CobaltStrike MANUAL_V2 .rar](CobaltStrike%20MANUAL_V2%20.rar)
* [CS Inst.txt](CS%20Inst.txt)
* [DefenderControl 2.exe](DefenderControl%202.exe)
* [disable-defender.exe](disable-defender.exe)
* [Everything.exe](Everything.exe)
* [Fast.ex_](Fast.ex_)
* [Fast.ex__](Fast.ex__)
* [gost-windows-amd64-2.11.2.zip](gost-windows-amd64-2.11.2.zip)
* [Handover.xlsx](Handover.xlsx)
[[email protected][email protected]_Sec_220704_085638.pdf](Instant_Netcat_Starter_%40C2Book_News_%40Library_Sec_220704_085638.pdf)
* [johnsuppttt987_2022-06-22_03-10.zip](johnsuppttt987_2022-06-22_03-10.zip)
* [mi.7z](mi.7z)
* [MindCert-Netcat-MindMap @Library_Sec_220704_085750.pdf](MindCert-Netcat-MindMap%20%40Library_Sec_220704_085750.pdf)
* [nc.exe](nc.exe)
* [nc.exe-master.zip](nc.exe-master.zip)
* [nc64.exe](nc64.exe)
* [netscan.exe](netscan.exe)
* [NTLM.txt](NTLM.txt)
* [OpenSSH_8.6x64 (2).exe](OpenSSH_8.6x64%20%282%29.exe)
* [OpenSSH_8.6x64.exe](OpenSSH_8.6x64.exe)
* [OpenSSH_8.6x86 (2).exe](OpenSSH_8.6x86%20%282%29.exe)
* [OpenSSH_8.6x86.exe](OpenSSH_8.6x86.exe)
* [plink.exe](plink.exe)
* [PowerTool_64.exe](PowerTool_64.exe)
* [Process Hacker 3.0.exe](Process%20Hacker%203.0.exe)
* [prochack.exe](prochack.exe)
* [prochack3/](prochack3/)
* [PROXI new (2).txt](PROXI%20new%20%282%29.txt)
* [PROXI new.txt](PROXI%20new.txt)
* [Result.xml](Result.xml)
* [RTCleaner+.bat](RTCleaner%2B.bat)
* [scan арабы.xml](scan%20%D0%B0%D1%80%D0%B0%D0%B1%D1%8B.xml)
* [scan2.xml](scan2.xml)
* [Servers_IP_summary_with passwords.xlsx](Servers_IP_summary_with%20passwords.xlsx)
* [setup_undefined.msi](setup_undefined.msi)
* [Shadow.bat](Shadow.bat)
* [skr 1.png](skr%201.png)
* [skr 2.png](skr%202.png)
* [ssh_tunnel.bat](ssh_tunnel.bat)
* [tai mis.xml](tai%20mis.xml)
* [tai.xml](tai.xml)
* [uninstallSophos.bat](uninstallSophos.bat)
* [unlocker-setup.exe](unlocker-setup.exe)

Figure 2: Transfer box used by the attacker had a library of intrusion tools and exfiltrated data (removed).

C2 Box

The threat actor used a C2 Box for maintaining a web shell to the community college´s network. The C2 Box was also a Cobalt Strike server. However, the attacker didn’t leverage Cobalt Strike’s Beacon in the attack against the community college. Interestingly, the infrastructure existed on a range known to be managed by bulletproof hosting provider that appears to still be active on hacker forums. (Figure 3).

Figure 3: Recent forum activity of an infrastructure provider

Russian Speaking Threat Actor Responsible

Some tools in the exposed toolbox and the code (Figure 4) in some of the deployed tools are in Cyrillic, which Slavic-speaking members of TRU identify as the Russian language and validated through Google Translate. A few tools overlap with tools observed in an incident reported by Security Joes.

Figure 4: Cyrillic characters in wallet stealer code

Information Targets

Information stealers deployed by the threat actor had some interesting targets including crypto-wallets, PokerStars, Ebay, Neteller, and Skrill. In addition to the deployment of ransomware, these targets point to financially motivated cybercrime.

