CISA conducted an onsite incident response engagement from the middle of June to the middle of July 2022, during which time it discovered that the company had been compromised as early as February 2022, most likely by APT actors sponsored by the Iranian government who installed XMRig crypto mining software. The attackers compromised credentials and implanted Ngrok reverse proxies before laterally spreading to the domain controller.[\/vc_column_text][vc_custom_heading text=”Threat Actor Activity” font_container=”tag:h4|text_align:left”][vc_column_text]Attackers gained access [TA0001] to an unpatched VMware Horizon server in the company in February 2022 by exploiting Log4Shell [T1190]. CISA discovered an initial exploit that involved a 17.6-second connection to the malicious IP address 182.54.217[. ]2.<\/p>\n
The following PowerShell command [T1059.001] was executed as part of the exploit payload, which added an exclusion tool to Windows Defender [T1562.001]:[\/vc_column_text][vc_column_text]\n
I am text block. Click edit button to change this text. Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.<\/p>\n[\/vc_column_text][nectar_scrolling_text scroll_direction=”ltr” scroll_speed=”slower” style=”default” text_repeat_number=”2″ text_repeat_divider=”none” overflow=”hidden” background_image_animation=”None”]powershell try{Add-MpPreference -ExclusionPath ‘C:\\’; Write-Host ‘added-exclusion’} catch {Write-Host ‘adding-exclusion-failed’ }; powershell -enc “$BASE64 encoded payload to download next stage and execute it”[\/nectar_scrolling_text][vc_column_text]The exclusion tool allowlisted the entire\u00a0c:\\drive, enabling threat actors to download tools to the\u00a0c:\\drive\u00a0without virus scans. The exploit payload then downloaded\u00a0mdeploy.text\u00a0from\u00a0182.54.217[.]2\/mdepoy.txt\u00a0to\u00a0C:\\users\\public\\mde.ps1\u00a0[T1105]. When executed, mde.ps1 downloaded\u00a0file.zip\u00a0from\u00a0182.54.217[.]2\u00a0and removed\u00a0mde.ps1\u00a0from the disk [T1070.004<\/a>].<\/p>\n file.zip\u00a0contained XMRig cryptocurrency mining software and associated configuration files.<\/p>\n See MAR 10387061-1.v1 for additional information, including IOCs, on these four files.<\/p>\n After obtaining initial access and installing XMRig on the VMWare Horizon server, the actors used RDP [T1021.001] and the built-in Windows user account\u00a0DefaultAccount\u00a0[T1078.001] to move laterally [TA0008] to a VMware VDI-KMS host. Once the threat actor established themselves on the VDI-KMS host, CISA observed the actors download around 30 megabytes of files from\u00a0transfer[.]sh\u00a0server associated with\u00a0144.76.136[.]153. The actors downloaded the following tools:<\/p>\n The threat actors then executed Mimikatz on VDI-KMS to harvest credentials and created a rogue domain administrator account [T1136.002]. Using the newly created account, the actors leveraged RDP to propagate to several hosts within the network. Upon logging into each host, the actors manually disabled Windows Defender via the Graphical User Interface (GUI) and implanted Ngrok executables and configuration files. The threat actors were able to implant Ngrok on multiple hosts to ensure Ngrok\u2019s persistence should they lose access to a machine during a routine reboot. The actors were able to proxy [T1090] RDP sessions, which were only observable on the local network as outgoing HTTPS port 443 connections to\u00a0tunnel.us.ngrok[.]com\u00a0and\u00a0korgn.su.lennut[.]com\u00a0(the prior domain in reverse). It is possible, but was not observed, that the threat actors configured a custom domain, or used other Ngrok tunnel domains, wildcarded here as\u00a0*.ngrok[.]com,\u00a0*.ngrok[.]io,\u00a0ngrok.*.tunnel[.]com, or\u00a0korgn.*.lennut[.]com.<\/p>\n Once the threat actors established a deep foothold in the network and moved laterally to the domain controller, they executed the following PowerShell command on the Active Directory to obtain a list of all machines attached to the domain [T1018]:<\/p>\n Powershell.exe get-adcomputer -filter * -properties * | select name,operatingsystem,ipv4address ><\/p>\n The threat actors also changed the password for the local administrator account [T1098] on several hosts as a backup should the rogue domain administrator account get detected and terminated. Additionally, the threat actor was observed attempting to dump the Local Security Authority Subsystem Service (LSASS) process [T1003.001] with task manager but this was stopped by additional anti-virus the FCEB organization had installed.[\/vc_column_text][heading]\n\n
\n
MITRE ATT&CK TACTICS AND TECHNIQUES<\/h2>\n[\/heading][vc_column_text]\n