Cosmic Leopard’s Operation Celestial Force uses GravityRAT (Android) and HeavyLift (Windows) to target networks. A DNS deep dive by WhoisXML API expands IoCs to include domains, IPs, and emails connected to the campaign. #CosmicLeopard #GravityRAT #HeavyLift #OperationCelestialForce #CiscoTalos #WhoisXMLAPI #DNS #IoCs
Keypoints
- Cosmic Leopard’s Celestial Force relies on GravityRAT (Android) and HeavyLift (Windows) as core infection/loading components.
- Cisco Talos identified 19 IoCs (domains) associated with the operation.
- DNS-focused analysis found 3 email-connected domains, 15 malicious IPs, 35 string-connected domains, and 3,927 brand-containing domains (9 of which tied to threats).
- Newly registered domains (NRDs) appear to be preferred, with IoCs created in 2020, 2023, and 2024.
- Registrant-country patterns show Bahamas and Saint Kitts and Nevis as top contributors, with some IoCs from the U.S. and 11 with unknown registrant countries.
- WHOIS history and DNS investigations yielded 33 email addresses (1 public) and additional artifacts; full findings are available in the referenced report.
MITRE Techniques
- [T1071.001] Initial Access – Utilized newly registered domains (NRDs) to facilitate initial access to target networks. ‘Utilized newly registered domains (NRDs) to facilitate initial access to target networks.’
- [T1071] Command and Control – Employed GravityRAT and HeavyLift malware for command and control operations. ‘Employed GravityRAT and HeavyLift malware for command and control operations.’
- [T1115] Collection – Collected data from compromised networks using various malware tools. ‘Collected data from compromised networks using various malware tools.’
- [T1041] Exfiltration – Potentially exfiltrated data through the use of command and control channels established by the malware. ‘Potentially exfiltrated data through the use of command and control channels established by the malware.’
- [T1592] Reconnaissance – Conducted WHOIS lookups and DNS queries to gather information on potential targets. ‘Conducted WHOIS lookups and DNS queries to gather information on potential targets.’
Indicators of Compromise
- [Domain] IoCs related to Celestial Force – 19 domains identified; includes 3 email-connected domains, 35 string-connected domains, and 3,927 brand-containing domains (9 associated with threats)
- [IP] IoCs – 15 IP addresses identified, all malicious
- [Email] IoCs – 33 email addresses discovered (1 public)
Read more: https://circleid.com/posts/20240724-uncovering-dns-details-on-operation-celestial-force