Blog
/
/
January 8, 2024

Uncovering CyberCartel Threats in Latin America

Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
08
Jan 2024
Discover how Darktrace investigates CyberCartel attacks targeting Latin America. Learn about the methods and findings of this crucial analysis.

Introduction

In September 2023, Darktrace published its first Half-Year Threat Report, highlighting Threat Research, Security Operation Center (SOC), model breach, and Cyber AI Analyst analysis and trends across the Darktrace customer fleet. According to Darktrace’s Threat Report, the most observed threat type to affect Darktrace customers during the first half of 2023 was Malware-as-a-Service (Maas). The report highlighted a growing trend where malware strains, specifically in the MaaS ecosystem, “use cross-functional components from other strains as part of their evolution and customization” [1].  

Darktrace’s Threat Research team assessed this ‘Frankenstein’ approach would very likely increase, as shown by the fact that indicators of compromise (IoCs) are becoming “less and less mutually exclusive between malware strains as compromised infrastructure is used by multiple threat actors through access brokers or the “as-a-Service” market” [1].

Darktrace investigated one such threat during the last months of summer 2023, eventually leading to the discovery of CyberCartel-related activity across a significant number of Darktrace customers, especially in Latin America.

CyberCartel Overview and Darktrace Coverage

During a threat hunt, Darktrace’s Threat Research team discovered the download of a binary with a unique Uniform Resource Identifier (URI) pattern. When examining Darktrace’s customer base, it was discovered that binaries with this same URI pattern had been downloaded by a significant number of customer accounts, especially by customers based in Latin America. Although not identical, the targets and tactics, techniques, and procedures (TTPs) resembled those mentioned in an article regarding a botnet called Fenix [2], particularly active in Latin America.

During the Threat Research team’s investigation, nearly 40 potentially affected customer accounts were identified. Darktrace’s global Threat Research team investigates pervasive threats across Darktrace’s customer base daily. This cross-fleet research is based on Darktrace’s anomaly-based detection capability, Darktrace DETECT™, and revolves around technical analysis and contextualization of detection information.

Amid the investigation, further open-source intelligence (OSINT) research revealed that most indicators observed during Darktrace’s investigations were associated to a Latin American threat group named CyberCartel, with a small number of IoCs being associated with the Fenix botnet. While CyberCartel seems to have been active since 2012 and relies on MaaS offerings from well-known malware families, Fenix botnet was allegedly created at the end of last year and “specifically targets users accessing government services, particularly tax-paying individuals in Mexico and Chile” [2].

Both groups share similar targets and TTPs, as well as objectives: installing malware with information-stealing capabilities. In the case of Fenix infections, the compromised device will be added to a botnet and execute tasks given by the attacker(s); while in the case of CyberCartel, it can lead to various types of second-stage info-stealing and Man-in-the-Browser capabilities, including retrieving system information from the compromised device, capturing screenshots of the active browsing tab, and redirecting the user to fraudulent websites such as fake banking sites. According to a report by Metabase Q [2], both groups possibly share command and control (C2) infrastructure, making accurate attribution and assessment of the confidence level for which group was affecting the customer base extremely difficult. Indeed, one of the C2 IPs (104.156.149[.]33) observed on nearly 20 customer accounts during the investigation had OSINT evidence linking it to both CyberCartel and Fenix, as well as another group known to target Mexico called Manipulated Caiman [3] [4] [5].

CyberCartel and Fenix both appear to target banking and governmental services’ users based in Latin America, especially individuals from Mexico and Chile. Target institutions purportedly include tax administration services and several banks operating in the region. Malvertising and phishing campaigns direct users to pages imitating the target institutions’ webpages and prompt the download of a compressed file advertised in a pop-up window. This file claims enhance the user’s security and privacy while navigating the webpage but instead redirects the user to a compromised website hosting a zip file, which itself contains a URL file containing instructions for retrieval of the first stage payload from a remote server.

pop-up window with malicious file
Figure 1: Example of a pop-up window asking the user to download a compressed file allegedly needed to continue navigating the portal. Connections to the domain srlxlpdfmxntetflx[.]com were observed in one account investigated by Darktrace

During their investigations, the Threat Research team observed connections to 100% rare domains (e.g., situacionfiscal[.]online, consultar-rfc[.]online, facturmx[.]info), many of them containing strings such as “mx”, “rcf” and “factur” in their domain names, prior to the downloads of files with the unique URI pattern identified during the aforementioned threat hunting session.

The reference to “rfc” is likely a reference to the Registro Federal de Contribuyentes, a unique registration number issued by Mexico’s tax collection agency, Servicio de Administración Tributaria (SAT). These domains were observed as being 100% rare for the environment and were connected to a few minutes prior to connections to CyberCartel endpoints. Most of the endpoints were newly registered, with creation dates starting from only a few months earlier in the first half of 2023. Interestingly, some of these domains were very similar to legitimate government websites, likely a tactic employed by threat actors to convince users to trust the domains and to bypass security measures.

