Blog

Inside the SOC

Outlaw Returns: Uncovering Returning Features and New Tactics

Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
27
Jul 2023
27
Jul 2023
This blog takes a renewed look at the latest campaign activity linked with the notorious Outlaw crypto-mining operation. It discusses Darktrace’s investigation into recent cases of Outlaw, detailing the re-appearance of previously observed tactics, while also discussing the emergence of new ones.

What is Outlaw Cryptocurrency Mining Operation?

The cybersecurity community has been aware of the threat of Outlaw cryptocurrency mining operation, and its affiliated activities since as early as 2018. Despite its prominence, Outlaw remains largely elusive to researchers and analysts due to its ability to adapt its tactics, procedures, and payloads.

Outlaw gained notoriety in 2018 as security researchers began observing the creation of affiliated botnets.[1][2]  Researchers gave Outlaw  its name based on the English translation of the “Haiduc” tool observed during their initial activity on compromised devices.[3],[4] By 2019, much of the initial Outlaw activity  focused on the targeting of Internet of Things (IoT) devices and other internet facing servers, reportedly focusing operations in China and on Chinese devices.[5],[6]  From the outset, mining operations featured as a core element of botnets created by the group.[7] This initial focus may have been a sign of caution by threat actors or a preliminary means of testing procedures and operation efficacy. Regardless, Outlaw actors inevitably expanded scope, targeting larger organizations and a wider range of internet facing devices across geographic scope.

Following a short period of inactivity, security researchers began to observe new Outlaw activity, showcasing additional capabilities such as the ability to kill existing crypto-mining processes on devices, thereby reclaiming devices already compromised by crypto-jacking. [8],[9]

Latest News on Outlaw

Although the more recently observed incidents of Outlaw did demonstrate some new tactics, many of its procedures remained the same, including its unique bundling of payloads that combine crypto-mining and botnet capabilities. [10] In conjunction, the continued use of mining-specific payloads and growth of affiliated botnets has bolstered the belief that Outlaw actors historically prioritizes financial gain, in lieu of overt political objectives.

Given the tendency for malicious actors to share tools and capabilities, true attribution of threat or threat group is extremely difficult in the wild. As such, a genuine survey of activity from the group across a customer base has not always been possible. Therefore, we will present an updated look into more recent activity associated with Outlaw detected across the Darktrace customer base.  

Darktrace vs Outlaw

Since late 2022, Darktrace has observed a rise in probable cyber incidents involving indicators of compromise (IoCs) associated with Outlaw. Given its continued prevalence and relative dearth of information, it is essential to take a renewed look at the latest campaign activity associated with threats like Outlaw to avoid making erroneous assumptions and to ensure the threat posed is correctly characterized.

While being aware of previous IoCs and tactics known to be employed in previous campaigns will go some way to protecting against future Outlaw attacks, it is paramount for organizations to arm themselves with an autonomous intelligent decision maker that can identify malicious activity, based on recognizing deviations from expected patterns of behavior, and take preventative action to effectively defend against such a versatile threat.

Darktrace’s anomaly-based approach to threat detection means it is uniquely positioned to detect novel campaign activity by recognizing subtle deviations in affected devices’ behavior that would have gone unnoticed by traditional security tools relying on rules, signatures and known IoCs.

Outlaw Attack Overview & Darktrace Coverage

From late 2022 through early 2023, Darktrace identified multiple cyber events involving IP addresses, domains, and payloads associated with Outlaw on customer networks. In this recent re-emergence of campaign activity, Darktrace identified numerous attack vectors and IoCs that had previously been associated with Outlaw, however it also observed significant deviations from previous campaigns.

Returning Features

As outlined in a previous blog, past iterations of Outlaw compromises include four identified, distinct phases:

1. Targeting of internet facing devices via SSH brute-forcing

2. Initiation of crypto-mining operations

3. Download of shell script and/or botnet malware payloads

4. Outgoing external SSH scanning to propagate the botnet

Nearly all affected devices analyzed by Darktrace were tagged as internet facing, as identified in previous campaigns, supporting the notion that Outlaw continues to focus on easily exposed devices. In addition to this, Darktrace observed three other core returning features from previous Outlaw campaigns in affected devices between late 2022 and early 2023:

1. Gzip and/or Script Download

2. Beaconing Activity (Command and Control)

3. Crypto-mining

Gzip and/or Script Download

Darktrace observed numerous devices downloading the Dota malware, a strain that is previously known to have been associated with the Outlaw botnet, as either a gzip file or a shell script from rare external hosts.

In some examples, IP addresses that provided the payload were flagged by open-source intelligence (OSINT) sources as having engaged in widespread SSH brute-forcing activities. While the timing of the payload transfer to the device was not consistent, download of gzip files featured prominently during directly observed or potentially affiliated activity. Moreover, Darktrace detected multiple devices performing HTTP requests for shell scripts (.sh) according to detected connection URIs. Darktrace DETECT was able to identify these anomalous connections due to the rarity of the endpoint, payloads, and connectivity for the devices.

Figure 1: Darktrace Cyber AI Analyst technical details summary from an incident during the analysis timeframe that highlights a breach device retrieving the anomalous shell scripts using wget.

Beaconing Activity – Command and Control (C2) Endpoint

Across all Outlaw activity identified by Darktrace, devices engaged in some form of beaconing behavior, rather than one-off connections to IPs associated with Outlaw. While the use of application protocol was not uniform, repeated connectivity to rare external IP addresses related to Outlaw occurred across many analyzed incidents. Darktrace’s Self-Learning AI understood that this beaconing activity represented devices deviating from their expected patterns of life and was able to bring it to the immediate attention of customer security teams.

Figure 2: Model breach log details showing sustained, repeated connectivity to Outlaw affiliated endpoint over port 443, indicating potential C2 activity.

Crypto-mining

In almost every incident of Outlaw identified across the fleet, Darktrace detected some form of cryptocurrency mining activity. Devices affected by Outlaw were consistently observed making anomalous connections to external endpoints associated with crypto-mining operations. Furthermore, the Minergate protocol appeared consistently across hosts; even when devices did not make direct crypto-mining commands, such hosts attempted connections to external entities that were known to support crypto-mining operations.

Figure 3: Advanced Search results showing a sudden spike in mining activity from a device observed connecting to Outlaw-affiliated IP addresses. Such crypto-mining activity was observed consistently across analyzed incidents.

Is Outlaw Using New Tactics?

While in the past, Outlaw activity was identified through a systematic kill chain, recent investigations conducted by Darktrace show significant deviations from this.

For instance, affected devices do not necessarily follow the previously outlined kill chain directly as they did previously. Instead, Darktrace observed affected devices exhibiting these phases in differing orders, repeating steps, or missing out attack phases entirely.

It is essential to study such variation in the kill chain to learn more about the threat of Outlaw and how threat actors are continuing to use it is varying ways. These discrepancies in kill chain elements are likely impacted by visibility into the networks and devices of Darktrace customers, with some relevant activity falling outside of Darktrace’s purview. This is particularly true for internet-exposed devices and hosts that repeatedly performed the same anomalous activity (such as making Minergate requests). Moreover, some devices involved in Outlaw activity may have already been compromised prior to Darktrace’s visibility into the network. As such, these conclusions must be evaluated with a degree of uncertainty.

SSH Activity

Although external SSH connectivity was apparent in some of the incidents detected by Darktrace, it was not directly related to brute-forcing activity. Affected devices did receive anomalous incoming SSH connections, however, wide ranging SSH failed connectivity following the initiation of mining operations by compromised devices was not readily apparent across analyzed compromises. Connections over port 22 were more frequently associated with beaconing and/or C2 activity to endpoints associated with Outlaw, than with potential brute-forcing. As such, Darktrace could not, with high confidence correlate such SSH activity to brute-forcing. This could suggest that threat actors are now portioning or rotation of botnet devices for different operations, for example dividing between botnet expansion and mining operations.

