What We Do
How we do it
Resources
SECURITY ADVISORIES
Nov 22, 2021
Microsoft Exchange Vulnerability - CVE-2021-42321
THE THREAT eSentire has identified publicly available Proof-of-Concept (PoC) exploit code, for the critical Microsoft Exchange vulnerability CVE-2021-42321. CVE-2021-42321 was announced as part of Microsoft’s November Patch Tuesday release. Exploitation would allow a remote threat actor, with previous authentication, to execute code on vulnerable servers. Prior to the patch release, Microsoft…
Read More
View all Advisories →
Company
ABOUT ESENTIRE
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1000+ organizations in 70+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
LATEST PRESS RELEASE
Oct 28, 2021
Telarus and eSentire Expand Partnership to Safeguard Enterprises Globally Against Business Disrupting Ransomware and Zero-Day Attacks
London, UK and Sydney, Australia– Oct. 28, 2021 - eSentire, recognized globally as the Authority in Managed Detection and Response (MDR), today announces the expansion of its partnership with Telarus, the largest privately-held distributor of business cloud infrastructure and contact centre services. Building on their mutual success across North America, Telarus will bring eSentire’s Managed…
Read More
Partners
PARTNER PROGRAM
Partners
Our award-winning partner program offers financial rewards, sales and marketing tools and personalized training. Accelerate your business and grow your revenue by offering our world-class Managed Detection and Response (MDR) services.
Learn about our Partner Program
PARTNER RESOURCES
Apply today to partner with the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Search
Resources
Security advisories — Oct 19, 2021

Hackers Infect Employees of Law Firms, Manufacturing Companies, and Financial Services Orgs. with Increasingly Pervasive Infostealer, SolarMarker

Speak With A Security Expert Now

SolarMarker Infects 5X More Corporate Victims Using Over a Million Poisoned WordPress Pages

Key Takeaways

Introduction

In September 2021, eSentire reported an increase in SolarMarker activity. Subsequent analysis by eSentire's Threat Response Unit (TRU) showed that the campaign had expanded its distribution infrastructure more than tenfold compared to April’s analysis. SolarMarker targets many environments across verticals and sectors. At the time of this reporting, the legal industry tends to be more susceptible to the social engineering techniques which disguise the infostealer as formal documents and document templates related to the industry.

In July, Talos reported on a new variant of SolarMarker that includes an updated staging module and a new keylogging module. SolarMarker is known to employ multiple delivery operations that vary in method and infrastructure, including content delivery networks (CDNs) and attacker-controlled blogs.

Adding to these operations, the TRU has observed in recent incidents the majority of SolarMarker attacks being delivered from compromised WordPress sites—a technique previously employed by Gootloader, a JavaScript-based infection framework originally developed to deliver the Gootkit banking trojan.

Based on open-source research, it appears that this change has allowed the threat actors to drastically increase the number of malicious webpages being hosted online. When eSentire originally reported on SolarMarker, there were just over 100,000 malicious pages (Figure 1). As of September, eSentire Threat Intelligence identified over 1 million pages based on previously validated queries (Figure 2). It should be noted that a percentage of these pages could be benign.

Figure 1: April's SolarMarker analysis found just over 100,000 malicious pages

Figure 2: Using the new technique, the threat actors have vastly expanded their reach to more than 1 million pages

The dramatically higher page count seems to be delivering results for the threat actors, as the increase in the number of malicious webpages correlates with a fivefold increase in the number of SolarMarker infections observed by eSentire (Figure 3). Prior to September 2021, eSentire observed an average of 1-1.5 SolarMarker infections/week. During September and the first week of October there were approximately 4.5/5 SolarMarker infections/week.

Figure 3: The frequency of SolarMarker infections is increasing. Blue dots represent SolarMarker infections, orange line represents a rolling average of the rate of SolarMarker incidents

SolarMarker’s Evolution

There have been multiple changes to SolarMarker over the past few months, most notably to the:

Distribution Changes Expand the Attack Surface

Historically, SolarMarker has utilized Blogspot, Google Sites and CDNs to host malicious files. The threat actors embedded their blogs with large amounts of text specifically crafted to improve their search engine optimization (SEO) rankings, increasing the chances of it being discovered by users.

eSentire’s TRU recently discovered SolarMarker exploiting the Formidable Forms WordPress plugin—a previously undocumented technique for SolarMarker—to host malicious files on vulnerable websites. The malicious PDF documents hosted on compromised sites contain a download link along with multiple pages of specially crafted SEO text (Figure 4). When the user clicks on the download link, they are redirected to a .site page which then redirects the user through multiple .tk and .ml sites ultimately ending up on a fake Google Drive download page (Figure 5) where the SolarMarker binary is hosted. This redirection chain likely provides the threat actors with the ability to dynamically deliver content making it easier to push an updated payload.

Figure 4: Malicious PDF document serving SolarMarker

Figure 5: A short video capturing a victim’s experience once they download the malicious PDF serving SolarMarker

SolarMarker Authors Use MSI Files to Evade Detection from AV and Sandboxes

Analysis by the TRU confirms Morphisec’s recent report on SolarMarker’s shift to using MSI files to deliver its payload. The main motivation behind this change is to improve SolarMarker’s defense evasion, as antivirus engines and sandboxes are better equipped to analyze EXE files than MSI files. This shift, in conjunction with changes to SolarMarker’s modules, has enabled SolarMarker to go relatively undetected by antivirus engines (Figure 6).