Figure 2: Screenshot from similarweb[.]com showing the degree of affinity between malicious domains situacionfiscal[.]online and facturmx[.]info and the legitimate Mexican government hostname sat[.]gob[.]mx
Figure 3: Screenshot of the likely source infection website facturmx[.]info taken when visited in a sandbox environment

In other customer networks, connections to mail clients were observed, as well as connections to win-rar[.]com, suggesting an interaction with a compressed file. Connections to legitimate government websites were also detected around the same time in some accounts. Shortly after, the infected devices were detected connecting to 100% rare IP addresses over the HTTP protocol using WebDAV user agents such as Microsoft-WebDAV-MiniRedir/10.0.X and DavCInt. Web Distributed Authoring and Versioning, in its full form, is a legitimate extension to the HTTP protocol that allows users to remotely share, copy, move and edit files hosted on a web server. Both CyberCartel and Fenix botnet reportedly abuse this protocol to retrieve the initial payload via a shortcut link. The use (or abuse) of this protocol allows attackers to evade blocklists and streamline payload distribution. In cases investigated by Darktrace, the use of this protocol was not always considered unusual for the breach device, indicating it also was commonly used for its legitimate purposes.

HTTP methods observed included PROPFIND, GET, and OPTIONS, where a higher proportion of PROPFIND requests were observed. PROPFIND is an HTTP method related to the use of WebDAV that retrieves properties in an exactly defined, machine-readable, XML document (GET responses do not have a define format). Properties are pieces of data that describe the state of a resource, i.e., data about data [7]. They are used in distributed authoring environments to provide for efficient discovery and management of resources.  

Figure 4: Device event log showing a connection to facturmx[.]info followed by a WebDAV connection to the 100% rare IP 172.86.68[.]104

In a number of cases, connections to compromised endpoints were followed by the download of one or more executable files with names following the regex pattern /(yes|4496|[A-Za-z]{8})/(((4496|4545)[A-Za-z]{24})|Herramienta_de_Seguridad_SII).(exe|jse), for example 4496UCJlcqwxvkpXKguWNqNWDivM.exe. PROPFIND and GET HTTP requests for dynamic-link library (DLL) files such as urlmon.dll and netutils.dll were also detected. These are legitimate Windows files that are essential to handle network and internet-related tasks in Windows. Irrespective of whether they had malicious or legitimate signatures, Darktrace DETECT was able to recognize that the download of these files was suspicious with rare external endpoints not previously observed on the respective customer networks.

Figure 5: Advanced Search results showing some of the HTTP requests made by the breach device to a CyberCartel endpoint via PROPFIND, GET, or OPTIONS methods for executable and DLL files

Following Darktrace DETECT’s model breaches, these HTTP connections were investigated by Cyber AI Analyst™. AI Analyst provided a summary and further technical details of these connections, as shown in figure 6.

Figure 6: Cyber AI Analyst incident showing a summary of the event, as well as technical details. The AI investigation process is also detailed

AI Analyst searched for all HTTP connections made by the breach device and found more than 2,500 requests to more than a hundred endpoints for one given device. It then looked for the user agents responsible for these connections and found 15 possible software agents responsible for the HTTP requests, and from these identified a single suspicious software agent, Microsoft-WebDAV-Min-Redir. As mentioned previously, this is a legitimate software, but its use by the breach device was considered unusual by Darktrace’s machine learning technology. By performing analysis on thousands of connections to hundreds of endpoints at machine speed, AI Analyst is able to perform the heavy lifting on behalf of human security teams and then collate its findings in a single summary pane, giving end-users the information needed to assess a given activity and quickly start remediation as needed. This allows security teams and administrators to save precious time and provides unparalleled visibility over any potentially malicious activity on their network.

Following the successful identification of CyberCartel activity by DETECT, Darktrace RESPOND™ is then able to contain suspicious behavior, such as by restricting outgoing traffic or enforcing normal patterns of life on affected devices. This would allow customer security teams extra time to analyze potentially malicious behavior, while leaving the rest of the network free to perform business critical operations. Unfortunately, in the cases of CyberCartel compromises detected by Darktrace, RESPOND was not enabled in autonomous response mode meaning preventative actions had to be applied manually by the customer’s security team after the fact.

Figure 7. Device event log showing connections to 100% rare CyberCartel endpoint 172.86.68[.]194 and subsequent suggested RESPOND actions.

Conclusion

Threat actors targeting high-value entities such as government offices and banks is unfortunately all too commonplace.  In the case of Cyber Cartel, governmental organizations and entities, as well as multiple newspapers in the Latin America, have cautioned users against these malicious campaigns, which have occurred over the past few years [8] [9]. However, attackers continuously update their toolsets and infrastructure, quickly rendering these warnings and known-bad security precautions obsolete. In the case of CyberCartel, the abuse of the legitimate WebDAV protocol to retrieve the initial payload is just one example of this. This method of distribution has also been leveraged by in Bumblebee malware loader’s latest campaign [10]. The abuse of the legitimate WebDAV protocol to retrieve the initial CyberCartel payload outlined in this case is one example among many of threat actors adopting new distribution methods used by others to further their ends.

As threat actors continue to search for new ways of remaining undetected, notably by incorporating legitimate processes into their attack flow and utilizing non-exclusive compromised infrastructure, it is more important than ever to have an understanding of normal network operation in order to detect anomalies that are indicative of an ongoing compromise. Darktrace’s suite of products, including DETECT+RESPOND, is well placed to do just that, with machine-speed analysis, detection, and response helping security teams and administrators keep their digital environments safe from malicious actors.

