Lazarus Group targeted Korea by exploiting the Log4j CVE-2021-44228 vulnerability on unpatched VMware Horizon to install NukeSped and related components. The operation includes NukeSped backdoors, INFOSTEALER, and Jin Miner modules, with data exfiltration and remote control capabilities using encrypted C2 communications and multiple credential/information theft tactics.
Keypoints
- The Lazarus group exploited CVE-2021-44228 (Log4j) on unpatched VMware Horizon products to deliver NukeSped targets in Korea.
- NukeSped is a backdoor that decrypts strings with DES and uses RC4 for internal data and C2 communications, with two distinct RC4 keys for strings and C2.
- It communicates with its C2 via HTTP-based requests/responses (Type 1 and Type 2) and includes a verification step masking as SSL communication.
- NukeSped can perform keylogging, screen capture, USB dump, and WebCam capture, along with various shell and file-management tasks.
- An INFOSTEALER module was added to steal browser credentials, email accounts, and recently used file names.
- The attackers also deployed Jin Miner (CoinMiner) to mine Monero, and used NukeSped to gather information for potential lateral movement.
MITRE Techniques
- [T1190] Exploit Public-Facing Application – Lazarus Group exploited CVE-2021-44228 on unpatched VMware Horizon to install NukeSped. ‘The attacker used the log4j vulnerability on VMware Horizon products that were not applied with the security patch.’
- [T1105] Ingress Tool Transfer – NukeSped downloaded from a URL: ‘hxxp://185.29.8[.]18/htroy.exe’.
- [T1027] Obfuscated/Compressed Files and Information – The malware decrypts strings with DES and uses RC4 keys for decryption and C2 communications. ‘RC4 Key 1 (decrypting strings)… RC4 Key 2 (C&C communications)’.
- [T1071.001] Web Protocols – C2 traffic uses HTTP with explicit requests/responses: ‘HTTP 1.1 /index.php?member=sbi2009 SSL3.3.7’ and ‘HTTP 1.1 /member.php SSL3.4’.
- [T1113] Screen Capture – NukeSped includes screen capture capabilities via ModuleScreenCapture. ‘ModuleScreenCapture’ is listed among capabilities.
- [T1125] Video Capture – ModuleWebCamera indicates webcam capture as part of the attack. ‘ModuleWebCamera are new features discovered in this attack.’
- [T1056.001] Keylogging – NukeSped can perform keylogging via ModuleKeyLogger.
- [T1059.003] Windows Command Shell – Command execution through cmd.exe (e.g., ‘cmd.exe /c “ping 11.11.11.1″‘).
- [T1069.002] Domain Groups – Discovery of domain admins via ‘net group “domain admins” /domain’.
- [T1087.001] Local Account Discovery – Discovery via ‘net user _smuser white1234!@#$’.
- [T1555.003] Credentials in Web Browsers – Infostealer collects browser-stored accounts/passwords and history. ‘Collected Data: accounts and passwords saved in browsers, browser history.’
- [T1555.004] Credentials in Email Clients – Infostealer collects email account information (Outlook Express, MS Office Outlook, Windows Live Mail).
- [T1496] Resource Hijacking – Jin Miner (CoinMiner) mines Monero. ‘Jin Miner is a CoinMiner that ultimately mines the Monero coin.’
Indicators of Compromise
- [MD5] NukeSped backdoor hashes – 87a6bda486554ab16c82bdfb12452e8b, 830bc975a04ab0f62bfedf27f7aca673, 131fc4375971af391b459de33f81c253, 827103a6b6185191fd5618b7e82da292, 1875f6a68f70bee316c8a6eda9ebf8de
- [MD5] Infostealer hashes – 85995257ac07ae5a6b4a86758a2283d7, 47791bf9e017e3001ddc68a7351ca2d6
- [URL] NukeSped download URL – hxxp://185.29.8[.]18/htroy.exe
- [URL] NukeSped C2 URLs – 185.29.8[.]18:8888, 84.38.133[.]145:443, 84.38.133[.]16:8443, mail.usengineergroup[.]com:8443
- [File] NukeSped filenames – svc.exe, srvCredit.exe, runhostw.exe, javarw.exe
- [MD5] Jin Miner hashes – 7a19c59c4373cadb4556f7e30ddd91ac, c2412d00eb3b4bccae0d98e9be4d92bb, 8c8a38f5af62986a45f2ab4f44a0b983, 7ef97450e84211f9f35d45e1e6ae1481, dd4b8a2dc73a29bc7a598148eb8606bb
- [URL] Jin Miner download URLs – hxxp://iosk[.]org/pms/add.bat, hxxp://iosk[.]org/pms/mad.bat, hxxp://iosk[.]org/pms/jin.zip, hxxp://iosk[.]org/pms/jin-6.zip
- [Domain] C2 domain – mail.usengineergroup[.]com
Read more: https://asec.ahnlab.com/en/34461/