LookBack

Based on the capabilities of LookBack and FlowCloud, both of which facilitate various means of credential capture, Dragos assesses with high confidence that TALONITE lateral movement incorporates credential reuse.

Exploit public facing app: LookingFrog and JollyFrog • CVE-2019-0604 • ProxyLogon (March 2021) • ProxyShell (August 2021)

The group uses phishing techniques with either malicious documents or executables.

TALONITE gains initial enterprise network access via spearphishing activity that leverages malicious documents and executables.

The phishing emails appeared to impersonate a US-based engineering licensing board with emails originating from what appears to be an actor-controlled domain, nceess[.]com.

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.

TALONITE TTPs from MITRE ATT&CK ... EXECUTION ... T1106 Native API

Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution.

Based on the capabilities of LookBack and FlowCloud, both of which facilitate various means of credential capture, Dragos assesses with high confidence that TALONITE lateral movement incorporates credential reuse.

Both malware types are Remote Access Trojans (RAT) that contain capabilities to establish persistence within the environment.

ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.

Based on the capabilities of LookBack and FlowCloud, both of which facilitate various means of credential capture, Dragos assesses with high confidence that TALONITE lateral movement incorporates credential reuse.

Both malware types are Remote Access Trojans (RAT) that contain capabilities to establish persistence within the environment.

ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.

threat actors appeared to utilize many concatenation commands within the macro to obfuscate the VBA function. It is possible these concatenations were an attempt to evade static signature detection for the macro strings...

actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

Based on the capabilities of LookBack and FlowCloud, both of which facilitate various means of credential capture, Dragos assesses with high confidence that TALONITE lateral movement incorporates credential reuse.

The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.

LookBack Capabilities • User Activity ... FlowCloud Capabilities • User Activity

TALONITE TTPs from MITRE ATT&CK ... DISCOVERY ... T1046 Network Scanning Service

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

LookBack Capabilities • System Information ... FlowCloud Capabilities • System Information

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

TALONITE TTPs from MITRE ATT&CK ... COLLECTION ... T1005 Data from Local System

LookBack Capabilities • User Activity ... FlowCloud Capabilities • User Activity

The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

TALONITE TTPs from MITRE ATT&CK ... COMMAND & CONTROL ... T1090 Proxy

Operation Honeybee, the threat actors used a Visual Basic script embedded within a Word document to download an implant.

Both malware types are Remote Access Trojans (RAT) that contain capabilities to establish persistence within the environment.

The content is a catalog of malware and threat groups that encrypt command-and-control communications using algorithms such as DES, AES, RC4, XOR, Blowfish, RSA, Camellia, RC2, RC6, and custom ciphers.