Command line tools

In cases of Outlaw investigated by Darktrace, there was also a degree of variability involving the tools used to retrieve payloads. On the networks of customers affected by Outlaw, Darktrace DETECT identified the use of user agents and command line tools that it considered to be out of character for the network and its devices.

When retrieving the Dota malware payload or shell script data, compromised devices frequently relied on numerous versions of wget and curl user agents. Although the use of such tools as a tactic cannot be definitively linked to the crypto-mining campaign, the employment of varying and/or outdated native command line tools attests to the procedural flexibility of Outlaw campaigns, and its potential for continued evolution.

Figure 4: Breach log data showing use of curl and wget tools to connect to IP addresses associated with Outlaw.

Outlaw in 2023

Given Outlaw’s widespread notoriety and its continued activities, it is likely to remain a prominent threat to organizations and security teams across the threat landscape in 2023 and beyond.

As Darktrace has observed within its customer base from late 2022 through early 2023, activity linked with the Outlaw cryptocurrency mining campaign continues to transpire, offering security teams and research a renewed look at how it has evolved and adapted over the years. While many of its features and tactics appear to have remained consistent, Darktrace has identified numerous signs of Outlaw deviating from its previously known activities.

While relying on previously established IoCs and known tactics from previous campaigns will go some way to protecting an organization’s network from Outlaw compromises, there is a greater need than ever to go further than this. Rather than depending on a list of known-bads or traditional signatures and rules, Darktrace’s anomaly-based approach to threat detection and unparallel autonomous response capabilities mean it is uniquely positioned to DETECT and RESPOND to Outlaw activity, regardless of how it evolves in the future.

Credit to: Adam Potter, Cyber Analyst, Nahisha Nobregas, SOC Analyst, and Ryan Traill, Threat Content Lead

Relevant DETECT Model Breaches:

Compliance / Incoming SSH  

Device / New User Agent and New IP

Device / New User Agent  

Anomalous Connection / New User Agent to IP Without Hostname  

Compromise / Crypto Currency Mining Activity  

Anomalous File / Internet Facing System File Download  

Anomalous Server Activity / New User Agent from Internet Facing System  

Anomalous File / Zip or Gzip from Rare External Location  

Anomalous File / Script from Rare External Location  

Anomalous Connection / Multiple Failed Connections to Rare Endpoint  

Compromise / Large Number of Suspicious Failed Connections  

Anomalous Server Activity / Outgoing from Server  

Compromise / Sustained TCP Beaconing Activity To Rare Endpoint

Indicators of Compromise

Indicator - Type - Description

/dota3.tar.gz​

File  URI​

Outlaw  payload​

/tddwrt7s.sh​

File  URI​

Outlaw  payload​

73e5dbafa25946ed636e68d1733281e63332441d​

SHA1  Hash​

Outlaw  payload​

debian-package[.]center​

Hostname​

Outlaw  C2 endpoint​

161.35.236[.]24​

IP  address​

Outlaw  C2 endpoint​

138.68.115[.]96​

IP  address​

Outlaw C2  endpoint​

67.205.134[.]224​

IP  address​

Outlaw C2  endpoint​

138.197.212[.]204​

IP  address​

Outlaw C2  endpoint​

45.9.148[.]59 ​

IP  address​

Possible  Outlaw C2 endpoint​

45.9.148[.]117​

IP  address​

Outlaw C2  endpoint​

45.9.148[.]125​

IP  address​

Outlaw C2  endpoint​

45.9.148[.]129​

IP  address​

Outlaw C2  endpoint​

45.9.148[.]99 ​

IP  address​

Outlaw C2  endpoint​

45.9.148[.]234​

IP  address​

Possible  Outlaw C2 endpoint​

45.9.148[.]236​

IP  address​

Possible  Outlaw C2 endpoint​

159.203.102[.]122​

IP  address​

Outlaw C2  endpoint​

159.203.85[.]196​

IP  address​

Outlaw C2  endpoint​

159.223.235[.]198​

IP  address​

Outlaw C2  endpoint​

MITRE ATT&CK Mapping

Tactic -Technique

Initial Access -T1190  Exploit - Public Facing Application

Command and Control - T1071 - Application - Layer Protocol

T1071.001 - Application Layer Protocol: Web Protocols

Impact - T1496 Resource Hijacking

INSIDE THE SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
AUTHOR
ABOUT ThE AUTHOR
Adam Potter
Cyber Analyst
Book a 1-1 meeting with one of our experts
share this article
PRODUCT SPOTLIGHT
No items found.
COre coverage
No items found.

More in this series

No items found.

Blog

No items found.

Customer Blog: Community Housing Limited Enhancing Incident Response

Default blog imageDefault blog image
04
Mar 2024

About Community Housing Limited

Community Housing Limited is a non-profit organization based in Australia that focuses on providing affordable, long-term housing and creating employment opportunities where possible. We give people the security of having a home so that they can focus on other essential pathways. As such, we are responsible for sensitive information on our clients.

As part of our commitment to strengthening our cyber security, we sought to simplify and unify our incident response plans and equip our engineers and desktop support teams with all the information we need at our fingertips.

Why Community Housing Limited chose Darktrace

Our team hoped to achieve a response procedure that allowed us to have oversight over any potential security risks, even cases that don’t overtly seem like a security risk. For example, an incident could start as a payroll issue and end up in the hands of HR, instead of surfacing as a security problem. In this case, our security team has no way of knowing the real number of events or how the threat had actually started and played out, making incident response and mitigation even more challenging.

We were already a customer of Darktrace’s autonomous threat detection, attack intervention, and attack surface management capabilities, and decided to add Darktrace for AI-assisted incident response and AI cyber-attack simulation.

AI-generated playbooks save time during incident response

I wanted to reduce the time and resources it took our security team to appropriately respond to a threat. Darktrace automates several steps of the recovery process to accelerate the rate of incident response by using AI that learns the granular details of the specific organization, building a dynamic understanding of the devices, connections, and user behaviors that make up the normal “pattern of life.”  

The AI then uses this understanding to create bespoke, AI-generated incident response playbooks that leverage an evolving understanding of our organization to determine recovery steps that are tailored not only to the specific incident but also to our unique environment.

For my security team, this means having access to all the information we need to respond to a threat. When running through an incident, rather than going to different places to synthesize relevant information, which takes up valuable resources and time, we can speed up its remediation with Darktrace.  

The playbooks created by Darktrace help lower the technical skills required to respond to incidents by elevating the workload of the staff, tripling our capacity for incident response.

Realistic attack simulations upskill teams while saving resources

We have differing levels of experience on the team which means some members know exactly what to do during incident response while others are slower and need more guidance. Thus, we have to either outsource skilled security professionals or add a security solution that could lower the technical skills bar.

You don’t want to be second guessing and searching for the right move – it’s urgent – there should be certainty. Our goal with running attack simulations is to test and train our team's response capabilities in a “realistic” scenario. But this takes considerable time to plan and execute or can be expensive if outsourced, which can be a challenge for organizations short on resources. 

Darktrace provides AI-assisted incident response and cyber-attack simulation using AI that understands the organization to run simulations that effectively map onto the real digital environment and the assets within it, providing training for actual incidents.

It is one thing to sit together in a meeting and discuss various outcomes of a cyber-attack, talking through the best response strategies. It is a huge benefit being able to run attack simulations that emulate real-world scenarios.

Our team can now see how an incident would play out over several days to resemble a real-world scenario or it can play through the simulation quickly to ascertain outcomes immediately. It then uses these insights to strengthen its technology, processes, and training.

AI-Powered Incident Response

Darktrace helps my security team save resources and upskill staff using AI to generate bespoke playbooks and run realistic simulations. Its real-time understanding of our business ensures incident preparedness and incident response are tailored to not only the specific threat in question, but also to the contextual infrastructure of the organization.  

