Hackers target transportation and shipping companies in new trojan malware campaign

guest · Sep 23, 2019

Hackers target transportation and shipping companies in new trojan malware campaign
September 23, 2019
https://www.zdnet.com/article/hacke...ng-industries-in-new-trojan-malware-campaign/

Hackers are deploying previously unknown tools in a cyber attack campaign targeting shipping and transport organisations with custom trojan malware.

Identified and detailed by researchers at Palo Alto Networks' Unit 42 threat intelligence division, the campaign has been active since at least May 2019 and focuses on transportation and shipping firms operating out of Kuwait in the Persian Gulf.
The campaign has been dubbed xHunt because the malicious tools associated with it have apparently been named by the developers after characters in anime series Hunter x Hunter.

xHunt first came to light in May after a malicious binary was found installed on the network of a victim in Kuwait. It's still not certain how machines are initially compromised, but the attackers install a backdoor named Hisoka version 0.8 which facilities the delivery of additional families of malware which appear to have been developed by the same authors.
Click to expand...

Palo Alto: xHunt Campaign: Attacks on Kuwait Shipping and Transportation Organizations

guest · Mar 9, 2020

Report details threats to shipping companies from malware
Hackers are increasingly targeting this niche with phishing links
March 9, 2020
https://www.rivieramm.com/news-cont...eats-to-shipping-companies-from-malware-58372

Dryad Global’s new report stated that “Email subject line MV or MT keyword usage is a common lure to entice users in the maritime industry to open emails containing malicious attachments.”
The weekly list showed vessels being impersonated with the associated malicious emails. Dryad Global’s report showed attempts to use vessel names to try to lure companies in the maritime sector.

The report for week four of February 2020 has seen a large percentage of these malicious emails attempting to deliver the Trojan malware Tiggre!rfn and Wacatac.
Tiggre!rfn is Trojan malware for Microsoft Windows that mines cryptocurrency off the user’s computer. Wacatac is an alias of the RedRum ransomware that is distributed through email spam.

The report for the third week of February lists attempts to impersonate a Maersk vessel among others. In 2017, Maersk was victim to a cyber-attack that crippled Maersk Group’s IT systems.
Dryad Global’s analysis illustrates “how opening any infected email could cause a recipient to become an infected member of the maritime supply chain and thus possibly infect victim vessels, port facilities and/or shore companies in the marine, agricultural, and other industries with additional malware.”
Click to expand...

guest · Nov 9, 2020

Microsoft Exchange Attack Exposes New xHunt Backdoors
November 9, 2020
https://threatpost.com/microsoft-exchange-attack-xhunt-backdoors/161041/

Two never-before-seen Powershell backdoors have been uncovered, after researchers recently discovered an attack on Microsoft Exchange servers at an organization in Kuwait .

The activity is tied back to the known xHunt threat group, which was first discovered in 2018 and has previously launched an array of attacks targeting the Kuwait government, as well as shipping and transportation organizations.
However, a more recently observed attack – on or before Aug. 22, 2019, based on the creation timestamps of the scheduled tasks associated with the breach – shows the attackers have updated their arsenal of tools.
Click to expand...

The attack used two newly discovered backdoors: One that researchers called “TriFive,” and the other, a variant of a previously discovered PowerShell-based backdoor (dubbed CASHY200), which they called “Snugy.”

“Both of the backdoors installed on the compromised Exchange server of a Kuwait government organization used covert channels for C2 communications, specifically DNS tunneling and an email-based channel using drafts in the Deleted Items folder of a compromised email account,” said researchers with Palo Alto’s Unit 42 team, Monday.
Click to expand...

Palo Alto Networks - Unit42:
xHunt Campaign: Newly Discovered Backdoors Using Deleted Email Drafts and DNS Tunneling for Command and Control

Conclusion
The xHunt campaign continues as threat actors attack organizations in Kuwait. The group shows an ability to adjust their tools with slightly new features and communication channels to avoid detection. Both of the backdoors installed on the compromised Exchange server of a Kuwait government organization used covert channels for C2 communications, specifically DNS tunneling and an email-based channel using drafts in the Deleted Items folder of a compromised email account.
Click to expand...

xHunt Campaign: New PowerShell Backdoor Blocked Through DNS Tunnel Detection (October 10, 2019)

Conclusion
According to our initial publication, the xHunt Campaign targeted Kuwait organizations using several custom tools to compromise systems. We discovered another custom tool that we call CASHY200, which is a PowerShell-based backdoor that communicates with a C2 server using DNS tunneling. We found evidence through open source collection that this threat group used CASHY200 to target Kuwait government organizations.

While we cannot confirm the specific organizations mentioned in the open source, we can confirm that another Kuwait organization was targeted by this group based on our own telemetry from our DNS Security service.
Click to expand...

guest · Jan 13, 2021

BumbleBee Opens Exchange Servers in xHunt Spy Campaign
The BumbleBee web shell allows APT attackers to upload and download files, and move laterally by running commands.
January 12, 2021
https://threatpost.com/bumblebee-exchange-servers-xhunt-spy/162973/

A webshell called BumbleBee has taken flight in an ongoing xHunt espionage campaign that has targeted Microsoft Exchange servers at Kuwaiti organizations.

According to researchers at Palo Alto Networks’ Unit 42, BumbleBee (so named because of its color scheme) was observed being used to upload and download files to and from a compromised Exchange server back in September.

“We found BumbleBee hosted on an internal Internet Information Services (IIS) web server on the same network as the compromised Exchange server, as well as on two internal IIS web servers at two other Kuwaiti organizations,” researchers explained in a Monday blog.
Click to expand...

BumbleBee was also used in lateral-movement efforts, running commands from the attackers to discover additional systems. And indeed, the researchers discovered additional BumbleBee webshells hosted on internal IIS web servers that are not connected to the internet at all three Kuwaiti organizations.
BumbleBee: Password Pollination
Looking deeper into the web shell, Unit 42 found that BumbleBee requires an attacker to supply one password to view the web shell, and a second password to interact with it.

“The actor must [first] provide a password in a URL parameter named parameter,” according to the firm. “Otherwise, the form used to interact with BumbleBee will not display in the browser. To check the supplied password for authentication, the web shell will generate an MD5 hash of the parameter value and check it with a hardcoded MD5 hash.”
Click to expand...

Palo Alto Networks - Unit42: xHunt Campaign: New BumbleBee Webshell and SSH Tunnels Used for Lateral Movement

In September 2020, we began investigating a Microsoft Exchange server at a Kuwaiti organization that a threat group compromised as part of a continued xHunt campaign. This investigation resulted in the discovery of two new backdoors called TriFive and Snugy, which we discussed in a prior blog, as well as a new webshell that we call BumbleBee that we will explain in greater detail in this blog.
Click to expand...

Log in or Sign up

Hackers target transportation and shipping companies in new trojan malware campaign

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Hackers target transportation and shipping companies in new trojan malware campaign

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches