Fantasy – a new Agrius wiper deployed through a supply-chain attack

MITRE Techniques

• [T1587] Develop Capabilities – Agrius builds utility tools to use during an active exploitation process. ‘Agrius builds utility tools to use during an active exploitation process.’
• [T1587.001] Develop Capabilities: Malware – Agrius builds custom malware including wipers (Fantasy) and lateral movement tools (Sandals). ‘Agrius builds custom malware including wipers (Fantasy) and lateral movement tools (Sandals).’
• [T1078.002] Valid Accounts: Domain Accounts – Agrius operators attempted to capture cached credentials and then use them for lateral movement. ‘Agrius operators attempted to capture cached credentials and then use them for lateral movement.’
• [T1078.003] Valid Accounts: Local Accounts – Agrius operators attempted to use cached credentials from local accounts to gain initial access to additional systems within an internal network. ‘Agrius operators attempted to use cached credentials from local accounts to gain initial access to additional systems within an internal network.’
• [T1059.003] Command and Scripting Interpreter: Windows Command Shell – Fantasy and Sandals both use batch files that run via the Windows command shell. ‘Fantasy and Sandals both use batch files that run via the Windows command shell.’
• [T1134] Access Token Manipulation – Fantasy uses the LookupPrivilegeValue and AdjustTokenPrivilege APIs in advapi32.dll to grant its process token the SeShutdownPrivilege to reboot Windows. ‘…grant its process token the SeShutdownPrivilege to reboot Windows.’
• [T1070.006] Indicator Removal on Host: Timestomp – Agrius operators timestomped the compilation timestamps of Fantasy and Sandals. ‘timestomped the compilation timestamps of Fantasy and Sandals.’
• [T1003] OS Credential Dumping – Agrius operators used several tools to dump OS credentials for use in lateral movement. ‘used several tools to dump OS credentials for use in lateral movement.’
• [T1135] Network Share Discovery – Agrius operators used cached credentials to check for access to other systems within an internal network. ‘used cached credentials to check for access to other systems within an internal network.’
• [T1021.002] Remote Services: SMB/Windows Admin Shares – Agrius operators used cached credentials to connect over SMB to systems within an exploited internal network. ‘connect over SMB to systems within an exploited internal network.’
• [T1570] Lateral Tool Transfer – Agrius operators used Sandals to push batch files over SMB to other systems within an internal network. ‘push batch files over SMB to other systems within an internal network.’
• [T1485] Data Destruction – The Fantasy wiper overwrites data in files and then deletes the files. ‘overwrites data in files and then deletes the files.’
• [T1561.002] Disk Wipe – Fantasy wipes the MBR of the Windows drive and attempts to wipe the OS partition. ‘wipes the MBR of the Windows drive and attempts to wipe the OS partition.’
• [T1561.001] Disk Wipe: Disk Content Wipe – Fantasy wipes all disk contents from non-Windows drives that are fixed drives. ‘wipes all disk contents from non-Windows drives that are fixed drives.’
• [T1529] System Shutdown/Reboot – Fantasy reboots the system after completing its disk and data wiping payloads. ‘reboots the system after completing its disk and data wiping payloads.’