{"data":{"news":{"items":[{"title":"Securonix Detects New Covert Attack Campaign Targeting Military Contractors","date":"2022-10-03 15:52:58","id":4183,"author":"Navkiran Kaur","blurb":"","blurb_image_uid":"https://dxfpracgmlczp.cloudfront.net/2022/10/1666868720672_securonix.png","blurb_expanded_image_uid":null,"article":"\n\t\n\n\n

Securonix Threat Research team recently discovered a new covert attack campaign targeting multiple military/weapons contractor companies, including likely a strategic supplier to the F-35 Lightning II fighter aircraft. The stager mainly employed the use of PowerShell, and while stagers written in PowerShell are not unique, the procedures involved featured an array of interesting tactics, persistence methodology, counter-forensics, and layers upon layers of obfuscation to hide its code.

\n\n

Additionally, the remote infrastructure or command and control (C2) involved with the stager was relatively sophisticated.

\n\n

Target Analysis and Attack Chain

\n\n

The attack was carried out starting in late summer 2022, targeting at least two high-profile military contractor companies.

\n\n

The overall attack chain can be seen in figure 1 on slide 2, which highlights the initial compromise phase of the attack.

\n\n

Figure 1: Attack Chain (Slide 2)

\n\n

Initial Infection: Shortcut to Code Execution

\n\n

As with a lot of targeted campaigns, the initial infection begins with a phishing email sent to the target containing a malicious attachment. Similar to that of the STIFF#BIZON campaign reported earlier this year, the phishing email contains a compressed file containing a shortcut file, in this case, “Company & Benefits.lnk.”

\n\n

Figure 2: Company & Benefits.pdf.lnk (Slide 3)

\n\n

The shortcut file does some tricky things to avoid detection. First, it attempts to hide its execution by calling for files rather than cmd.exe or powershell.exe.

\n\n

It then takes the powershell.exe executable file, copies it to C:Windows, renames it to AdobeAcrobatPDFReader, and then uses it to execute the rest of the PowerShell string. Logs generated from Sysinternals Sysmon identify this in figure 3 on slide 4.

\n\n

Figure 3: Windows logs showing renamed PowerShell.exe (Slide 4)

\n\n

The rest of the PowerShell script runs on a loop with a 120-second timeout or until an error is not produced. C2 communication is attempted at the URL: hxxps://terma[.]dev/0 to pull down the initial stager.

\n\n

Conclusion

\n\n

Overall, it is clear that this attack was relatively sophisticated, with the malicious threat actor paying specific attention to opsec. There were a lot of relatively recent attack techniques at play, some of which were unfamiliar and required additional analysis, such as leveraging the PowerShell Get-Alias command to perform an invoke expression.

\n\n

Leveraging the registry, WMI subscriptions, scheduled tasks, and incorporating Lolbins with the process was overall clever and needs to be monitored. While this was a very targeted attack, the tactics and techniques used are well-known, and it is important to stay vigilant.

\n\n

Securonix Recommendations and Mitigations

\n\n

Avoid downloading unknown email attachments/link files from non-trusted sources.
Deploy PowerShell script block logging to assist in detections.
Deploy additional process-level logging, such as Sysmon, for additional log coverage. Additionally, Sysmon installed on the host will prevent next-stage payload execution.
Pay specific attention to attempts to disable security monitoring tools, including SIEM.
Scan endpoints using the Securonix seeder hunting queries below.

\n\n

MITRE ATT&CK Techniques

\n\n\n\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\n

\n\t\t\t Tactics \n\t\t\t	\n\t\t\t Techniques \n\t\t\t
Initial Access	T1566: Phishing
Defence Evasion	\n\t\t\t T1027: Obfuscated Files or Information \n\n\t\t\t T1140: Deobfuscate/Decode Files or Information \n\t\t\tT1202: Indirect Command Execution \n\n\t\t\t T1005: Data from Local System \n\t\t\tT1562.001: Impair Defences: Disable or Modify Tools \n\n\t\t\t T1112: Modify Registry \n\t\t\t
Execution	T1059.001: Command and Scripting Interpreter: PowerShell \n\t\t\tT1047: Windows Management Instrumentation
Persistence	T1547: Boot or Logon Autostart Execution \n\t\t\tT1053: Scheduled Task/Job \n\t\t\tT1053.005: Scheduled Task/Job: Scheduled TaskT1546.003: Event-Triggered Execution: Windows Management Instrumentation Event Subscription

\n\n

\n\n\n

\n\n

\n\n\n","article_image_uid":"https://dxfpracgmlczp.cloudfront.net/2022/10/1666868369669_securonix.png","article_expanded_image_uid":null,"article_image_caption":"Securonix","publications":"5","tags":"border security,military,attack chain,threat research","category":"Products & Technologies"},{"title":"Lynred Releases Portable and Low Power Infrared Detector, the Galatea MW","date":"2021-09-24 09:55:37","id":3116,"author":"Ming En Liew","blurb":"","blurb_image_uid":"https://dxfpracgmlczp.cloudfront.net/2021/09/1632448972949_Galatea-MW-Copyright-LYNRED-.jpg","blurb_expanded_image_uid":null,"article":"\n\t\n\n\n

Lynred, a global provider of high-quality infrared detectors for the aerospace, defense and commercial markets, has launched the Galatea MW, one of the most compact and low power consumption infrared (IR) detectors on the market. Its SWaP (Size, Weight and Power) design enhances the autonomy and performance of battery powered devices.

\n\n

Galatea MW, which optimises the balance between performance and miniaturization, is suitable for applications where payload or mobility is critical, such as on Unmanned Aerial Vehicles (UAVs), Unmanned Ground Vehicles (UGVs) and tactical infantry, such as Thermal Weapon Sights or Handheld Thermal Imaging (HHTI) equipment.

\n\n

Says Jean-Yves Dussaud, Chief Marketing Officer of Lynred, \"\"Besides its small form factor, Galatea MW is easy to integrate, compatible with existing optics and user-friendly in every aspect. Initial feedback from customers underscores the confidence we have in the strong potential of this product.\"

\n\n

Military tactical HHTI are becoming increasingly central to achieving strategic objectives in field operations, thus requiring equipment to be easily portable, reliable, and optimised for power management.

\n\n

Galatea was designed with these specifications in mind. To enable an overall reduction in equipment payload and a gain in mission autonomy, the IR detector features a cooled 15-micron mid-wavelength IR detector, with low power consumption, a lightweight frame, and equivalent volume to ease integration and improve ergonomics.

\n\n\n","article_image_uid":"https://dxfpracgmlczp.cloudfront.net/2021/09/1632448900196_Galatea-MW-Copyright-LYNRED-.jpg","article_expanded_image_uid":null,"article_image_caption":"Photo courtesy of Lynred","publications":"5","tags":"lynred,military","category":"Products & Technologies"}],"pageInfo":{"hasNextPage":false,"hasPreviousPage":false,"totalCount":2,"totalPages":0,"currentIndex":0}}}}