FRP

Fast Reverse Proxy (FRP) for command and control (C2); Plink for C2; Remote Desktop Protocol (RDP) for lateral movement; BitLocker for data encryption; SoftPerfect Network Scanner for system network configuration discovery.

Every deployed Yarbo robot runs an Greengrass component named com.yarbo.frpc (version 1.0.17) that establishes and maintains a persistent outbound TCP tunnel to a remote server... configured to expose the robot's local SSH service to the internet.

Persistence was established for the FRP via scheduled tasks on the domain controller.

For persistence, the threat actor registers their reverse proxies as scheduled tasks, causing the reverse proxy to execute approximately every 20 minutes to communicate with the attacker’s C2 servers.

Use of Publicly Available Exploits: The Phosphorus Group was first seen exploiting the ProxyShell vulnerability, and later on the Log4j vulnerability as well, utilizing fresh exploits in the wild.

Persistence was established for the FRP via scheduled tasks on the domain controller.

For persistence, the threat actor registers their reverse proxies as scheduled tasks, causing the reverse proxy to execute approximately every 20 minutes to communicate with the attacker’s C2 servers.

Every deployed Yarbo robot runs an Greengrass component named com.yarbo.frpc (version 1.0.17) that establishes and maintains a persistent outbound TCP tunnel to a remote server... configured to expose the robot's local SSH service to the internet.

A full process tree of a real time attack that exploits the ProxyShell vulnerability and deployment of the FRP modules, can be seen below.

Persistence was established for the FRP via scheduled tasks on the domain controller.

For persistence, the threat actor registers their reverse proxies as scheduled tasks, causing the reverse proxy to execute approximately every 20 minutes to communicate with the attacker’s C2 servers.

During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.

The installation of Horoung caused a conflict with active security products on the system. This resulted in a crash of these services.

MITRE ATT&CK BREAKDOWN ... Impair Defenses: Disable or Modify System Firewall

Once the attackers exploited the vulnerable Microsoft Exchange Server, they downloaded the FRP module, ran multiple reconnaissance commands, created persistence, dumped credentials using a known LOLBIN technique (Comsvcs.dll), and attempted to move laterally.

After establishing the reverse SOCKS proxy connection, the threat actor performed internal reconnaissance and brute forcing attempts on some of the internal FTP servers inside victim network.

Volexity detected a system running frp, otherwise known as fast reverse proxy, and subsequently detected internal port scanning shortly afterward.

Once the attackers exploited the vulnerable Microsoft Exchange Server, they downloaded the FRP module, ran multiple reconnaissance commands, created persistence, dumped credentials using a known LOLBIN technique (Comsvcs.dll), and attempted to move laterally.

TeamPCP a débuté par l’exploitation opportuniste d’infrastructures cloud exposées (APIs Docker non protégées, plans de contrôle Kubernetes, instances Redis mal configurées)

T1021.004 — Remote Services: SSH (Lateral Movement)

Shared IOCs with Memento Ransomware: One of the IP addresses serves a domain which is being used as command and control (C2) for the recently discovered Memento Ransomware.

The actor has used Earthworm and a custom Fast Reverse Proxy (FRP) client with hardcoded C2 callbacks [T1090].

Figure 15 displays the reverse SOCKS proxy activity on the infected device using the open-source tool FRP.

The FRP client can be configured to connect to the server through a proxy. The server component of SystemBC has used SOCKS5 for C2 communication. Keydnap uses a copy of tor2web proxy for HTTPS communications.

MITRE ATT&CK Techniques Command and Control T1090.003 Proxy: Multi-hop Proxy

MITRE ATT&CK Techniques Command and Control T1105 Ingress Tool Transfer

“The FRP client establishes a persistent reverse tunnel to the attacker’s server, providing remote access to the device’s ADB service.”

The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.

Because the robot connects to the owner's Wi-Fi, an attacker with a root shell can... Exfiltrate data : use the robot's internet connection (via the FRP tunnel) as a covert outbound channel to exfiltrate data from internal hosts

Talos discovered an ongoing espionage campaign in May 2023 targeting an Islamic charitable non-profit organization in Saudi Arabia that exfiltrates data approximately twice a month.