Credit to: Nahisha Nobregas, SOC Analyst

References

[1] https://darktrace.com/blog/darktrace-half-year-threat-report

[2] https://www.metabaseq.com/fenix-botnet/

[3] https://perception-point.io/blog/manipulated-caiman-the-sophisticated-snare-of-mexicos-banking-predators-technical-edition/

[4] https://www.virustotal.com/gui/ip-address/104.156.149.33/community

[5] https://silent4business.com/tendencias/1

[6] https://www.metabaseq.com/cybercartel/

[7] http://www.webdav.org/specs/rfc2518.html#rfc.section.4.1

[8] https://www.csirt.gob.cl/alertas/8ffr23-01415-01/

[9] https://www.gob.mx/sat/acciones-y-programas/sitios-web-falsos

[10] https://www.bleepingcomputer.com/news/security/bumblebee-malware-returns-in-new-attacks-abusing-webdav-folders/

Appendices  

Darktrace DETECT Model Detections

AI Analyst Incidents:

• Possible HTTP Command and Control

• Suspicious File Download

Model Detections:

• Anomalous Connection / New User Agent to IP Without Hostname

• Device / New User Agent and New IP

• Anomalous File / EXE from Rare External Location

• Multiple EXE from Rare External Locations

• Anomalous File / Script from Rare External Location

List of IoCs

IoC - Type - Description + Confidence

f84bb51de50f19ec803b484311053294fbb3b523 - SHA1 hash - Likely CyberCartel Payload IoCs

4eb564b84aac7a5a898af59ee27b1cb00c99a53d - SHA1 hash - Likely CyberCartel payload

8806639a781d0f63549711d3af0f937ffc87585c - SHA1 hash - Likely CyberCartel payload

9d58441d9d31b5c4011b99482afa210b030ecac4 - SHA1 hash - Possible CyberCartel payload

37da048533548c0ad87881e120b8cf2a77528413 - SHA1 hash - Likely CyberCartel payload

2415fcefaf86a83f1174fa50444be7ea830bb4d1 - SHA1 hash - Likely CyberCartel payload

15a94c7e9b356d0ff3bcee0f0ad885b6cf9c1bb7 - SHA1 hash - Likely CyberCartel payload

cdc5da48fca92329927d9dccf3ed513dd28956af - SHA1 hash - Possible CyberCartel payload

693b869bc9ba78d4f8d415eb7016c566ead839f3 - SHA1 hash - Likely CyberCartel payload

04ce764723eaa75e4ee36b3d5cba77a105383dc5 - SHA1 hash - Possible CyberCartel payload

435834167fd5092905ee084038eee54797f4d23e - SHA1 hash - Possible CyberCartel payload

3341b4f46c2f45b87f95168893a7485e35f825fe - SHA1 hash - Likely CyberCartel payload

f6375a1f954f317e16f24c94507d4b04200c63b9 - SHA1 hash - Likely CyberCartel payload

252efff7f54bd19a5c96bbce0bfaeeecadb3752f - SHA1 hash - Likely CyberCartel payload

8080c94e5add2f6ed20e9866a00f67996f0a61ae - SHA1 hash - Likely CyberCartel payload

c5117cedc275c9d403a533617117be7200a2ed77 - SHA1 hash - Possible CyberCartel payload

19dd866abdaf8bc3c518d1c1166fbf279787fc03 - SHA1 hash - Likely CyberCartel payload

548287c0350d6e3d0e5144e20d0f0ce28661f514 - SHA1 hash - Likely CyberCartel payload

f0478e88c8eefc3fd0a8e01eaeb2704a580f88e6 - SHA1 hash - Possible CyberCartel payload

a9809acef61ca173331e41b28d6abddb64c5f192 - SHA1 hash - Likely CyberCartel payload

be96ec94f8f143127962d7bf4131c228474cd6ac - SHA1 hash -Likely CyberCartel payload

44ef336395c41bf0cecae8b43be59170bed6759d - SHA1 hash - Possible CyberCartel payload

facturmx[.]info - Hostname - Likely CyberCartel infection source

consultar-rfc[.]online - Hostname - Possible CyberCartel infection source

srlxlpdfmxntetflx[.]com - Hostname - Likely CyberCartel infection source

facturmx[.]online - Hostname - Possible CyberCartel infection source

rfcconhomoclave[.]mx - Hostname - Possible CyberCartel infection source

situacionfiscal[.]online - Hostname - Likely CyberCartel infection source

descargafactura[.]club - Hostname - Likely CyberCartel infection source

104.156.149[.]33 - IP - Likely CyberCartel C2 endpoint

172.86.68[.]194 - IP - Likely CyberCartel C2 endpoint

139.162.73[.]58 - IP - Likely CyberCartel C2 endpoint

172.105.24[.]190 - IP - Possible CyberCartel C2 endpoint

MITRE ATT&CK Mapping

Tactic - Technique

Command and Control - Ingress Tool Transfer (T1105)

Command and Control - Web Protocols (T1071.001)

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Alexandra Sentenac
Cyber Analyst
Book a 1-1 meeting with one of our experts
Share this article

More in this series

No items found.

Blog

/

AI

/

March 18, 2025

Survey findings: How is AI Impacting the SOC?