Continue reading
About the author
Jamie Woodland
Head of Technology at Community Housing Limited

Blog

Email

Beyond DMARC: Navigating the Gaps in Email Security

Default blog imageDefault blog image
29
Feb 2024

Email threat landscape  

Email has consistently ranked among the most targeted attack vectors, given its ubiquity and criticality to business operations. From September to December 2023, 10.4 million phishing emails were detected across Darktrace’s customer fleet demonstrating the frequency of attempted email-based attacks.

Businesses are searching for ways to harden their email security posture alongside email providers who are aiming to reduce malicious emails traversing their infrastructure, affecting their clients. Domain-based Message Authentication (DMARC) is a useful industry-wide protocol organizations can leverage to move towards these goals.  

What is DMARC?

DMARC is an email authentication protocol designed to enhance the security of email communication.

Major email service providers Google and Yahoo recently made the protocol mandatory for bulk senders in an effort to make inboxes safer worldwide. The new requirements demonstrate an increasing need for a standardized solution as misconfigured or nonexistent authentication systems continue to allow threat actors to evade detection and leverage the legitimate reputation of third parties.  

DMARC is a powerful tool that allows email administrators to confidently identify and stop certain spoofed emails; however, more organizations must implement the standard for it to reach its full potential. The success and effectiveness of DMARC is dependent on broad adoption of the standard – by organizations of all sizes.  

How does DMARC work?

DMARC builds on two key authentication technologies, Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) and helps to significantly improve their ability to prevent domain spoofing. SPF verifies that a sender’s IP address is authorized to send emails on behalf of a particular domain and DKIM ensures integrity of email content by providing a verifiable digital signature.  

DMARC adds to this by allowing domain owners to publish policies that set expectations for how SPF and DKIM verification checks relate to email addresses presented to users and whose authenticity the receiving mail server is looking to establish.  

These policies work in tandem to help authenticate email senders by verifying the emails are from the domain they say they are, working to prevent domain spoofing attacks. Key benefits of DMARC include:

  1. Phishing protection DMARC protects against direct domain spoofing in which a threat actor impersonates a legitimate domain, a common phishing technique threat actors use to trick employees to obtain sensitive information such as privileged credentials, bank information, etc.  
  2. Improving brand reputation: As DMARC helps to prevent impersonation of domains, it stands to maintain and increase an organization’s brand reputation. Additionally, as organizational reputation improves, so will the deliverability of emails.
  3. Increased visibility: DMARC provides enhanced visibility into email communication channels, including reports of all emails sent on behalf of your domain. This allows security teams to identify shadow-IT and any unauthorized parties using their domain.

Understanding DMARC’s Limitations

DMARC is often positioned as a way for organizations to ‘solve’ their email security problems, however, 65% of the phishing emails observed by Darktrace successfully passed DMARC verification, indicating that a significant number of threat actors are capable of manipulating email security and authentication systems in their exploits. While DMARC is a valuable tool in the fight against email-based attacks, the evolving threat landscape demands a closer look at its limitations.  

As threat actors continue to innovate, improving their stealth and evasion tactics, the number of attacks with valid DMARC authentication will only continue to increase in volume and sophistication. These can include:

  1. Phishing attacks that leverage non-spoofed domains: DMARC allows an organization to protect the domains that they own, preventing threat actors from being able to send phishing emails from their domains. However, threat actors will often create and use ‘look-a-like’ domains that closely resemble an organization’s domain to dupe users. 3% of the phishing emails identified by Darktrace utilized newly created domains, demonstrating shifting tactics.  
  2. Email Account Takeovers: If a threat actor gains access to a user’s email account through other social engineering means such as credential stuffing, they can then send phishing emails from the legitimate domain to pursue further attacks. Even though these emails are malicious, DMARC would not identify them as such because they are coming from an authorized domain or sender.  

