Citrine Sleet (formerly DEV-0139) targeted cryptocurrency investment companies, leveraging social pretexting on Telegram and a weaponized Excel document to deliver a backdoor via DLL proxying. The campaign shows sophisticated industry knowledge, multiple delivery stages, and ties to infrastructure such as strainservice.com and OpenDrive-hosted payloads. #CitrineSleet #DEV0139 #OKX #Binance #Huobi #CryptoDashboardV2 #Wolfic
Keypoints
- The attacker profile demonstrates in-depth knowledge of the cryptocurrency industry and targeted groups on Telegram to identify victims.
- A weaponized Excel file named “OKX Binance & Huobi VIP fee comparision.xls” was used to initiate the intrusion, including a malicious macro and base64-embedded components.
- The macro drops a second XLS payload (VSDB688.tmp) and decodes a PNG that contains three executables: logagent.exe (legitimate), wsock32.dll (malicious proxy), and an XOR-encoded backdoor.
- DLL side-loading is used: logagent.exe loads the malicious wsock32.dll which proxies to the legitimate wsock32.dll to execute the backdoor.
- A related campaign uses an MSI (CryptoDashboardV2) delivering DUser.dll (HijackingLib.dll) via DLL proxying to load the final payload.
- The attackers deployed a second technique set via OpenDrive and a C2 domain (strainservice.com) with ports 80/443/2083, with C2 traffic over 443.
- Microsoft Defender/Endpoint detections map to Wolfic family indicators, and advisories provide defense-in-depth steps and hunting queries for defenders.
MITRE Techniques
- [T1591] Gather Victim Org Information – The attackers gathered information about the targets reaching them on Telegram with a clear understanding of their challenges. “The threat actor…identified their target from among the members.”
- [T1593.001] Social Media – Attackers identified the targets on specific crypto currencies group on Telegram. “Attackers identified the targets on Telegram.”
- [T1583.001] Acquire Infrastructure: Domains – Attackers registered the domain “strainservice.com” on June 18.
- [T1566.001] Initial Access – Spearphishing Attachment – Attackers sent a weaponized Excel document. “The weaponized Excel file initiates the following series of activities.”
- [T1204.002] User Execution: Malicious File – The target must open the weaponized Excel document and enable macros.
- [T1059.005] Command and Scripting Interpreter: Visual Basic – Attackers used VBA in the malicious Excel document to deliver the implant.
- [T1106] Native API – Usage of CreateProcess API in the Excel document to run the executable.
- [T1574.002] DLL side-loading – The attackers abused the legitimate Logagent.exe to side-load wsock32.dll and TPLink.exe to side-load Duser.dll.
- [T1027] Obfuscated file or information – The malicious VBA is obfuscated using UserForm to hide variable and data.
- [T1036.005] Masquerading: Match Legitimate Name or Location – The attackers use legitimate DLL names that act as DLL proxies (wsock32.dll, Duser.dll).
- [T1027.009] Obfuscated Files or Information: Embedded Payloads – The malicious DLLs drop the implant into the machine.
- [T1071.001] Application Layer Protocol: Web Protocols – The implant communicates to the remote domain through port 80 or 443.
- [T1132] Data Encoding – The implant encodes data exchanged with the C2.
- [T1041] Exfiltration over C2 channel – The implant has the ability to exfiltrate information.
Indicators of Compromise
- [File] OKX Binance & Huobi VIP fee comparision.xls – weaponized Excel file with hashes abca3253c003af67113f83df2242a7078d5224870b619489015e4fde060acad0 and 17e6189c19dedea678969e042c64de2a51dd9fba69ff521571d63fd92e48601b
- [File] VSDB688.tmp – second worksheet dropped, hash a2d3c41e6812044573a939a51a22d659ec32aea00c26c1a2fdf7466f5c7e1ee9
- [File] wsock32.dll – malicious dropper (Hash: 2e8d2525a523b0a47a22a1e9cc9219d6526840d8b819d40d24046b17db8ea3fb)
- [File] logagent.exe – legitimate Windows file used as a loader (Hash: 8400f2674892cdfff27b0dfe98a2a77673ce5e76b06438ac6110f0d768459942)
- [File] DUser.dll – malicious DLL proxy (Hash: 90b0a4c9fe8fd0084a5d50ed781c7c8908f6ade44e5654acffea922e281c6b33)
- [File] CryptoDashboardV2 MSI payloads – 4acbe3.msi and 43d972.msi; DUser.dll delivered by MSI
- [Domain] strainservice[.]com – C2 domain used by implants
- [IP] 198.54.115.248 – C2 IP
- [URL] hxxps://od.lk/d/d021d412be456a6f78a0052a1f0e3557dcfa14bf25f9d0f1d0d2d7dcdac86c73/Background.png – PNG used to fetch the payload
- [GUID] 56762eb9-411c-4842-9530-9922c46ba2da – filename for wsock32.dll and decrypt key
- [GUID] 27E57D84-4310-4825-AB22-743C78B8F3AA – filename for wsock32.dll payload