The Cortex Threat Research team uncovered espionage campaigns against governments in the Middle East and Africa, attributed to a sophisticated APT cluster labeled CL-STA-0043. The attackers deployed new evasive techniques, including an in-memory VBScript implant and rare Exchange email exfiltration methods, with a likely nation-state objective to obtain sensitive geopolitical information. #CL-STA-0043 #Yasso
Keypoints
- Attacks targeted governmental entities in the Middle East and Africa with high-priority political/military information aims.
- Introduction of novel in-memory VBScript implant that runs webshells clandestinely on Exchange/IIS servers.
- Rare credential theft technique involving a new network provider (ntos) to exfiltrate credentials, alongside classic Mimikatz/NTDSWDigest methods.
- Use of the Yasso toolset for lateral movement (SMB, WinRM, SSH, MSSQL) and NTLM spray with Identity Analytics detection.
- Exfiltration of targeted emails via Exchange Management Shell and added PowerShell snap-ins to export PSTs and email data.
- Privilege escalation techniques included JuicyPotatoNG, Sticky Keys (sethc.exe) abuse, and IIS PE tooling (Iislpe).
MITRE Techniques
- [T1059.005] VBScript – In-memory VBScript implant deployed to run webshell clandestinely. “an in-memory VBscript implant deployed by the threat actor.”
- [T1505] Web Shell – Webshell clandestinely deployed on IIS/Exchange servers via the in-memory VBScript implant. “to run webshell clandestinely”
- [T1046] Network Service Discovery – Reconnaissance using Ladon, Nbtscan, portscans and Windows commands. “Ladon web scanning tool (authored by “k8gege”) … Nbtscan … Portscan … Netstat, nslookup, net, ipconfig, tasklist, quser”
- [T1134] Access Token Manipulation – Privilege escalation using Potato suite tools (e.g., JuicyPotatoNG) to create admin accounts and run elevated tools. “The main tools that were observed during the investigation were: Using those tools, the threat actor attempted to create administrative accounts, and to run various tools that require elevated privileges.”
- [T1548.001] Abuse Elevation Control: Accessibility Features – Sticky Keys abuse to obtain an elevated command prompt. “Sticky Keys Attack is Making a Comeback” … “sethc.exe” … replaced with “cmd.exe”
- [T1068] Exploitation for Privilege Escalation – IIS privilege escalation tool “Iislpe.exe” used as part of IIS PE
- [T1003] Credential Dumping – Credential dumping with Mimikatz, SAM, WDigest, NTDS.dit; includes a novel network-provider method using ntos.dll. “Mimikatz, Dumping the Sam key, Forcing WDigest to store credentials in plaintext and Dumping NTDS.dit …
- [T1021] Remote Services – Lateral movement via Yasso modules (SMB, WinRM, SSH, MSSQL). “SMB Service blowup module”, “Winrm service blowup module”, “SSH service burst module”, “MSSQL … module”
- [T1047] WMI – Additional lateral movement TTPs include WMI, Scheduled Task, WinRS and Net
- [T1114] Email Collection – Exfiltration of targeted emails via Exchange management shell exports and PSTs. “Get-MailboxExportRequest” and related commands described
- [T1059.001] PowerShell – Add PowerShell snap-ins (PSSnapins) to manage Exchange and export emails. “Add-PSSnapin … Microsoft.Exchange.Management.Powershell.E2010”
- [T1560] Archive Collected Data – Exported email data to PSTs and password-protected TIFFs for exfiltration. “output … saved into .tiff files, … compressed, password-protected and sent to the attacker’s C2”
Indicators of Compromise
- [Hash] Yasso – 6b37aec6253c336188d9c8035e90818a139e3425c6e590734f309bd45021f980
- [Hash] sam.exe (Credential Dumping Tool) – 77a3fa80621af4e1286b9dd07edaa37c139ca6c18e5695bc9b2c644a808f9d60
- [Hash] iislpe.exe – 73b9cf0e64be1c05a70a9f98b0de4925e62160e557f72c75c67c1b8922799fc4
- [Hash] SMBexec – E781ce2d795c5dd6b0a5b849a414f5bd05bb99785f2ebf36edb70399205817ee
- [Hash] nbtscan – 0f22e178a1e1d865fc31eb5465afbb746843b223bfa0ed1f112a02ccb6ce3f41
- [Hash] Ladon – 291bc4421382d51e9ee42a16378092622f8eda32bf6b912c9a2ce5d962bcd8f4
- [Hash] Ladon – aa99ae823a3e4c65969c1c3aa316218f5829544e4a433a4bab9f21df11d16154
- [Hash] Ladon – ddcf878749611bc8b867e99d27f0bb8162169a8596a0b2676aa399f0f12bcbd7
- [Hash] ntos.dll – bcd2bdea2bfecd09e258b8777e3825c4a1d98af220e7b045ee7b6c30bf19d6df