What We Do
How We Do
Resources
Company
Partners
Get Started
Blog

Russian-Speaking Attacker Exposes Their Toolbox While Attempting to Deploy the Phobos Ransomware to Community College

BY eSentire Threat Response Unit (TRU)

October 3, 2022 | 9 MINS READ

Attacks/Breaches

Threat Intelligence

Threat Response Unit

TRU Positive/Bulletin

Want to learn more on how to achieve Cyber Resilience?

TALK TO AN EXPERT

A Russian-speaking hacker exposed their toolbox while attempting a ransomware intrusion at a U.S. Community College. The attacker unloaded an arsenal of hacker tools including:

Since the Phobos ransomware is bought, not borrowed, this threat actor was likely acting in isolation or as part of a small independent group. Some of the custom tools and the observation of Russian language in the code observed in the incident mirrored a previous report on an unknown ransomware operation.

The threat actor used two distinct systems: a Transfer Box and a C2 Box full of intrusion tools and, presumably, exfiltrated data. The attacker’s systems were open to the internet and were scanned by various open-source tools that reported open services and exposed directories. TRU leveraged these sources to understand attacker motivation and techniques.

Key Points

  1. A Russian-speaking attacker exposed their arsenal including a Cobalt Strike instruction manual. Organizations can use this arsenal to perform gap analysis on their cybersecurity defenses.
  2. The threat actor attempted to deploy crypto-stealers, wallet-stealers, and a variant of the Phobos ransomware.
  3. The toolbox appears to also be used for exfiltration and included references to infrastructure from other schools in Argentina and some unknown infrastructure in Kenya.
  4. The threat actor attempted several intrusion actions in the cyberattack and had many defense evasion tools in their arsenal. However, these types of cyberattacks are challenging to intercept with just anti-virus tools and password policies.
  5. The eSentire Threat Response Unit (TRU) assesses with medium confidence that the threat actor was acting independently. This is notable as TRU had previously indicated a high probability of Russians engaging in ransomware attacks as the economy faltered in Russia due to the ongoing conflict between Russia and Ukraine. Ransomware and extortion are lucrative endeavours, and cybercriminals of all types incorporate it into their attacks nowadays, from independent solo actors that run the whole attack chain to ransomware gangs that have specialized and independent teams that help conduct ransomware attacks, also known as Ransomware-as-a-Service (RaaS).

Transfer Box

The threat actor used a box containing several services for lateral movement via GUI-based applications such as Remote Desktop, VNC, and AnyDesk (Figure 1). They also had the 445 and 1139 exposed, likely for SMB-based ingress of tools and exfiltration of data.

The transfer box also had a directory structure with an exposed folder containing a long list of intrusion tools and exfiltrated network data (Figure 2, exfiltrated data removed). The presumed exfiltrated data was titled with IP addresses which pointed to a university in Argentina.

