An October 2023 intrusion used a spam campaign to deliver a forked IcedID loader, then expanded laterally to deploy ScreenConnect and Cobalt Strike beacons across the environment. The operation culminated with ALPHV ransomware on domain-joined Windows hosts, leveraging Impacket, ScreenConnect, CSharp Streamer, and Rclone for data exfiltration. #IcedID #ScreenConnect #CobaltStrike #ALPHV #Rclone
Keypoints
- Intrusion started in October 2023 via malicious email delivering a forked IcedID loader (VBS) from a spam campaign.
- Impacket wmiexec and RDP were used to install ScreenConnect on multiple systems, enabling command execution and Cobalt Strike beacon deployment.
- CSharp Streamer (CS) was deployed as a multi-function RAT to perform credential access and C2 tasks, including LSASS access and dcsync.
- A custom tool (confucius_cpp) staged data and Rclone was used to exfiltrate data to a remote server.
- ALPHV ransomware was deployed across domain controllers and backups were deleted as part of the final stage.
- Throughout the attack, attackers moved laterally via RDP, performed discovery with built-in Windows tools, and attempted multiple payload delivery methods before encryption.
MITRE Techniques
- [T1566.001] Phishing – The intrusion began with a malicious email that enticed the recipient to download a zip archive containing a Visual Basic Script (VBS). “This intrusion began in October 2023 with a malicious email that enticed the recipient to download a zip archive containing a Visual Basic Script (VBS).”
- [T1047] Windows Management Instrumentation – Impacket’s wmiexec and RDP were used to install ScreenConnect on multiple systems, enabling command execution. “They used Impacket’s wmiexec and RDP to install ScreenConnect on multiple systems, enabling them to execute various commands and deploy Cobalt Strike beacons.”
- [T1219] Remote Access Software – ScreenConnect used to access and control compromised hosts. “The threat actor used ScreenConnect on the beachhead…”
- [T1071.001] Application Layer Protocol – Cobalt Strike beacons communicated with the C2 server over HTTP/S, demonstrating web-based C2 traffic. “The beacons were dropped … and established communication with the Cobalt Strike command and control server.”
- [T1003.001] LSASS Memory – Access to LSASS for credential dumping during the intrusion. “LSASS was accessed on the host for credential access.”
- [T1003.006] DCSync – A dcsync operation was performed from the beachhead to a domain controller. “the threat actor performed a dcsync operation from the beachhead host to one of the domain controllers.”
- [T1117] Regsvr32 – The embedded DLL was loaded and executed via regsvr32 after being saved in Temp. “The DLL is saved in C:WindowsTemp370-1.dll and then executes said DLL through regsvr32.”
- [T1218.010] Regsvr32 – Regsvr32 usage to execute the DLL payload observed in the infection chain.
- [T1569.002] Service Execution – ScreenConnect persisted via an auto-start service after installation. “ScreenConnect persists across reboots with an auto-start service.”
- [T1021.001] Remote Desktop – RDP was used extensively for lateral movement between domain controllers and file servers. “RDP was used extensively during the intrusion”
- [T1059.001] PowerShell – PowerShell cradles were used to retrieve Cobalt Strike beacons, often via ScreenConnect. “PowerShell was another tool used to retrieve Cobalt Strike beacons, again with some failures, and yet again using ScreenConnect.”
- [T1560.001] Archive via Utility – The confucius_cpp tool archives data before exfiltration. “we observed … creating multiple ZIP archives.”
- [T1040] Network Sniffing/Discovery – Network discovery and netscan were performed to map the environment. “SoftPerfect netscan” and multiple discovery commands were run.
- [T1083] File and Directory Discovery – Discovery of files and folders during exfiltration preparation. “on each selected folder, the tool will look for files based on keywords and then compress data.”
- [T1486] Data Encrypted for Impact – Final stage encrypts files with ALPHV ransomware. “Data Encrypted for Impact”
- [T1070.004] Indicator Removal: File Deletion – Backups were deleted to cover tracks before encryption. “the threat actor deleting all the backups interactively.”
Indicators of Compromise
- [IP] – C2 and exfiltration traffic to multiple IPs: 173.255.204.62, 94.232.46.27, 77.105.140.181. Example domains include jkbarmossen[.]com, evinakortu[.]com, and hofsaalos[.]com.
- [Domain] – Known C2/domains used for IcedID and Cobalt Strike activities: modalefastnow[.]com, jkbarmossen[.]com, evinakortu[.]com, hofsaalos[.]com, jerryposter[.]com, skrechelres[.]com.
- [URL] – Malicious download/test URLs observed: http[:]//85.209.11[.]48:80/download/test1.exe, http[:]//85.209.11[.]48:80/download/http64.exe, http[:]//85.209.11[.]48:80/download/csss.exe, http[:]//temp[.]sh/VSlAV/http64.exe.
- [File] – Renamed installers and payloads: toovey.exe (ScreenConnect), setup.exe, BNUfUOmFT2.exe (ALPHV), cslite.exe (CSharp Streamer), confucius_cpp.exe, rclone.exe, http64.dll, http64.dll (various variants).
- [Port] – SSH exfiltration port observed: port 22 to exfil server 217.23.12.8. “Exfiltration Server data: 217.23.12.8, Port 22.”