Default blog imageDefault blog image

There’s no question that AI is already impacting the SOC – augmenting, assisting, and filling the gaps left by staff and skills shortages. We surveyed over 1,500 cybersecurity professionals from around the world to uncover their attitudes to AI cybersecurity in 2025. Our findings revealed striking trends in how AI is changing the way security leaders think about hiring and SOC transformation. Download the full report for the big picture, available now.

Download the full report to explore these findings in depth

The AI-human conundrum

Let’s start with some context. As the cybersecurity sector has rapidly evolved to integrate AI into all elements of cyber defense, the pace of technological advancement is outstripping the development of necessary skills. Given the ongoing challenges in security operations, such as employee burnout, high turnover rates, and talent shortages, recruiting personnel to bridge these skills gaps remains an immense challenge in today’s landscape.

But here, our main findings on this topic seem to contradict each other.

There’s no question over the impact of AI-powered threats – nearly three-quarters (74%) agree that AI-powered threats now pose a significant challenge for their organization.  

When we look at how security leaders are defending against AI-powered threats, over 3 out of 5 (62%) see insufficient personnel to manage tools and alerts as the biggest barrier.  

Yet at the same time, increasing cyber security staff is at the bottom of the priority list for survey participants, with only 11% planning to increase cybersecurity staff in 2025 – less than in 2024. What 64% of stakeholders are committed to, however, is adding new AI-powered tools onto their existing security stacks.

The conclusion? Due to pressures around hiring, defensive AI is becoming integral to the SOC as a means of augmenting understaffed teams.

How is AI plugging skills shortages in the SOC?

As explored in our recent white paper, the CISO’s Guide to Navigating the Cybersecurity Skills Shortage, 71% of organizations report unfilled cybersecurity positions, leading to the estimation that less than 10% of alerts are thoroughly vetted. In this scenario, AI has become an essential multiplier to relieve the burden on security teams.

95% of respondents agree that AI-powered solutions can significantly improve the speed and efficiency of their defenses. But how?

The area security leaders expect defensive AI to have the biggest impact is on improving threat detection, followed by autonomous response to threats and identifying exploitable vulnerabilities.

Interestingly, the areas that participants ranked less highly (reducing alert fatigue and running phishing simulation), are the tasks that AI already does well and can therefore be used already to relieve the burden of manual, repetitive work on the SOC.

Different perspectives from different sides of the SOC

CISOs and SecOps teams aren’t necessarily aligned on the AI defense question – while CISOs tend to see it as a strategic game-changer, SecOps teams on the front lines may be more sceptical, wary of its real-world reliability and integration into workflows.  

From the data, we see that while less than a quarter of execs doubt that AI-powered solutions will block and automatically respond to AI threats, about half of SecOps aren’t convinced. And only 17% of CISOs lack confidence in the ability of their teams to implement and use AI-powered solutions, whereas over 40% those in the team doubt their own ability to do so.

This gap feeds into the enthusiasm that executives share about adding AI-driven tools into the stack, while day-to-day users of the tools are more interested in improving security awareness training and improving cybersecurity tool integration.

Levels of AI understanding in the SOC

AI is only as powerful as the people who use it, and levels of AI expertise in the SOC can make or break its real-world impact. If security leaders want to unlock AI’s full potential, they must bridge the knowledge gap—ensuring teams understand not just the different types of AI, but where it can be applied for maximum value.

Only 42% of security professionals are confident that they fully understand all the types of AI in their organization’s security stack.

This data varies between job roles – executives report higher levels of understanding (60% say they know exactly which types of AI are being used) than participants in other roles. Despite having a working knowledge of using the tools day-to-day, SecOps practitioners were more likely to report having a “reasonable understanding” of the types of AI in use in their organization (42%).  

Whether this reflects a general confidence in executives rather than technical proficiency it’s hard to say, but it speaks to the importance of AI-human collaboration – introducing AI tools for cybersecurity to plug the gaps in human teams will only be effective if security professionals are supported with the correct education and training.  

Download the full report to explore these findings in depth

The full report for Darktrace’s State of AI Cybersecurity is out now. Download the paper to dig deeper into these trends, and see how results differ by industry, region, organization size, and job title.  

Continue reading
About the author
The Darktrace Community

Blog

/

Network

/

March 18, 2025

Darktrace's Detection of State-Linked ShadowPad Malware

Default blog imageDefault blog image

An integral part of cybersecurity is anomaly detection, which involves identifying unusual patterns or behaviors in network traffic that could indicate malicious activity, such as a cyber-based intrusion. However, attribution remains one of the ever present challenges in cybersecurity. Attribution involves the process of accurately identifying and tracing the source to a specific threat actor(s).

Given the complexity of digital networks and the sophistication of attackers who often use proxies or other methods to disguise their origin, pinpointing the exact source of a cyberattack is an arduous task. Threat actors can use proxy servers, botnets, sophisticated techniques, false flags, etc. Darktrace’s strategy is rooted in the belief that identifying behavioral anomalies is crucial for identifying both known and novel threat actor campaigns.

