Microsoft IR documents a five-day intrusion where BlackByte 2.0 ransomware operators moved from initial access to impact using a mix of exploits, living-off-the-land techniques, and custom tooling. Key actions included ProxyShell exploitation of Exchange, web shells, Cobalt Strike beacons, AnyDesk usage, and data encryption/exfiltration across the network. #BlackByte #ProxyShell
Keypoints
- The threat actor progressed from initial access to full impact in less than five days, disrupting operations.
- Initial access leveraged ProxyShell vulnerabilities on unpatched Exchange servers, enabling remote control and persistence.
- Persistence and defense evasion included Run Keys in the registry, a backdoor DLL, process hollowing, and vulnerable drivers.
- Cobalt Strike beacons provided C2, and AnyDesk was used for persistence and lateral movement.
-
-
MITRE Techniques
- [T1190] Exploit Public-Facing Application – Exploiting the ProxyShell vulnerabilities on unpatched Exchange Servers to gain initial access. ‘exploiting the ProxyShell vulnerabilities CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207 on unpatched Microsoft Exchange Servers.’
- [T1505.003] Web Shell – Creating web shells to obtain remote control on affected servers. ‘Create web shells to obtain remote control on affected servers.’
- [T1547.001] Registry Run Keys/Startup Folder – Using registry Run keys to execute payload at sign-in. ‘the threat actor created the following registry run keys to run a payload each time a user signs in.’
- [T1055.012] Process Hollowing – Employing process hollowing and the use of vulnerable drivers to evade defenses. ‘Process hollowing and the use of vulnerable drivers for defense evasion.’
- [T1059.003] Windows Command Shell – Execution flows and commands such as ‘cmd.exe /c ping 1.1.1.1 -n 10 > nul & Del explorer.exe /F /Q’ showing command-line usage for execution/evasion.
- [T1046] Network Service Discovery – NetScan used to perform network enumeration. ‘network discovery tool NetScan being used by the threat actor to perform network enumeration.’
- [T1018/ T1069.002] Active Directory Discovery – AdFind used for Active Directory reconnaissance. ‘execution of AdFind (SHA-256: f157090f…), an Active Directory reconnaissance tool.’
- [T1003] Credential Dumping – Mimikatz likely used to obtain credentials for privileged accounts. ‘presence of likely usage of the credential theft tool Mimikatz …’
- [T1021.001] Remote Services – RDP for lateral movement to other servers. ‘Remote Desktop Protocol (RDP) … to obtain access to other servers.’
- [T1021.006] Remote Services: PowerShell Remoting – PowerShell remoting used for lateral movement. ‘PowerShell remoting to obtain access to other servers.’
- [T1071.001] Web Protocols – Cobalt Strike beacon communicates with a C2 server over HTTP(S). ‘C2 channel: 109.206.243.59:443.’
- [T1567.002] Exfiltration to Cloud Storage – Data exfiltration to Mega NZ via Mega’s API. ‘to the MEGA NZ using the platform’s API at: hxxps://g.api.mega.co.nz’
- [T1074] Data Staged – Data staging/exfiltration activities and log file creation. ‘log files … C:ExchangeMSExchLog.log’.
- [T1486] Data Encrypted for Impact – BlackByte 2.0 encrypts files across the environment. ‘encryption across the environment’ with 8-digit key requirement.
- [T1490] Inhibit System Recovery – Modifying/destroying volume shadow copies to hinder recovery. ‘Modification of volume shadow copies … to destroy volume shadow copies.’
- [T1562.001] Impair Defenses – Disabling security tools (e.g., Defender). ‘Tamper protection … was not enabled’ and backdoor ran with Defender present.
- [T1562.004] Disable/Modify System Firewall – Modifying or disabling Windows Firewall rules. ‘cmd /c netsh advfirewall set allprofiles state off’ etc.
- [T1070.006] Timestomping – Anti-forensics: timestomping file times. ‘timestomping (sets the file time of encrypted and ReadMe file to 2000-01-01 00:00:00)’.
Indicators of Compromise
- [SHA-256] api-msvc.dll – Backdoor installed via RunKeys – 4a066569113a569a6feb8f44257ac8764ee8f2011765009fdfd82fe3f4b92d3e
- [SHA-256] sys.exe – Cobalt Strike Beacon – 5f37b85687780c089607670040dbb3da2749b91b8adc0aa411fd6280b5fa7103
- [SHA-256] rENEgOtiAtES – Vulnerable driver RtCore64.sys – 01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd
- [SHA-256] [RANDOM_NAME].exe – UPX packed PsExec (random name) – ba3ec3f445683d0d0407157fda0c26fd669c0b8cc03f21770285a20b3133098f
- [SHA-256] netscan.exe, netapp.exe – Netscan network discovery tool – 1b9badb1c646a19cdf101ac4f6fdd23bc61eaab8c9f925eb41848cea9fd0738e
- [SHA-256] AdFind.exe – Active Directory information gathering tool – f157090fd3ccd4220298c06ce8734361b724d80459592b10ac632acc624f455e
- [URL] myvisit.alteksecurity.org/t – C2 for backdoor api-msvc.dll
- [URL] temp.sh/szAyn/sys.exe – Download URL for sys.exe
- [IP Address] 109.206.243.59 – Cobalt Strike Beacon C2
- [IP Address] 185.225.73.244 – ProxyShell exploitation/origin IP
- [URL] g.api.mega.co.nz – Mega NZ API endpoint used for credential-related activity
- [File] data.txt – Obfuscated credentials used to authenticate to Mega NZ API