NightEagle targets Russian companies

MITRE Techniques

• [T1078 ] Valid Accounts – Attackers used compromised valid credentials to access corporate VPNs (‘compromised valid credentials to gain access to corporate VPNs’).
• [T1133 ] External Remote Services – VPN access was used as the initial entry point into victim environments (‘gain access to corporate VPNs’).
• [T1059 ] Command and Scripting Interpreter – The backdoor delivered C2 commands and the attackers used administrative commands like netsh (‘processes C2 commands’ … ‘netsh interface portproxy add’).
• [T1014 ] Rootkit – The backdoor evaded AMSI and Windows Event Log monitoring by overwriting memory addresses in system DLLs (‘evades detection … by overwriting addresses in amsi.dll and ntdll.dll’).
• [T1190 ] Exploit Public-Facing Application – GhostContainer was associated with exploitation of Microsoft Exchange and CVE-2020-0688-related components (‘an exploit for the CVE-2020-0688 vulnerability’).
• [T1110 ] Brute Force – Not mentioned in the article.
• [T1055 ] Process Injection – The payload was injected into VIEWSTATE and launched the backdoor in memory (‘injecting a payload into it, which then launched the GhostContainer backdoor in memory’).
• [T1027 ] Obfuscated Files or Information – The attackers disguised archive and file names to resemble legitimate software (‘names … were disguised to look legitimate’ and ‘mimicking known legitimate software’).
• [T1090 ] Proxy – GhostContainer implemented proxying and socket forwarding, and rdp2tcp was used for traffic tunneling (‘implements network traffic redirection (proxying) and socket forwarding functionality’).
• [T1219 ] Remote Access Software – Microsoft dev tunnels and RDP were used to maintain remote access without exposing suspicious ports (‘expose port 3389 (RDP)’ and ‘maintain network access’).
• [T1021.001 ] Remote Desktop Protocol – The attackers leveraged RDP for lateral movement and tunnel setup (‘Once the attackers gain sufficient privileges … they leverage RDP to move laterally’).
• [T1048 ] Exfiltration Over Alternative Protocol – TCP traffic was tunneled over RDP connections using rdp2tcp (‘tunneling TCP traffic over an established RDP connection’).
• [T1021.002 ] SMB/Windows Admin Shares – Port forwarding to 445 suggests access to SMB services through redirected traffic (‘connectport=445’).
• [T1053.002 ] Scheduled Task/Job: Scheduled Task – Impacket atexec was used to create scheduled tasks (‘use the atexec utility … to create scheduled tasks’).
• [T1098 ] Account Manipulation – A local account was created and added to privileged groups (‘create a local account … and add it to the Administrators and Remote Desktop Users groups’).
• [T1003.006 ] OS Credential Dumping: DCSync – The attackers attempted to replicate AD password data to impersonate the domain controller (‘attempted to replicate the Domain-Password object … (a technique known as DCSync)’).
• [T1550.003 ] Use Alternate Authentication Material: Pass the Ticket – They requested Kerberos tickets with special flags and used long-lived tickets for legitimate access (‘use long-lived Kerberos tickets to gain legitimate access’).
• [T1484.001 ] Domain Policy Modification: Group Policy Modification – Not mentioned in the article.
• [T1210 ] Exploitation of Remote Services – CVE-2019-0708 was exploited to create accounts and move laterally (‘they exploited … CVE-2019-0708 (BlueKeep)’).
• [T1069.002 ] Permission Groups Discovery: Domain Groups – The attackers added accounts to the Administrators and Remote Desktop Users groups (‘add it to the Administrators and Remote Desktop Users groups’).
• [T1090.001 ] Proxy: Internal Proxy – The attackers used portproxy to relay traffic internally (‘netsh interface portproxy add v4tov4’).