The ShadowPad cluster

Between July 2024 and November 2024, Darktrace observed a cluster of activity threads sharing notable similarities. The threads began with a malicious actor using compromised user credentials to log in to the target organization's Check Point Remote Access virtual private network (VPN) from an attacker-controlled, remote device named 'DESKTOP-O82ILGG'.  In one case, the IP from which the initial login was carried out was observed to be the ExpressVPN IP address, 194.5.83[.]25. After logging in, the actor gained access to service account credentials, likely via exploitation of an information disclosure vulnerability affecting Check Point Security Gateway devices. Recent reporting suggests this could represent exploitation of CVE-2024-24919 [27,28]. The actor then used these compromised service account credentials to move laterally over RDP and SMB, with files related to the modular backdoor, ShadowPad, being delivered to the  ‘C:\PerfLogs\’ directory of targeted internal systems. ShadowPad was seen communicating with its command-and-control (C2) infrastructure, 158.247.199[.]185 (dscriy.chtq[.]net), via both HTTPS traffic and DNS tunneling, with subdomains of the domain ‘cybaq.chtq[.]net’ being used in the compromised devices’ TXT DNS queries.

Darktrace’s Advanced Search data showing the VPN-connected device initiating RDP connections to a domain controller (DC). The device subsequently distributes likely ShadowPad-related payloads and makes DRSGetNCChanges requests to a second DC.
Figure 1: Darktrace’s Advanced Search data showing the VPN-connected device initiating RDP connections to a domain controller (DC). The device subsequently distributes likely ShadowPad-related payloads and makes DRSGetNCChanges requests to a second DC.
Event Log data showing a DC making DNS queries for subdomains of ‘cbaq.chtq[.]net’ to 158.247.199[.]185 after receiving SMB and RDP connections from the VPN-connected device, DESKTOP-O82ILGG.
Figure 2: Event Log data showing a DC making DNS queries for subdomains of ‘cbaq.chtq[.]net’ to 158.247.199[.]185 after receiving SMB and RDP connections from the VPN-connected device, DESKTOP-O82ILGG.

Darktrace observed these ShadowPad activity threads within the networks of European-based customers in the manufacturing and financial sectors.  One of these intrusions was followed a few months later by likely state-sponsored espionage activity, as detailed in the investigation of the year in Darktrace’s Annual Threat Report 2024.

Related ShadowPad activity

Additional cases of ShadowPad were observed across Darktrace’s customer base in 2024. In some cases, common C2 infrastructure with the cluster discussed above was observed, with dscriy.chtq[.]net and cybaq.chtq[.]net both involved; however, no other common features were identified. These ShadowPad infections were observed between April and November 2024, with customers across multiple regions and sectors affected.  Darktrace’s observations align with multiple other public reports that fit the timeframe of this campaign.

Darktrace has also observed other cases of ShadowPad without common infrastructure since September 2024, suggesting the use of this tool by additional threat actors.

The data theft thread

One of the Darktrace customers impacted by the ShadowPad cluster highlighted above was a European manufacturer. A distinct thread of activity occurred within this organization’s network several months after the ShadowPad intrusion, in October 2024.

The thread involved the internal distribution of highly masqueraded executable files via Sever Message Block (SMB) and WMI (Windows Management Instrumentation), the targeted collection of sensitive information from an internal server, and the exfiltration of collected information to a web of likely compromised sites. This observed thread of activity, therefore, consisted of three phrases: lateral movement, collection, and exfiltration.

The lateral movement phase began when an internal user device used an administrative credential to distribute files named ‘ProgramData\Oracle\java.log’ and 'ProgramData\Oracle\duxwfnfo' to the c$ share on another internal system.  

Darktrace model alert highlighting an SMB write of a file named ‘ProgramData\Oracle\java.log’ to the c$ share on another device.
Figure 3: Darktrace model alert highlighting an SMB write of a file named ‘ProgramData\Oracle\java.log’ to the c$ share on another device.

Over the next few days, Darktrace detected several other internal systems using administrative credentials to upload files with the following names to the c$ share on internal systems:

ProgramData\Adobe\ARM\webservices.dll

ProgramData\Adobe\ARM\wksprt.exe

ProgramData\Oracle\Java\wksprt.exe

ProgramData\Oracle\Java\webservices.dll

ProgramData\Microsoft\DRM\wksprt.exe

ProgramData\Microsoft\DRM\webservices.dll

ProgramData\Abletech\Client\webservices.dll

ProgramData\Abletech\Client\client.exe

ProgramData\Adobe\ARM\rzrmxrwfvp

ProgramData\3Dconnexion\3DxWare\3DxWare.exe

ProgramData\3Dconnexion\3DxWare\webservices.dll

ProgramData\IDMComp\UltraCompare\updater.exe

ProgramData\IDMComp\UltraCompare\webservices.dll

ProgramData\IDMComp\UltraCompare\imtrqjsaqmm

Cyber AI Analyst highlighting an SMB write of a file named ‘ProgramData\Adobe\ARM\webservices.dll’ to the c$ share on an internal system.
Figure 4: Cyber AI Analyst highlighting an SMB write of a file named ‘ProgramData\Adobe\ARM\webservices.dll’ to the c$ share on an internal system.

The threat actor appears to have abused the Microsoft RPC (MS-RPC) service, WMI, to execute distributed payloads, as evidenced by the ExecMethod requests to the IWbemServices RPC interface which immediately followed devices’ SMB uploads.  

Cyber AI Analyst data highlighting a thread of activity starting with an SMB data upload followed by ExecMethod requests.
Figure 5: Cyber AI Analyst data highlighting a thread of activity starting with an SMB data upload followed by ExecMethod requests.

Several of the devices involved in these lateral movement activities, both on the source and destination side, were subsequently seen using administrative credentials to download tens of GBs of sensitive data over SMB from a specially selected server.  The data gathering stage of the threat sequence indicates that the threat actor had a comprehensive understanding of the organization’s system architecture and had precise objectives for the information they sought to extract.

Immediately after collecting data from the targeted server, devices went on to exfiltrate stolen data to multiple sites. Several other likely compromised sites appear to have been used as general C2 infrastructure for this intrusion activity. The sites used by the threat actor for C2 and data exfiltration purport to be sites for companies offering a variety of service, ranging from consultancy to web design.

Screenshot of one of the likely compromised sites used in the intrusion. 
Figure 6: Screenshot of one of the likely compromised sites used in the intrusion.

At least 16 sites were identified as being likely data exfiltration or C2 sites used by this threat actor in their operation against this organization. The fact that the actor had such a wide web of compromised sites at their disposal suggests that they were well-resourced and highly prepared.  

Darktrace model alert highlighting an internal device slowly exfiltrating data to the external endpoint, yasuconsulting[.]com.
Figure 7: Darktrace model alert highlighting an internal device slowly exfiltrating data to the external endpoint, yasuconsulting[.]com.
Darktrace model alert highlighting an internal device downloading nearly 1 GB of data from an internal system just before uploading a similar volume of data to another suspicious endpoint, www.tunemmuhendislik[.]com    
Figure 8: Darktrace model alert highlighting an internal device downloading nearly 1 GB of data from an internal system just before uploading a similar volume of data to another suspicious endpoint, www.tunemmuhendislik[.]com  

Cyber AI Analyst spotlight

Cyber AI Analyst identifying and piecing together the various steps of a ShadowPad intrusion.
Figure 9: Cyber AI Analyst identifying and piecing together the various steps of a ShadowPad intrusion.  
Cyber AI Analyst Incident identifying and piecing together the various steps of the data theft activity.
Figure 10: Cyber AI Analyst Incident identifying and piecing together the various steps of the data theft activity.

As shown in the above figures, Cyber AI Analyst’s ability to thread together the different steps of these attack chains are worth highlighting.

In the ShadowPad attack chains, Cyber AI Analyst was able to identify SMB writes from the VPN subnet to the DC, and the C2 connections from the DC. It was also able to weave together this activity into a single thread representing the attacker’s progression.

Similarly, in the data exfiltration attack chain, Cyber AI Analyst identified and connected multiple types of lateral movement over SMB and WMI and external C2 communication to various external endpoints, linking them in a single, connected incident.

These Cyber AI Analyst actions enabled a quicker understanding of the threat actor sequence of events and, in some cases, faster containment.

Attribution puzzle

Publicly shared research into ShadowPad indicates that it is predominantly used as a backdoor in People’s Republic of China (PRC)-sponsored espionage operations [5][6][7][8][9][10]. Most publicly reported intrusions involving ShadowPad  are attributed to the China-based threat actor, APT41 [11][12]. Furthermore, Google Threat Intelligence Group (GTIG) recently shared their assessment that ShadowPad usage is restricted to clusters associated with APT41 [13]. Interestingly, however, there have also been public reports of ShadowPad usage in unattributed intrusions [5].

The data theft activity that later occurred in the same Darktrace customer network as one of these ShadowPad compromises appeared to be the targeted collection and exfiltration of sensitive data. Such an objective indicates the activity may have been part of a state-sponsored operation. The tactics, techniques, and procedures (TTPs), artifacts, and C2 infrastructure observed in the data theft thread appear to resemble activity seen in previous Democratic People’s Republic of Korea (DPRK)-linked intrusion activities [15] [16] [17] [18] [19].

The distribution of payloads to the following directory locations appears to be a relatively common behavior in DPRK-sponsored intrusions.

Observed examples:

C:\ProgramData\Oracle\Java\  

C:\ProgramData\Adobe\ARM\  

C:\ProgramData\Microsoft\DRM\  

C:\ProgramData\Abletech\Client\  

C:\ProgramData\IDMComp\UltraCompare\  

C:\ProgramData\3Dconnexion\3DxWare\

Additionally, the likely compromised websites observed in the data theft thread, along with some of the target URI patterns seen in the C2 communications to these sites, resemble those seen in previously reported DPRK-linked intrusion activities.

No clear evidence was found to link the ShadowPad compromise to the subsequent data theft activity that was observed on the network of the manufacturing customer. It should be noted, however, that no clear signs of initial access were found for the data theft thread – this could suggest the ShadowPad intrusion itself represents the initial point of entry that ultimately led to data exfiltration.

Motivation-wise, it seems plausible for the data theft thread to have been part of a DPRK-sponsored operation. DPRK is known to pursue targets that could potentially fulfil its national security goals and had been publicly reported as being active in months prior to this intrusion [21]. Furthermore, the timing of the data theft aligns with the ratification of the mutual defense treaty between DPRK and Russia and the subsequent accused activities [20].

Darktrace assesses with medium confidence that a nation-state, likely DPRK, was responsible, based on our investigation, the threat actor applied resources, patience, obfuscation, and evasiveness combined with external reporting, collaboration with the cyber community, assessing the attacker’s motivation and world geopolitical timeline, and undisclosed intelligence.

