Secureworks CTU researchers analyzed COBALT MIRAGE’s ransomware operations in the United States, spotting two intrusion clusters: Cluster A uses BitLocker/DiskCryptor for opportunistic ransomware, while Cluster B pursues targeted intrusions with some ransomware experimentation. The campaign involved ProxyShell exploitation, web shells, FRPC-based C2 tunnels, LSASS dumps, RDP with a DefaultAccount, and mass scanning, underscoring a financially motivated operation that tests ransomware capabilities.
#COBALT_MIRAGE #ProxyShell
#COBALT_MIRAGE #ProxyShell
Keypoints
- Two COBALT MIRAGE intrusion clusters identified: Cluster A (ransomware with BitLocker/DiskCryptor) and Cluster B (targeted intrusions with some ransomware experiments).
- Initial access achieved via scan-and-exploit activity, including Fortinet FortiOS vulnerabilities in 2021 and a broad ProxyShell campaign to deploy remote-access tooling.
- Use of web shells and a custom Go binary (dllhost.exe) that incorporates FRP for C2, with scheduled tasks (Wininet.xml) and a DLL-based execution flow.
- Credential access and lateral movement set in motion via LSASS dumps, RDP logins using DefaultAccount, and environment enumeration with netscan tools.
- Ransomware activity in Cluster A encrypts three workstations with BitLocker, and a ransom note is even sent to a local printer to notify victims.
- March 2022 intrusion into a U.S. local government network involved VMware Horizon exploits and cryptominer activity, with FRPC and other COBALT MIRAGE tooling observed in the campaign.
- Indicators of Compromise (Domains, IPs, filenames, and hashes) are documented and used to guide mitigation and monitoring efforts.
MITRE Techniques
- [T1190] Exploit Public-Facing Application – Used Fortinet FortiOS vulnerabilities (CVE-2018-13379, CVE-2020-12812, CVE-2019-5591) and ProxyShell to compromise targets. “scanned ports 4443, 8443, and 10443 for devices vulnerable to Fortinet FortiOS vulnerabilities …” and later targeted Exchange servers via ProxyShell.
- [T1090] Proxy – FRPC-based remote access and tunneling to C2 servers. “FRPC is routinely deployed by COBALT MIRAGE” and the binary establishes a tunnel to the defined C2 servers. …”establish a tunnel to the defined command and control (C2) servers.”
- [T1021.001] Remote Desktop Protocol – Lateral movement and hands-on access via RDP using a DefaultAccount. “The threat actors then used Remote Desktop Protocol (RDP) and a built-in user account (DefaultAccount) to log onto the compromised Exchange server.”
- [T1059.001] PowerShell – Use of PowerShell commands and a pwsh.exe variant. “There are two versions of the same PowerShell command. One version uses an older PowerShell binary filename. The other uses the pwsh.exe filename implemented in PowerShell Core 6.0.”
- [T1003.001] LSASS – Credential access via LSASS dump to derive credentials after initial access. “LSASS dump soon after dllhost.exe executed its commands.”
- [T1136] Create Account – Privilege escalation and persistence by adding a new user and adding it to groups. “creates a ‘MSSQL’ user account on the compromised system with password … and adds it to the administrators and Remote Desktop Users groups.”
- [T1567.002] Exfiltration to Cloud Storage – Data exfiltration via cloud/file-sharing services. “Logs indicate that one or more of these sites may have been used to exfiltrate data from the environment.”
Indicators of Compromise
- [Domain name] COBALT MIRAGE infrastructure context – newdesk.top, onedriver-srv.ml, and other items
- [IP address] COBALT MIRAGE domains hosted – 107.173.231.114, 198.12.65.175
- [Filename] COBALT MIRAGE artifacts – dllhost.exe, wininet.xml, wininet.bat
- [MD5 hash] COBALT MIRAGE script that runs dllhost.exe – 5f098b55f94f5a448ca28904a57c0e58, 0f8b592126cc2be0e9967d21c40806bc
- [SHA1 hash] COBALT MIRAGE script that runs dllhost.exe – 27102b416ef5df186bd8b35190c2a4cc4e2fbf37, 3da45558d8098eb41ed7db5115af5a2c61c543af
- [SHA256 hash] COBALT MIRAGE script that runs dllhost.exe – 724d54971c0bba8ff32aeb6044d3b3fd571b13a4c19cada015ea4bcab30cae26, 668ec78916bab79e707dc99fdecfa10f3c87ee36d4dee6e3502d1f5663a428a0
- [Email Address] Used to register COBALT MIRAGE domains – [email protected], [email protected]
Read more: https://www.secureworks.com/blog/cobalt-mirage-conducts-ransomware-operations-in-us