Combine cutting-edge XDR technology, multi-signal threat intelligence and 24/7 Elite Threat Hunters to help you build a world-class security operation.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Cyber risk and advisory programs that identify security gaps and build security strategies to address them.
XDR with machine learning that eliminates noise, enables real-time detection and response, and automatically blocks threats.
24/7 SOC-as-a-Service with unlimited threat hunting and incident handling.
Proactive threat intelligence, original threat research and a world-class team of seasoned industry veterans.
Extend your team capabilities and prevent business disruption with expertise from eSentire.
Stop ransomware before it spreads.
Meet regulatory compliance mandates.
Detect and respond to zero-day exploits.
End misconfigurations and policy violations.
Defend third-party and supply chain risk.
Prevent disruption by outsourcing MDR.
Adopt a risk-based security approach.
Meet insurability requirements with MDR.
Protect your most sensitive data.
Defend brute force attacks, active intrusions and unauthorized scans.
Guard endpoints by isolating and remediating threats to prevent lateral spread.
Investigation and threat detection across multi-cloud or hybrid environments.
Remediate misconfigurations, vulnerabilities and policy violations.
Defend brute force attacks, active intrusions and unauthorized scans.
THE THREAT On February 20th, ConnectWise confirmed that two recently disclosed ScreenConnect vulnerabilities are now under active exploitation. The vulnerabilities are currently tracked as…Feb 09, 2024
THE THREAT On February 7th, CISA, NSA, FBI, along with Five Eyes intelligence partners, published a joint advisory related to state-sponsored threat actors from the People’s Republic of…
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Waterloo, ON–February 7, 2024 – eSentire, Inc., the Authority in Managed Detection and Response (MDR), today announced that three of Australia’s top Value-Added Resellers (VARs): Advance Vision Technology, Exigo Tech, and Rubicon 8 have joined eSentire’s CRN 5-Star e3 partner…
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
We believe a multi-signal approach is paramount to protecting your complete attack surface. See why eSentire MDR means multi-signal telemetry and complete response.
See how our 24/7 SOC Cyber Analysts and Elite Threat Hunters stop even the most advanced cyberattacks before they disrupt your business.
Choose the right mix of Managed Detection and Response, Exposure Management, and Incident Response services to strengthen your cyber resilience.
Try our interactive tools including the MITRE ATT&CK Tool, the SOC Pricing Calculator, the Cybersecurity Maturity Assessment, and our MDR ROI Calculator.
Read the latest security advisories, blogs, reports, industry publications and webinars published by eSentire's Threat Response Unit (TRU).
See why 2000+ organizations count on eSentire to build resilience and prevent business disruption.
SolarMarker Infects 5X More Corporate Victims Using Over a Million Poisoned WordPress Pages
In September 2021, eSentire reported an increase in SolarMarker activity. Subsequent analysis by eSentire's Threat Response Unit (TRU) showed that the campaign had expanded its distribution infrastructure more than tenfold compared to April’s analysis. SolarMarker targets many environments across verticals and sectors. At the time of this reporting, the legal industry tends to be more susceptible to the social engineering techniques which disguise the infostealer as formal documents and document templates related to the industry.
In July, Talos reported on a new variant of SolarMarker that includes an updated staging module and a new keylogging module. SolarMarker is known to employ multiple delivery operations that vary in method and infrastructure, including content delivery networks (CDNs) and attacker-controlled blogs.
Based on open-source research, it appears that this change has allowed the threat actors to drastically increase the number of malicious webpages being hosted online. When eSentire originally reported on SolarMarker, there were just over 100,000 malicious pages (Figure 1). As of September, eSentire Threat Intelligence identified over 1 million pages based on previously validated queries (Figure 2). It should be noted that a percentage of these pages could be benign.
