The Threat Response Unit (TRU) at eSentire traced a SocGholish infection that began with a fake browser update and led to post-exploitation activities such as credential theft and data exfiltration. The campaign leveraged obfuscated JavaScript, living-off-the-land techniques, and user-interaction monitoring to map victim peers and extend reach. #SocGholish #MoreEggs #Kaseya #eSentire #ThreatResponseUnit
Keypoints
- In April 2024, eSentire’s Threat Response Unit identified and traced hands-on-keyboard activity to a SocGholish infection initiated by a fake browser update.
- The fake update used obfuscated JavaScript to evade detection and establish a foothold in the environment.
- Attackers used living-off-the-land techniques and web beacons in email signatures and network shares to map local and business relationships for targeting peers.
- The infection began when the user visited a compromised website and downloaded a fake Update.js JavaScript file (MD5: 44a0b845b30dcdc26c8017a6714c46e9).
- Post-exploitation included password store extraction from Microsoft Edge and Google Chrome and copying login data to temporary and other user directories for exfiltration.
- Threat actors attempted to retrieve and decrypt browser encryption keys with PowerShell, set up a portable Python environment for payloads, and manipulated Outlook HTML signatures to monitor email opens and enumerate domain users.
MITRE Techniques
- [T1189] Drive-by Compromise – Infection initiated by a fake browser update that loads obfuscated scripts to foothold. ‘The fake update used obfuscated JavaScript to evade detection and establish a foothold in the environment.’
- [T1027] Obfuscated/Compressed Files and Information – Obfuscated JavaScript used to evade detection during the initial payload delivery. ‘The fake update used obfuscated JavaScript to evade detection and establish a foothold in the environment.’
- [T1555.003] Credentials in Web Browsers – Extraction of saved login data from browser profiles. ‘The threat actors extracted saved login data from Microsoft Edge and Google Chrome.’
- [T1059.001] PowerShell – Use of base64-encoded PowerShell commands to retrieve and decrypt browser keys and set up payloads. ‘Next, the threat actors attempted to run a base64-encoded command via PowerShell.’
- [T1566.002] Phishing: Spearphishing Link – Social engineering via fake updates and modifications to Outlook signatures to monitor email opens. ‘The SocGholish intrusion campaign showcased a social engineering approach to first gain entry through fake updates and then initiate a series of scripted actions to extract sensitive data and monitor user interactions.’
- [T1069.001] Domain Groups Discovery – Enumeration of domain users to understand internal group memberships. ‘listed the members of the “domain users” group in a domain environment.’
Indicators of Compromise
- [Hash] MD5 – 44a0b845b30dcdc26c8017a6714c46e9
- [Domain] ghost.blueecho88[.]com – C2/script delivery points within the obfuscated URLs
- [IP] 170.130.55.72 – C2 server referenced for resource delivery (Documentation.ico)
- [URL] hxxps://ghost.blueecho88[.]com/XnkKYSVbaQg6WzBTaU0mQy0NbxF8QygRLBxpCTsaYT40ClUHLBZkFTsLeA4sWyZDOwt4DixbMFByW3hDZFtvBy4JbEMj
- [URL] hxxps://ghost.blueecho88[.]com/U5WuWyi3zTI3t5RpZKGCeSDhyytxr4wrIfDNMzb2xQQ55vE9IfrALzbn3DQht4J5NufcNCG3lGl/t9x5abfKNz3wxDAl/cw3NeXXPDG30w==
- [URL] hxxps://ghost.blueecho88[.]com/gcGKZ/rj6Q7l47BVtvWmRfK17xej+6gG76DmHvuk1QHx46ZF8+OwReumqBo=
- [File] Update.js – malicious JavaScript payload
- [File] DefaultLogin Data – browser password store file targeted for exfiltration
- [File] Login Data – browser password data copied and exfiltrated
- [File] logocompany.jpeg – image resource loaded from remote server as part of monitoring
- [File] Documentation.lnk – network share shortcut pointing to C2 resource
- [File] Documentation.ico – icon used in network share shortcut
- [File] 395edg.bin, 396chr.bin – staged credential data components used in exfiltration
- [Temp] C:UsersusernameAppDataLocalTemp*.tmp – log and staging artifacts
Read more: https://www.esentire.com/blog/socgholish-sets-sights-on-victim-peers