Figure 6: As of October 5th, no antivirus engines detect the latest MSI file as malicious

While TRU has observed SolarMarker executing similar PowerShell commands as Morphisec discussed, the latest analysis shows that the threat actors behind SolarMarker have changed their PowerShell commands again. 

Figure 7: The latest PowerShell commands observed by TRU are similar to those discussed by Morphisec

SolarMarker attempts to load the Jupyter PowerShell loader from the –scriptFileparameter (Figure 7). This loader is very similar to previous version of the Jupyter loader and manages to keep a very low detection rate. It resembles the original PowerShell commands discussed by Red Canary but with an updated directory.

Figure 8: PowerShell calling malicious script files

It should be noted that this PowerShell closely resembles the original PowerShell commands discussed by Red Canary but with an updated file name and directory (Figure 8). Previously, this PowerShell command was only seen in EXE versions of the payload. However, the threat actors have updated their MSI version to include similar commands, likely to reduce the number of files written to disk.

Payload Changes Aid Evasion and Enhance Functionality

Samples observed by the TRU are consistent with recent findings by Talos, who reported on updates to SolarMarker’s modules. Noteworthy changes include an updated staging module and a new keylogging module.

In new versions of the staging module, known as Mars, we no longer see SolarMarker writing the system’s identification string to “solarmarker.dat.” Instead, it writes hundreds of files to the victim’s roaming directory in an attempt to hide the true identification file. The updated Mars module also obfuscates its C# code, further hindering analysis efforts.

Another noteworthy development is the discovery of a keylogging module, Uranus, which abuses .NET architecture to capture user’s keystrokes and relevant metadata. While SolarMarker and its modules have been heavily researched, the Uranus module has gone unreported until Talos’ article. This module has been observed being delivered from campaign infrastructure associated with older SolarMarker variants, which indicates it is not new.

eSentire’s Response

Appendix

IOCs

Observed SolarMarker Command-and-Control IP Addresses
146.70.24.173
146.70.41.157
167.88.15.115
185.236.203.153
185.244.213.64
188.241.83.61 
23.29.115.175
37.120.237.251
37.120.247.199
45.42.201.248

Observed File Hashes (MD5)
03346A959C12EC00BF849A985A297ACE
0491CD2715E86E3D4B04F34A0DB03EF1
0EC6843168902C78A4F190FDD267CCB4
209A4C5F64BEDDCE266FA4CFBD61E7FF
209a4c5f64beddce266fa4cfbd61e7ff
34FB289E9FEE64CD7D4B588F0AF35A87
544AA776689B82B0FBC89C5961282007
5B686A2891BF3FB427479D36B2391CE9
5D5228E44B74C76CA56681616F514990
8693B9CFB8B4C466AE12CCDC2FEB46CE
C4772D76029004A5512EA6E2FF3BE39B
F4DD5F920BAC97CC0DE7AEA669E64DED
F6118522893F3CD95198527D6F0282BA
F9688352A31218448F211DB4026B214B

Observed File Names
standard-lease-agreement-ontario-pdf[.]msi
Are-Goodyear-Assurance-Weatherready-Tires-Directional[.]msi
Assure-Compound-Pseudo-Din[.]msi
long-term-incentive-plan-examples[.]msi
Hotel-Management-Takeover-Checklist[.]msi
tcpa-consent-disclaimer-example[.]msi
bermex-dining-table-chairs[.]msi
letter-of-intent-sample-homeschool[.]msi
manager-evaluation-form-excel[.]msi
Automation-Testing-Ppt-Presentation[.]msi
creative-achievement-questionnaire-jordan-peterson[.]msi
Soccer-Team-Fundraising-Letter[.]msi
Sample-Written-Warning-For-Unprofessional-Behavior[.]msi
The-Handbook-Of-Sailing-Pdf[.]msi
where-to-file-a-lien-in-ontario[.]msi
constitutional-underpinnings-test-answers[.]msi
colorado-rules-of-evidence-summary-trial-guide[.]exe
uniform-guidance-corrective-action-plan-example[.]exe
town-of-oyster-bay-pool-fence-requirements[.]exe
Utility-Easement-Laws-In-Tennessee[.]exe

Observed Compromised WordPress Sites
ajedigital[.]com
barritaftl[.]com
devuloper[.]fi
eastjordanfreedomfestival[.]org
ermc[.]com
midcontinentenergyexchange[.]com
ninjacrosssystems[.]com
parksandresorts[.]rac[.]com[.]au
shout-media[.]ca
trasoft[.]net

References

  1. https://www.esentire.com/security-advisories/solarmarker-malware-activity
  2. https://www.esentire.com/security-advisories/hackers-flood-the-web-with-100-000-malicious-pages-promising-professionals-free-business-forms-but-are-delivering-malware-reports-esentire
  3. https://blog.talosintelligence.com/2021/07/threat-spotlight-solarmarker.html
  4. https://www.esentire.com/security-advisories/gootloader-hackers-poison-websites-globally
  5. https://blog.morphisec.com/new-jupyter-evasive-delivery-through-msi-installer
  6. https://www.esentire.com/blog/solarmarker-shifts-infrastructure-in-recent-drive-by-attacks
  7. https://redcanary.com/blog/yellow-cockatoo/
View Most Recent Blogs