Conclusion

When state-linked cyber activity occurs within an organization’s environment, previously unseen C2 infrastructure and advanced evasion techniques will likely be used. State-linked cyber actors, through their resources and patience, are able to bypass most detection methods, leaving anomaly-based methods as a last line of defense.

Two threads of activity were observed within Darktrace’s customer base over the last year: The first operation involved the abuse of Check Point VPN credentials to log in remotely to organizations’ networks, followed by the distribution of ShadowPad to an internal domain controller. The second operation involved highly targeted data exfiltration from the network of one of the customers impacted by the previously mentioned ShadowPad activity.

Despite definitive attribution remaining unresolved, both the ShadowPad and data exfiltration activities were detected by Darktrace’s Self-Learning AI, with Cyber AI Analyst playing a significant role in identifying and piecing together the various steps of the intrusion activities.  

Credit to Sam Lister (R&D Detection Analyst), Emma Foulger (Principal Cyber Analyst), Nathaniel Jones (VP), and the Darktrace Threat Research team.

Appendices

Darktrace / NETWORK model alerts

User / New Admin Credentials on Client

Anomalous Connection / Unusual Admin SMB Session

Compliance / SMB Drive Write  

Device / Anomalous SMB Followed By Multiple Model Breaches

Anomalous File / Internal / Unusual SMB Script Write

User / New Admin Credentials on Client  

Anomalous Connection / Unusual Admin SMB Session

Compliance / SMB Drive Write

Device / Anomalous SMB Followed By Multiple Model Breaches

Anomalous File / Internal / Unusual SMB Script Write

Device / New or Uncommon WMI Activity

Unusual Activity / Internal Data Transfer

Anomalous Connection / Download and Upload

Anomalous Server Activity / Rare External from Server

Compromise / Beacon to Young Endpoint

Compromise / Agent Beacon (Short Period)

Anomalous Server Activity / Anomalous External Activity from Critical Network Device

Anomalous Connection / POST to PHP on New External Host

Compromise / Sustained SSL or HTTP Increase

Compromise / Sustained TCP Beaconing Activity To Rare Endpoint

Anomalous Connection / Multiple Failed Connections to Rare Endpoint

Device / Multiple C2 Model Alerts

Anomalous Connection / Data Sent to Rare Domain

Anomalous Connection / Download and Upload

Unusual Activity / Unusual External Data Transfer

Anomalous Connection / Low and Slow Exfiltration

Anomalous Connection / Uncommon 1 GiB Outbound  

MITRE ATT&CK mapping

(Technique name – Tactic ID)

ShadowPad malware threads

Initial Access - Valid Accounts: Domain Accounts (T1078.002)

Initial Access - External Remote Services (T1133)

Privilege Escalation - Exploitation for Privilege Escalation (T1068)

Privilege Escalation - Valid Accounts: Default Accounts (T1078.001)

Defense Evasion - Masquerading: Match Legitimate Name or Location (T1036.005)

Lateral Movement - Remote Services: Remote Desktop Protocol (T1021.001)

Lateral Movement - Remote Services: SMB/Windows Admin Shares (T1021.002)

Command and Control - Proxy: Internal Proxy (T1090.001)

Command and Control - Application Layer Protocol: Web Protocols (T1071.001)

Command and Control - Encrypted Channel: Asymmetric Cryptography (T1573.002)

Command and Control - Application Layer Protocol: DNS (T1071.004)

Data theft thread

Resource Development - Compromise Infrastructure: Domains (T1584.001)

Privilege Escalation - Valid Accounts: Default Accounts (T1078.001)

Privilege Escalation - Valid Accounts: Domain Accounts (T1078.002)

Execution - Windows Management Instrumentation (T1047)

Defense Evasion - Masquerading: Match Legitimate Name or Location (T1036.005)

Defense Evasion - Obfuscated Files or Information (T1027)

Lateral Movement - Remote Services: SMB/Windows Admin Shares (T1021.002)

Collection - Data from Network Shared Drive (T1039)

Command and Control - Application Layer Protocol: Web Protocols (T1071.001)

Command and Control - Encrypted Channel: Asymmetric Cryptography (T1573.002)

Command and Control - Proxy: External Proxy (T1090.002)

Exfiltration - Exfiltration Over C2 Channel (T1041)

Exfiltration - Data Transfer Size Limits (T1030)

List of indicators of compromise (IoCs)

IP addresses and/or domain names (Mid-high confidence):

ShadowPad thread

- dscriy.chtq[.]net • 158.247.199[.]185 (endpoint of C2 comms)

- cybaq.chtq[.]net (domain name used for DNS tunneling)  

Data theft thread

- yasuconsulting[.]com (45.158.12[.]7)

- hobivan[.]net (94.73.151[.]72)

- mediostresbarbas.com[.]ar (75.102.23[.]3)

- mnmathleague[.]org (185.148.129[.]24)

- goldenborek[.]com (94.138.200[.]40)

- tunemmuhendislik[.]com (94.199.206[.]45)

- anvil.org[.]ph (67.209.121[.]137)

- partnerls[.]pl (5.187.53[.]50)

- angoramedikal[.]com (89.19.29[.]128)

- awork-designs[.]dk (78.46.20[.]225)

- digitweco[.]com (38.54.95[.]190)

- duepunti-studio[.]it (89.46.106[.]61)

- scgestor.com[.]br (108.181.92[.]71)

