The investigation: keeping all options open
Our investigation became an interesting combination of forensics and threat hunting. We categorised our findings into three separate attack phases:
- In - How did the attackers gain access to the network?
- Through - How did the attackers move through the network?
- Out - How did they use the network access to monetize the attack?
Let’s take a closer look at what we discovered per phase:
IN |
|
Initial access The threat actors gained initial access by logging on to a terminal server using Remote Desktop Protocol (RDP). To do so, they used valid credentials and were able to bypass multi-factor authentication (MFA). Due to limited retention of the authentication logs, it was not possible to determine how the threat actors were able to authenticate. Persistency After bypassing MFA for almost two weeks, they created persistency by using legitimate remote access tools to consolidate their remote access |
THROUGH |
|
Discovery and lateral movement Different legitimate (pen testing) tools were used to explore the internal IT domain of the client and to acquire additional credentials.2 Privilege escalation Establishing their foothold, the threat actors escalated their privileges to domain accounts (by retrieving valid domain administrator passwords from several domain controllers) and used previously acquired credentials to create local accounts. |
OUT |
|
(Generic) data collection Some servers showed evidence of data collection of generic files like password stores and browser profiles. Data that was relevant to following through on the attackers’ objectives. This was archived in ZIP files, probably for exfiltration purposes. No traces of collecting or exfiltrating sensitive corporate data like financial information, annual reports, or employee and customer data were found. Coinminer deployment After being inside the network for at least 17 days, the threat actors started to propagate and deploy a coinminer called XMRig to be able to mine the Monero (XMR) altcoin. A PowerShell script was crafted to deploy the coinminer script on multiple hosts. The threat actors used scheduled tasks to start the coinminer executables. The miner was deployed to at least 1600 server systems within the IT domain of our client. We observed at least a few of these hosts connecting to the port of a mining pool. Crypto miners use a mining pool to share processing (CPU) power to split the reward equally, according to the amount of work they contribute. The connection to the mining pool indicated that the miners were indeed active. Moreover, the hosts concerned showed an unusual high CPU usage (see figure 1).
Figure 1: CPU usage of one of the hosts that had an active miner installed.
|
The table below provides a closer look at the tactics, techniques and procedures (TTPs) per phase of the attack, referring to the MITRE ATT&CK framework.
| Technique title | ID | Tactic | Tools or protocols used |
| Initial Access - IN | |||
| External Remote Services | T1133 | Initial access | Remote Desktop Protocol (RDP) |
| Initial access | |||
| Local account creation | T1136.001 | Persistence | |
| Scheduled Task/Job | T1053 | Persistence | |
| Valid account login | T1078 | Defence evasion | |
| Remote access software | T1219 | Command and Control | Atera, Splashtop, AnyDesk |
| Ingress tool transfer | T1105 | Command and Control | sysdaemon.exe, PowerShell |
| Lateral Movement - THROUGH | |||
| Network Service Discovery | T1046 | Discovery | Advanced IP Scanner |
| Account discovery | T1087 | Discovery | AD Explorer, PowerShell, PingCastle |
| Browser information discovery | T1217 | Discovery | |
| Domain controller listing | T1087.002 | Discovery | PowerShell |
| Valid domain accounts | T1078.002 | Privilege escalation | |
| Credential dumping | T1003 | Credential access | crackmapexec |
| Action on Objectives - OUT | |||
| Archive collected data | T1560 | Collection | |
| Resource hijacking | T1496 | Impact | XMRig cryptocurrency miner |