Port Service
22 SSH
1139 NetBios
445 SMB
3389 RDP
5901 VNC
7070 AnyDesk

Figure 1: Transfer box services

* [AirVPN_Belgium_UDP-443.ovpn](AirVPN_Belgium_UDP-443.ovpn)
* [AirVPN_Canada_UDP-443.ovpn](AirVPN_Canada_UDP-443.ovpn)
* [AirVPN_Latvia_UDP-443.ovpn](AirVPN_Latvia_UDP-443.ovpn)
* [AirVPN_Norway_UDP-443.ovpn](AirVPN_Norway_UDP-443.ovpn)
* [any.exe](any.exe)
* [APS.exe](APS.exe)
* [CobaltStrike MANUAL_V2 .rar](CobaltStrike%20MANUAL_V2%20.rar)
* [CS Inst.txt](CS%20Inst.txt)
* [DefenderControl 2.exe](DefenderControl%202.exe)
* [disable-defender.exe](disable-defender.exe)
* [Everything.exe](Everything.exe)
* [Fast.ex_](Fast.ex_)
* [Fast.ex__](Fast.ex__)
* [gost-windows-amd64-2.11.2.zip](gost-windows-amd64-2.11.2.zip)
* [Handover.xlsx](Handover.xlsx)
[Instant_Netcat_Starter_@C2Book_News_@Library_Sec_220704_085638.pdf](Instant_Netcat_Starter_%40C2Book_News_%40Library_Sec_220704_085638.pdf)
* [johnsuppttt987_2022-06-22_03-10.zip](johnsuppttt987_2022-06-22_03-10.zip)
* [mi.7z](mi.7z)
* [MindCert-Netcat-MindMap @Library_Sec_220704_085750.pdf](MindCert-Netcat-MindMap%20%40Library_Sec_220704_085750.pdf)
* [nc.exe](nc.exe)
* [nc.exe-master.zip](nc.exe-master.zip)
* [nc64.exe](nc64.exe)
* [netscan.exe](netscan.exe)
* [NTLM.txt](NTLM.txt)
* [OpenSSH_8.6x64 (2).exe](OpenSSH_8.6x64%20%282%29.exe)
* [OpenSSH_8.6x64.exe](OpenSSH_8.6x64.exe)
* [OpenSSH_8.6x86 (2).exe](OpenSSH_8.6x86%20%282%29.exe)
* [OpenSSH_8.6x86.exe](OpenSSH_8.6x86.exe)
* [plink.exe](plink.exe)
* [PowerTool_64.exe](PowerTool_64.exe)
* [Process Hacker 3.0.exe](Process%20Hacker%203.0.exe)
* [prochack.exe](prochack.exe)
* [prochack3/](prochack3/)
* [PROXI new (2).txt](PROXI%20new%20%282%29.txt)
* [PROXI new.txt](PROXI%20new.txt)
* [Result.xml](Result.xml)
* [RTCleaner+.bat](RTCleaner%2B.bat)
* [scan арабы.xml](scan%20%D0%B0%D1%80%D0%B0%D0%B1%D1%8B.xml)
* [scan2.xml](scan2.xml)
* [Servers_IP_summary_with passwords.xlsx](Servers_IP_summary_with%20passwords.xlsx)
* [setup_undefined.msi](setup_undefined.msi)
* [Shadow.bat](Shadow.bat)
* [skr 1.png](skr%201.png)
* [skr 2.png](skr%202.png)
* [ssh_tunnel.bat](ssh_tunnel.bat)
* [tai mis.xml](tai%20mis.xml)
* [tai.xml](tai.xml)
* [uninstallSophos.bat](uninstallSophos.bat)
* [unlocker-setup.exe](unlocker-setup.exe)

Figure 2: Transfer box used by the attacker had a library of intrusion tools and exfiltrated data (removed).

C2 Box

The threat actor used a C2 Box for maintaining a web shell to the community college´s network. The C2 Box was also a Cobalt Strike server. However, the attacker didn’t leverage Cobalt Strike’s Beacon in the attack against the community college. Interestingly, the infrastructure existed on a range known to be managed by bulletproof hosting provider that appears to still be active on hacker forums. (Figure 3).

Figure 3: Recent forum activity of an infrastructure provider

Russian Speaking Threat Actor Responsible

Some tools in the exposed toolbox and the code (Figure 4) in some of the deployed tools are in Cyrillic, which Slavic-speaking members of TRU identify as the Russian language and validated through Google Translate. A few tools overlap with tools observed in an incident reported by Security Joes.

Figure 4: Cyrillic characters in wallet stealer code

Information Targets

Information stealers deployed by the threat actor had some interesting targets including crypto-wallets, PokerStars, Ebay, Neteller, and Skrill. In addition to the deployment of ransomware, these targets point to financially motivated cybercrime.

How the eSentire Threat Response Unit (TRU) Responded to this Cyber Threat

Our Threat Response Unit (TRU) combines threat intelligence obtained from research and security incidents to create practical outcomes for our customers:

Our detection content is supported by investigation runbooks, ensuring our SOC (Security Operations Center) analysts respond rapidly to any intrusion attempts related to known malware Tactics, Techniques, and Procedures. In addition, TRU closely monitors the threat landscape and constantly addresses capability gaps and conducts retroactive threat hunts to assess customer impact.