Figure 1: April's SolarMarker analysis found just over 100,000 malicious pages
Figure 2: Using the new technique, the threat actors have vastly expanded their reach to more than 1 million pages
The dramatically higher page count seems to be delivering results for the threat actors, as the increase in the number of malicious webpages correlates with a fivefold increase in the number of SolarMarker infections observed by eSentire (Figure 3). Prior to September 2021, eSentire observed an average of 1-1.5 SolarMarker infections/week. During September and the first week of October there were approximately 4.5/5 SolarMarker infections/week.
Figure 3: The frequency of SolarMarker infections is increasing. Blue dots represent SolarMarker infections, orange line represents a rolling average of the rate of SolarMarker incidents
There have been multiple changes to SolarMarker over the past few months, most notably to the:
Historically, SolarMarker has utilized Blogspot, Google Sites and CDNs to host malicious files. The threat actors embedded their blogs with large amounts of text specifically crafted to improve their search engine optimization (SEO) rankings, increasing the chances of it being discovered by users.
eSentire’s TRU recently discovered SolarMarker exploiting the Formidable Forms WordPress plugin—a previously undocumented technique for SolarMarker—to host malicious files on vulnerable websites. The malicious PDF documents hosted on compromised sites contain a download link along with multiple pages of specially crafted SEO text (Figure 4). When the user clicks on the download link, they are redirected to a .site page which then redirects the user through multiple .tk and .ml sites ultimately ending up on a fake Google Drive download page (Figure 5) where the SolarMarker binary is hosted. This redirection chain likely provides the threat actors with the ability to dynamically deliver content making it easier to push an updated payload.
Figure 4: Malicious PDF document serving SolarMarker
Figure 5: A short video capturing a victim’s experience once they download the malicious PDF serving SolarMarker
Analysis by the TRU confirms Morphisec’s recent report on SolarMarker’s shift to using MSI files to deliver its payload. The main motivation behind this change is to improve SolarMarker’s defense evasion, as antivirus engines and sandboxes are better equipped to analyze EXE files than MSI files. This shift, in conjunction with changes to SolarMarker’s modules, has enabled SolarMarker to go relatively undetected by antivirus engines (Figure 6).
Figure 6: As of October 5th, no antivirus engines detect the latest MSI file as malicious
While TRU has observed SolarMarker executing similar PowerShell commands as Morphisec discussed, the latest analysis shows that the threat actors behind SolarMarker have changed their PowerShell commands again.
Figure 7: The latest PowerShell commands observed by TRU are similar to those discussed by Morphisec
SolarMarker attempts to load the Jupyter PowerShell loader from the –scriptFileparameter (Figure 7). This loader is very similar to previous version of the Jupyter loader and manages to keep a very low detection rate. It resembles the original PowerShell commands discussed by Red Canary but with an updated directory.
Figure 8: PowerShell calling malicious script files
It should be noted that this PowerShell closely resembles the original PowerShell commands discussed by Red Canary but with an updated file name and directory (Figure 8). Previously, this PowerShell command was only seen in EXE versions of the payload. However, the threat actors have updated their MSI version to include similar commands, likely to reduce the number of files written to disk.
Samples observed by the TRU are consistent with recent findings by Talos, who reported on updates to SolarMarker’s modules. Noteworthy changes include an updated staging module and a new keylogging module.
In new versions of the staging module, known as Mars, we no longer see SolarMarker writing the system’s identification string to “solarmarker.dat.” Instead, it writes hundreds of files to the victim’s roaming directory in an attempt to hide the true identification file. The updated Mars module also obfuscates its C# code, further hindering analysis efforts.
Another noteworthy development is the discovery of a keylogging module, Uranus, which abuses .NET architecture to capture user’s keystrokes and relevant metadata. While SolarMarker and its modules have been heavily researched, the Uranus module has gone unreported until Talos’ article. This module has been observed being delivered from campaign infrastructure associated with older SolarMarker variants, which indicates it is not new.
Observed SolarMarker Command-and-Control IP Addresses
Observed File Hashes (MD5)
Observed File Names
Observed Compromised WordPress Sites