- lacapannadelsilenzio[.]it (86.107.36[.]15)

- lovetamagotchith[.]com (203.170.190[.]137)

- lieta[.]it (78.46.146[.]147)

File names (Mid-high confidence):

ShadowPad thread:

- perflogs\1.txt

- perflogs\AppLaunch.exe

- perflogs\F4A3E8BE.tmp

- perflogs\mscoree.dll

Data theft thread

- ProgramData\Oracle\java.log

- ProgramData\Oracle\duxwfnfo

- ProgramData\Adobe\ARM\webservices.dll

- ProgramData\Adobe\ARM\wksprt.exe

- ProgramData\Oracle\Java\wksprt.exe

- ProgramData\Oracle\Java\webservices.dll

- ProgramData\Microsoft\DRM\wksprt.exe

- ProgramData\Microsoft\DRM\webservices.dll

- ProgramData\Abletech\Client\webservices.dll

- ProgramData\Abletech\Client\client.exe

- ProgramData\Adobe\ARM\rzrmxrwfvp

- ProgramData\3Dconnexion\3DxWare\3DxWare.exe

- ProgramData\3Dconnexion\3DxWare\webservices.dll

- ProgramData\IDMComp\UltraCompare\updater.exe

- ProgramData\IDMComp\UltraCompare\webservices.dll

- ProgramData\IDMComp\UltraCompare\imtrqjsaqmm

- temp\HousecallLauncher64.exe

Attacker-controlled device hostname (Mid-high confidence)

- DESKTOP-O82ILGG

References  

[1] https://www.kaspersky.com/about/press-releases/shadowpad-how-attackers-hide-backdoor-in-software-used-by-hundreds-of-large-companies-around-the-world  

[2] https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf

[3] https://blog.avast.com/new-investigations-in-ccleaner-incident-point-to-a-possible-third-stage-that-had-keylogger-capacities

[4] https://securelist.com/operation-shadowhammer-a-high-profile-supply-chain-attack/90380/

[5] https://assets.sentinelone.com/c/Shadowpad?x=P42eqA

[6] https://www.cyfirma.com/research/the-origins-of-apt-41-and-shadowpad-lineage/

[7] https://www.csoonline.com/article/572061/shadowpad-has-become-the-rat-of-choice-for-several-state-sponsored-chinese-apts.html

[8] https://global.ptsecurity.com/analytics/pt-esc-threat-intelligence/shadowpad-new-activity-from-the-winnti-group

[9] https://cymulate.com/threats/shadowpad-privately-sold-malware-espionage-tool/

[10] https://www.secureworks.com/research/shadowpad-malware-analysis

[11] https://blog.talosintelligence.com/chinese-hacking-group-apt41-compromised-taiwanese-government-affiliated-research-institute-with-shadowpad-and-cobaltstrike-2/

[12] https://hackerseye.net/all-blog-items/tails-from-the-shadow-apt-41-injecting-shadowpad-with-sideloading/

[13] https://cloud.google.com/blog/topics/threat-intelligence/scatterbrain-unmasking-poisonplug-obfuscator

[14] https://www.domaintools.com/wp-content/uploads/conceptualizing-a-continuum-of-cyber-threat-attribution.pdf

[15] https://www.nccgroup.com/es/research-blog/north-korea-s-lazarus-their-initial-access-trade-craft-using-social-media-and-social-engineering/  

[16] https://www.microsoft.com/en-us/security/blog/2021/01/28/zinc-attacks-against-security-researchers/

[17] https://www.microsoft.com/en-us/security/blog/2022/09/29/zinc-weaponizing-open-source-software/  

[18] https://www.welivesecurity.com/en/eset-research/lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company/  

[19] https://blogs.jpcert.or.jp/en/2021/01/Lazarus_malware2.html  

[20] https://usun.usmission.gov/joint-statement-on-the-unlawful-arms-transfer-by-the-democratic-peoples-republic-of-korea-to-russia/

[21] https://media.defense.gov/2024/Jul/25/2003510137/-1/-1/1/Joint-CSA-North-Korea-Cyber-Espionage-Advance-Military-Nuclear-Programs.PDF  

[22] https://kyivindependent.com/first-north-korean-troops-deployed-to-front-line-in-kursk-oblast-ukraines-military-intelligence-says/

[23] https://www.microsoft.com/en-us/security/blog/2024/12/04/frequent-freeloader-part-i-secret-blizzard-compromising-storm-0156-infrastructure-for-espionage/  

[24] https://www.microsoft.com/en-us/security/blog/2024/12/11/frequent-freeloader-part-ii-russian-actor-secret-blizzard-using-tools-of-other-groups-to-attack-ukraine/  

[25] https://www.sentinelone.com/labs/chamelgang-attacking-critical-infrastructure-with-ransomware/    

[26] https://thehackernews.com/2022/06/state-backed-hackers-using-ransomware.html/  

[27] https://blog.checkpoint.com/security/check-point-research-explains-shadow-pad-nailaolocker-and-its-protection/

[28] https://www.orangecyberdefense.com/global/blog/cert-news/meet-nailaolocker-a-ransomware-distributed-in-europe-by-shadowpad-and-plugx-backdoors

Continue reading
About the author
Sam Lister
SOC Analyst
Your data. Our AI.
Elevate your network security with Darktrace AI