Recommendations from TRU to Protect Your Organization from This Cyber Threat

As the adversarial TTPs grow in sophistication, they lead to a certain level of difficulties at which critical business decisions must be made. Preventing the various attack paths utilized by the modern threat actor requires actively monitoring the threat landscape, developing, and deploying endpoint detection, and the ability to investigate logs & network data during active intrusions.  

Initial Access

Initial Access for ransomware operations is typically achieved using valid VPN and Active Directory (AD) user credentials, which are stolen using phishing emails, infostealer malware, social engineering tactics, and remote exploitation. Social engineering may occur through phishing and business email compromise (BEC) attempts and SEO poisoning. Remote exploitation occurs on the organizations’ Internet-facing systems when those systems are vulnerable. To increase your cyber resilience against Initial Access attempts, we recommend:

Lateral Movement

It’s important to understand that you can’t assume that every Initial Access vector can be stopped. Given sufficient time and size of organization, some fraction of employees will inevitably download and execute malware and give their credentials to phishing campaigns, resulting in threat actors gaining access and moving laterally across your environment. Some administrators will miss a patch or misconfiguration because there can be many patches to prioritize at different times in the year as the cybercrime seasons change. Therefore, we recommend:

Impact

Impact happens when the ransomware operation is successful. There are various levels and markers of success, from exfiltration to disrupting business directly through ransomware. Therefore, we recommend:

eSentire’s Threat Response Unit (TRU) is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats.

If you are not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption.

Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. Connect with an eSentire Security Specialist.

Attack Details Appendix

  1. Attempted ransomware deployment
    1. Phobos variant
  2. Intrusion Actions
    1. Initial Access
      1. T1078.004 – Citrix Credentials
    2. Ingress Tool Transfer
      1. T1105 – Citrix Workspace
    3. Persistence
      1. T1505.003 – Reverse Shell via 64-bit netcat
    4. Network Discovery
      1. T1046 – netscan.exe for Network Service Discovery
      2. T1046 – sd.exe – Network Service Discovery
      3. T1135 – NS v.2.exe for Network Share Discovery
    5. Lateral Movement
      1. T1021.002 – psexec.exe
      2. T1021.001 – rdp.exe (presumed lateral)
      3. T1021 – AnyDesk
    6. Credential Theft
      1. T1110 – Local Bruteforce
      2. T1003 – mimikatz
    7. Collection (TA0009)
      1. Infostealer targets:
        1. 1. Browser passwords
        2. 2. Crypto wallets
        3. 3. E-Bay
        4. 4. PokerStars
        5. 5. Paypal
        6. 6. Neteller
        7. 7. Skrill
    8. Exfiltration
      1. T1048 – FileZilla
      2. T1048 – AnyDesk
    9. Defense Evasion
      1. T1562 – Disable Defender via Modify Registry
      2. T1548.002 – Disable UAC via Modify Registry
      3. T1562 – Disable firewall with netsh (Phobos)
    10. Impact
      1. T1490 – Attepmted to delete shadow copies (backups)
      2. T1486 – Phobos Ransomware
    11. Actor Toolbox was expansive
      1. Attack Server
        1. GUI applications
          1. VNC
          2. RDP
          3. AnyDesk
        2. Netbios
        3. SMB
        4. Exposed folder full of tools and potentially exfiltrated data
      2. Command and Control Server had other servers embedded in it
        1. The servers hosted Cobalt Strike.
        2. Cobalt Strike wasn’t used in this incident.
eSentire Threat Response Unit (TRU)
eSentire Threat Response Unit (TRU)

The eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your organization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7 Security Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. By providing complete visibility across your attack surface and performing global threat sweeps and proactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending your organization against known and unknown threats.

Read the Latest from eSentire