Angry Birds: Toy Ghouls’ new toys

MITRE Techniques

• [T1021.006 ] Remote Services: Windows Remote Management – The attackers used WinRM to copy and deploy the backdoors and their config files onto compromised hosts [‘the attackers use Windows Remote Management (WinRM) to deliver the backdoors and their configuration files’]
• [T1105 ] Ingress Tool Transfer – The group transferred tools and payloads to victim systems using Evil-WinRM and WinRM-fs [‘rely on open-source tools such as Evil-WinRM and WinRM-fs to do this’]
• [T1543.003 ] Create or Modify System Process: Windows Service – The backdoors can install themselves as Windows services for persistence [‘Install as a system service’; ‘Run as a Windows service (internal)’]
• [T1083 ] File and Directory Discovery – The malware looks for config.toml in multiple locations before using a manually provided path [‘looks for a config.toml configuration file in the directory where the executable was launched, then falls back to …’]
• [T1112 ] Modify Registry – Configuration is sealed using a machine-bound key and stored in registry locations in the Element version [‘written to the HKLMSoftwaresynapseConfigSealedConfig registry key’; ‘saved to the HKLMSoftwareSynapseAgentmetrics_interval registry key’]
• [T1005 ] Data from Local System – The backdoor gathers local system data such as CPU load, memory, disk, and uptime for exfiltration [‘system information, such as CPU load and available memory, is sent’]
• [T1041 ] Exfiltration Over C2 Channel – Status, metrics, and command results are sent back to the operator over the same C2 channel [‘send commands to the backdoor’; ‘Command execution results are sent to the command server’]
• [T1059.001 ] Command and Scripting Interpreter: PowerShell – Commands are executed through hidden PowerShell with noninteractive parameters [‘Commands are executed via PowerShell.exe in hidden mode, using the -NonInteractive -NoProfile -Command parameters’]
• [T1059.003 ] Command and Scripting Interpreter: Windows Command Shell – The Element version executes received commands via the Windows command line interface [‘Received commands are executed via the Windows command line interface’]
• [T1071.001 ] Application Layer Protocol: Web Protocols – The malware queries ip-api.com and uses HTTP-based POST/GET traffic for C2 interactions [‘send a GET request to http://ip-api.com/json’; ‘POST request to broker.hivemq.com:8883/…’]
• [T1071.013 ] Application Layer Protocol: MQTT – The HiveMQ version uses MQTT broker traffic for telemetry and tasking [‘uses the public HiveMQ MQTT broker (broker.hivemq.com) as its C2 server’]
• [T1219 ] Remote Access Software – The Element version leverages a legitimate collaboration platform as its C2 infrastructure [‘set up their own Element server running on the Matrix protocol, meet.element[.]tw, as the C2 server’]