How the eSentire Threat Response Unit (TRU) Responded to this Cyber Threat

Our Threat Response Unit (TRU) combines threat intelligence obtained from research and security incidents to create practical outcomes for our customers:

Our detection content is supported by investigation runbooks, ensuring our SOC (Security Operations Center) analysts respond rapidly to any intrusion attempts related to known malware Tactics, Techniques, and Procedures. In addition, TRU closely monitors the threat landscape and constantly addresses capability gaps and conducts retroactive threat hunts to assess customer impact.

Recommendations from TRU to Protect Your Organization from This Cyber Threat

As the adversarial TTPs grow in sophistication, they lead to a certain level of difficulties at which critical business decisions must be made. Preventing the various attack paths utilized by the modern threat actor requires actively monitoring the threat landscape, developing, and deploying endpoint detection, and the ability to investigate logs & network data during active intrusions.  

Initial Access

Initial Access for ransomware operations is typically achieved using valid VPN and Active Directory (AD) user credentials, which are stolen using phishing emails, infostealer malware, social engineering tactics, and remote exploitation. Social engineering may occur through phishing and business email compromise (BEC) attempts and SEO poisoning. Remote exploitation occurs on the organizations’ Internet-facing systems when those systems are vulnerable. To increase your cyber resilience against Initial Access attempts, we recommend:

Lateral Movement

It’s important to understand that you can’t assume that every Initial Access vector can be stopped. Given sufficient time and size of organization, some fraction of employees will inevitably download and execute malware and give their credentials to phishing campaigns, resulting in threat actors gaining access and moving laterally across your environment. Some administrators will miss a patch or misconfiguration because there can be many patches to prioritize at different times in the year as the cybercrime seasons change. Therefore, we recommend:

Impact

Impact happens when the ransomware operation is successful. There are various levels and markers of success, from exfiltration to disrupting business directly through ransomware. Therefore, we recommend:

eSentire’s Threat Response Unit (TRU) is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats.

If you are not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption.

Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. Connect with an eSentire Security Specialist.

Attack Details Appendix

  1. Attempted ransomware deployment
    1. Phobos variant
  2. Intrusion Actions
    1. Initial Access
      1. T1078.004 – Citrix Credentials
    2. Ingress Tool Transfer
      1. T1105 – Citrix Workspace
    3. Persistence
      1. T1505.003 – Reverse Shell via 64-bit netcat
    4. Network Discovery
      1. T1046 – netscan.exe for Network Service Discovery
      2. T1046 – sd.exe – Network Service Discovery
      3. T1135 – NS v.2.exe for Network Share Discovery
    5. Lateral Movement
      1. T1021.002 – psexec.exe
      2. T1021.001 – rdp.exe (presumed lateral)
      3. T1021 – AnyDesk
    6. Credential Theft
      1. T1110 – Local Bruteforce
      2. T1003 – mimikatz
    7. Collection (TA0009)
      1. Infostealer targets:
        1. 1. Browser passwords
        2. 2. Crypto wallets
        3. 3. E-Bay
        4. 4. PokerStars
        5. 5. Paypal
        6. 6. Neteller
        7. 7. Skrill
    8. Exfiltration
      1. T1048 – FileZilla
      2. T1048 – AnyDesk
    9. Defense Evasion
      1. T1562 – Disable Defender via Modify Registry
      2. T1548.002 – Disable UAC via Modify Registry
      3. T1562 – Disable firewall with netsh (Phobos)
    10. Impact
      1. T1490 – Attepmted to delete shadow copies (backups)
      2. T1486 – Phobos Ransomware
    11. Actor Toolbox was expansive
      1. Attack Server
        1. GUI applications
          1. VNC
          2. RDP
          3. AnyDesk
        2. Netbios
        3. SMB
        4. Exposed folder full of tools and potentially exfiltrated data
      2. Command and Control Server had other servers embedded in it
        1. The servers hosted Cobalt Strike.
        2. Cobalt Strike wasn’t used in this incident.
View Most Recent Blogs
eSentire Threat Response Unit (TRU)
eSentire Threat Response Unit (TRU)

Our industry-renowned Threat Response Unit (TRU) is an elite team of threat hunters and researchers, that supports our 24/7 Security Operations Centers (SOCs), builds detection models across our Atlas XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. TRU has been recognized for its threat hunting, original research and content development capabilities. TRU is strategically organized into cross-functional groups to protect you against advanced and emerging threats, allowing your organization to gain leading threat intelligence and incredible cybersecurity acumen.