Organizations must also ensure their inbound analysis of emails is not skewed by successful DMARC authentication. Security teams cannot inherently trust emails that pass DMARC, because the source cannot always be legitimized, like in the event of an account takeover. If a threat actor gains access to an authenticated email account, emails sent by the threat actor from that account will pass DMARC – however the contents of that email may be malicious. Sender behavior must be continuously evaluated and vetted in real time as past communication history and validated DMARC cannot be solely relied upon amid an ever-changing threat landscape.  

Security teams should lean on other security measures, such as anomaly detection tools that can identify suspicious emails without relying on historical attack rules and static data. While DMARC is not a silver bullet for email security, it is nevertheless foundational in helping organizations protect their brand identity and must be viewed as an essential layer in an organization's overall cyber security strategy.  

Implementing DMARC

Despite the criticality of DMARC for preserving brand reputation and trust, adoption of the standard has been inconsistent. DMARC can be complex to implement with many organizations lacking the time required to understand and successfully implement the standard. Because of this, DMARC set-up is often outsourced, giving security and infrastructure teams little to no visibility into or control of the process.  

Implementation of DMARC is only the start of this process, as DMARC reports must be consistently monitored to ensure organizations have visibility into who is sending mail from their domain, the volume of mail being sent and whether the mail is passing authentication protocols. This process can be time consuming for security teams who are already faced with mounting responsibilities, tight budgets, and personnel shortages. These complexities unfortunately delay organizations from using DMARC – especially as many today still view it as a ‘nice to have’ rather than an essential.  

With the potential complexities of the DMARC implementation process, there are many ways security and infrastructure teams can still successfully roll out the standard. Initial implementation should start with monitoring, policy adjustment and then enforcement. As business changes over time, DMARC should be reviewed regularly to ensure ongoing protection and maintain domain reputation.

The Future of Email Security

As email-based attacks continue to rise, the industry must recognize the importance of driving adoption of foundational email authentication protocols. To do this, a new and innovative approach to DMARC is needed. DMARC products must evolve to better support organizations throughout the ongoing DMARC monitoring process, rather than just initial implementation. These products must also be able to share intelligence across an organization’s security stack, extending beyond email security tools. Integration across these products and tools will help organizations optimize their posture, ensuring deep understanding of their domain and increased visibility across the entire enterprise.

DMARC is critical in protecting brand identity and mitigating exact-domain based attacks. However, organizations must understand DMARC’s unique benefits and limitations to ensure their inboxes are fully protected. In today’s evolving threat landscape, organizations require a robust, multi-layered approach to stop email threats – in inbound mail and beyond. Email threats have evolved – its time security does too.

Join Darktrace on 9 April for a virtual event to explore the latest innovations needed to get ahead of the rapidly evolving threat landscape. Register today to hear more about our latest innovations coming to Darktrace’s offerings. For additional insights check out Darktrace’s 2023 End of Year Threat Report.

Credit to Carlos Gray and Stephen Pickman for their contribution to this blog

Continue reading
About the author
Carlos Gray
Product Manager

Good news for your business.
Bad news for the bad guys.

Start your free trial

Start your free trial

Flexible delivery
Cloud-based deployment.
Fast install
Just 1 hour to set up – and even less for an email security trial.
Choose your journey
Try out Self-Learning AI wherever you most need it — including cloud, network or email.
No commitment
Full access to the Darktrace Threat Visualizer and three bespoke Threat Reports, with no obligation to purchase.
For more information, please see our Privacy Notice.
Thanks, your request has been received
A member of our team will be in touch with you shortly.
YOU MAY FIND INTERESTING
Oops! Something went wrong while submitting the form.

Get a demo

Flexible delivery
You can either install it virtually or with hardware.
Fast install
Just 1 hour to set up – and even less for an email security trial.
Choose your journey
Try out Self-Learning AI wherever you most need it — including cloud, network or email.
No commitment
Full access to the Darktrace Threat Visualizer and three bespoke Threat Reports, with no obligation to purchase.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.