APT37 Adds New Capabilities for Air-Gapped Networks

MITRE Techniques

• [T1204.001 ] User Execution: Malicious Link – The infection chain is initiated when the victim launches a malicious LNK file. (‘The infection chain is initiated when the victim launches the malicious LNK file.’)
• [T1059.001 ] Command and Scripting Interpreter: PowerShell – The LNK file launches a PowerShell script to continue the infection and carve embedded payloads. (‘The LNK file silently launches a PowerShell command line script to continue the infection.’)
• [T1053.005 ] Scheduled Task/Job: Scheduled Task – SNAKEDROPPER creates a scheduled task named rubyupdatecheck to execute the disguised Ruby interpreter every 5 minutes. (‘SNAKEDROPPER creates a scheduled task named rubyupdatecheck to execute the disguised Ruby interpreter every 5 minutes.’)
• [T1574 ] Hijack Execution Flow – SNAKEDROPPER replaces operating_system.rb (auto-loaded by RubyGems) to ensure the malicious code executes when the Ruby interpreter starts. (‘SNAKEDROPPER replaces operating_system.rb, a Ruby file automatically loaded by RubyGems, to ensure its payload executes every time the Ruby interpreter starts.’)
• [T1027 ] Obfuscated Files or Information – Payloads are embedded within the LNK and decrypted with a 1-byte XOR key to evade detection. (‘Payloads are embedded and carved from fixed offsets within the LNK file, and the shellcode is 1-byte XOR decrypted.’)
• [T1055 ] Process Injection – RESTLEAF allocates executable memory and injects downloaded shellcode into a process to execute payloads. (‘RESTLEAF allocates executable memory, copies the downloaded payload into this region, and transfers execution to the entry point of the shellcode.’)
• [T1620 ] Reflective Code Loading – The second-stage shellcode reflectively loads an embedded Windows executable payload after decryption. (‘The decrypted second-stage shellcode reflectively loads an embedded Windows executable payload.’)
• [T1036.005 ] Masquerading: Match Legitimate Name or Location – The Ruby interpreter rubyw.exe is renamed to usbspeed.exe to masquerade as a USB utility and VIRUSTASK replaces victim files with shortcuts of the same name. (‘The Ruby interpreter (rubyw.exe) is renamed to usbspeed.exe to masquerade as a legitimate USB speed monitoring utility. VIRUSTASK replaces the victim’s files with malicious shortcuts of the same name.’)
• [T1564.001 ] Hide Artifacts: Hidden Files and Directories – VIRUSTASK and THUMBSBD create hidden $RECYCLE.BIN-like folders on removable media to conceal staged artifacts. (‘VIRUSTASK creates a hidden folder named $RECYCLE.BIN.USER on removable media. THUMBSBD uses a hidden $RECYCLE.BIN directory.’)
• [T1082 ] System Information Discovery – THUMBSBD collects detailed host environment information (user, computer, OS, diagnostics). (‘THUMBSBD initializes a configuration file … containing information about the victim’s environment (e.g., user name, computer name, Windows version…).’)
• [T1057 ] Process Discovery – THUMBSBD enumerates running processes via Windows APIs as part of reconnaissance. (‘THUMBSBD collects running processes via Windows API.’)
• [T1083 ] File and Directory Discovery – THUMBSBD performs recursive file-system enumeration to stage data for exfiltration. (‘THUMBSBD performs recursive file system enumeration.’)
• [T1132.002 ] Data Encoding: Non-Standard Encoding – FOOTWINE uses XOR and custom padding to encode keys and payloads in its key-exchange and communications. (‘FOOTWINE generates a 32-byte random key… obfuscates the transmitted packet size… and uses XOR-based validation.’)
• [T1092 ] Communication Through Removable Media – VIRUSTASK uses removable media propagation to spread malware to air-gapped systems. (‘VIRUSTASK is a removable media propagation component designed to spread malware by infecting removable media.’)
• [T1052.001 ] Exfiltration Over Physical Medium: Exfiltration over USB – THUMBSBD uses removable media as a covert C2 and exfiltration channel between segmented networks. (‘THUMBSBD uses removable media as a covert C2 channel to exfiltrate data from and send commands to air-gapped systems.’)
• [T1567.002 ] Exfiltration Over Web Service: Exfiltration to Cloud Storage – BLUELIGHT and other components use cloud providers for C2 and data exfiltration. (‘BLUELIGHT uploads collected data and a specific file to the cloud storage C2.’)
• [T1056.001 ] Input Capture: Keylogging – FOOTWINE supports keystroke capture and THUMBSBD stages collected data for exfiltration. (‘FOOTWINE performs keylogging and THUMBSBD provides a function for data collection.’)
• [T1113 ] Screen Capture – FOOTWINE can capture screenshots on command. (‘FOOTWINE receives a dm command to take screenshots.’)
• [T1123 ] Audio Capture – FOOTWINE can perform microphone surveillance via C2 commands. (‘FOOTWINE receives a cm command to perform microphone surveillance.’)
• [T1125 ] Video Capture – FOOTWINE can perform camera/webcam surveillance via C2 commands. (‘FOOTWINE receives a cm command to perform camera/webcam surveillance.’)