Threat actors’ infrastructures can themselves become targets of attacks by other actors, not just the final victims. AhnLab describes a CoinMiner proxy server being hit by a ransomware threat actor’s RDP scan, leading to infection and highlighting how compromised infrastructures can be repurposed to attack others. #CoinMiner #FastReverseProxy #AhnLab #WinXMRig
Keypoints
- Threat actors can attack other threat actors’ infrastructures, not only organizations or individuals.
- A CoinMiner proxy server was targeted by a ransomware actor’s Remote Desktop Protocol (RDP) scan, resulting in infection.
- Initial breach may involve compromising MS-SQL administrator accounts (sa) and using xp_cmdshell to install a backdoor and download malware from a C2 server.
- The backdoor was registered to Windows Management Instrumentation (WMI) and operated on a schedule (daily at 11:00 PM).
- The ransomware threat actor used a modified Fast Reverse Proxy to establish a reverse RDP connection and access the miner bot.
- An exposed proxy server led to an RDP port brute-force attack on targets, enabling system administrator login and ransomware spread.
- The case explores whether the attack was intentional or opportunistic, and suggests threat actors may use others’ infrastructures to launch efficient attacks.
MITRE Techniques
- [T1047] Windows Management Instrumentation – Backdoor registered to WMI and operated daily; ‘The backdoor was registered to Windows Management Instrumentation (WMI) and operated daily at 11:00 PM.’
- [T1053] Scheduled Task – The backdoor operated daily at 11:00 PM, implying scheduled task/job usage; ‘operated daily at 11:00 PM.’
- [T1105] Ingress Tool Transfer – Downloaded malicious files including CoinMiner from the C2 server; ‘The backdoor downloaded malicious files including the CoinMiner from the C2 server.’
- [T1059.003] Command and Scripting Interpreter – Used MS-SQL xp_cmdshell to install a backdoor; ‘they then installed a backdoor into the victim system using MS-SQL’s xp_cmdshell procedure.’
- [T1021.001] Remote Desktop Protocol – Configured reverse RDP to access the Miner bot; ‘The CoinMiner threat actor configured a reverse RDP environment using the Fast Reverse Proxy tool to access the Miner bot.’
- [T1090] Proxy – Modified Fast Reverse Proxy to automatically connect to the proxy server for use in attacks; ‘the normal version requires the user to import the information of the target server… The CoinMiner threat actor modified the Fast Reverse Proxy file’s code so that it automatically connects to the proxy server and uses it in their attack.’
- [T1110] Brute Force – RDP brute force attack on exposed systems; ‘The ransomware threat actor launched a RDP brute force attack on the TCP 30 port.’
- [T1021.001] Remote Desktop Protocol – Lateral movement via RDP after gaining initial access; ‘distributed the ransomware to multiple systems… lateral movement into the network.’
Indicators of Compromise
- [MD5] Hashes – D6B2FEEA1F03314B21B7BB1EF2294B72, 2513EB59C3DB32A2D5EFBEDE6136A75D, and 18 more hashes
- [IP] 223.223.188[.]19, 185.141.26[.]116
- [URL/Domain] 185.141.26[.]116/stats.php, 185.141.26[.]116/hotfixl.ico, httpd.exe
- [Domain] d.mymst[.]top, m.mymst[.]top, frp.mymst007[.]top
- [IP with port] 84.46.22[.]158:7000, 46.59.214[.]14:7000, 46.59.210[.]69:7000
Read more: https://asec.ahnlab.com/en/66372/