SLOW#TEMPEST is a covert campaign targeting Chinese-speaking users with Cobalt Strike payloads delivered via phishing emails. The attackers moved laterally, persisted for over two weeks, and used techniques like DLL hijacking and credential harvesting to remain undetected. hashtags: #SLOWTEMPEST #CobaltStrike #Mimikatz #DLLHijacking #BloodHound #Phishing #RDP
Keypoints
- The campaign targets Chinese-speaking users with malicious ZIP files distributing Cobalt Strike implants.
- Initial infection proceeds via a shortcut file inside a ZIP archive, sometimes password-protected.
- DLL hijacking is used to execute malicious code while masquerading as legitimate system processes (LicensingUI.exe).
- Privilege escalation and persistence are achieved by modifying the Guest account and creating scheduled tasks and services.
- BloodHound is deployed for Active Directory reconnaissance to map domain relationships.
- Credential harvesting uses Mimikatz and sharpdecryptpwd.exe, with lateral movement via RDP and pass-the-hash attempts.
- Exfiltration and C2 communications leverage obfuscated traffic and tunneling through internal and China-hosted infrastructure.
MITRE Techniques
- [T1566.001] Phishing: Spearphishing Attachment – ZIP files (sometimes password-protected) distributed via unsolicited emails to deliver the LNK payload. “ZIP files (which were sometimes password-protected), were distributed via unsolicited emails.”
- [T1078.001] Valid Accounts: Default Accounts – Privilege escalation by manipulating the Guest account to gain admin access. “The Guest account … added to the critical administrative group and assigning it a new password.”
- [T1560] Archive Collected Data – BloodHound data collected and zipped into BloodHound.zip. “The data collected by BloodHound was then compiled into several .json files … These files were subsequently compressed into a BloodHound.zip archive.”
- [T1132] Data Encoding – Cobalt Strike beacon uses obfuscated network traffic per Malleable_C2_Instructions. “The beacon uses obfuscated network traffic described by the ‘Malleable_C2_Instructions’ …”
- [T1003] OS Credential Dumping – Mimikatz used for credential dumping during lateral movement. “Windows credential dumping utility Mimikatz being used from the Cobalt Strike process ‘lld.exe’.”
- [T1555] Credentials from Password Stores – Sharpdecryptpwd.exe dumps cached credentials from browsers and apps. “sharpdecryptpwd.exe: A command-line based utility that collects and dumps cached credentials…”
- [T1574.001] Hijack Execution Flow: DLL Search Order Hijacking – DLL sideloading of dui70.dll via a renamed UI.exe. “The DLL sideloading … technique involving LicensignUI.exe appears to be unreported.”
- [T1620] Reflective Code Loading – Shellcode loaded/executed by lld.exe. “shellcode to be executed by lld.exe.”
- [T1033] System Owner/User Discovery – BloodHound mapping of AD users/computers. “BloodHound … collect data on users, computers, groups…”
- [T1057] Process Discovery – Observed process chain with runonce.exe as a staging/run process. “The Cobalt Strike implant is programmed to inject itself into the Windows binary ‘runonce.exe’.”
- [T1069] Permission Groups Discovery: Domain Groups – BloodHound data includes domain groups. “information on users, computers, groups, organizational units”…
- [T1082] System Information Discovery – System information queries during enumeration. “System information discovery” content.
- [T1059.001] Command and Scripting Interpreter: PowerShell – Multiple interpreters used during execution. “PowerShell” listed in the techniques.
- [T1059.003] Command and Scripting Interpreter: Windows Command Shell – Windows Command Shell usage observed. “Windows Command Shell” in the techniques.
- [T1059.006] Command and Scripting Interpreter: Python – Python usage for scripting actions. “Python” in the techniques.
- [T1569.002] System Services: Service Execution – Creation of a Windows service (windowsinspectionupdate) to run lld.exe. “sc create ‘windowsinspectionupdate’ …”
- [T1204.001] User Execution: Malicious Link – LNK file acts as a lure to execute payload. “a shortcut (.lnk) file contained within a compressed archive (.zip) file.”
- [T1204.002] User Execution: Malicious File – Malicious files executed by user action. “LNK file … executed”
- [T1021.001] Remote Services: Remote Desktop Protocol – Lateral movement via RDP to other systems. “a successful RDP connection … to another domain-joined server.”
- [T1550.002] Use Alternate Authentication Material: Pass the Hash – Hash-based authentication attempts during lateral movement. “pass the hash as one of the captured users and hash combinations.”
- [T1053] Scheduled Task/Job – Persistence via scheduled tasks (windowsinspectionupdate). “T1053: Scheduled Task/Job”
- [T1041] Exfiltration Over C2 Channel – Data exfiltration through C2 communications. “Exfiltration over C2 channel” content.
Indicators of Compromise
- [IP Address] context – 123.207.74.22, 49.235.152.72, and other C2 IPs (as observed in Appendix A)
- [Domain] context – myip.ipip.net, 360-1305242994.cos.ap-nanjing.myqcloud.com
- [File Hash] context – 8e77101d3f615a58b8d759e8b82ca3dffd4823b9f72dc5c6989bb4311bdffa86, 3a9b64a61f6373ee427f27726460e7047b21ddcfd1d0d45ee4145192327a0408
- [File Name] context – Archive.zip (renamed), dui70.dll
- [File Name] context – gogo_windows_amd64.exe, iox.exe, LLD.exe, netspy.exe, PVEFindADUser.exe, fpr.exe, sharpdecryptpwd.exe, tmp.log, sa64.gif
Read more: https://www.securonix.com/blog/from-cobalt-strike-to-mimikatz-slowtempest/