Resurgence of Ursnif Banking Trojan "May's Most Wanted Malware"
22
Jul 2020
22
Jul 2020
The Ursnif banking trojan tries to blend into the network as legitimate Zoom and Webex activity, trying to capture credentials. See how Darktrace stops it!
Earlier this month, Darktrace’s Cyber AI detected the Ursnif banking trojan, described as May’s most wanted malware, making a resurgence across its customers’ networks. This blog follows the malicious activity in one financial services company in the US, detailing how and why Darktrace Antigena stepped in and autonomously stopped the attack in real time.
Banking trojans continue to present a credible and persistent threat to organizations of all sizes across the globe. This attack was delivered via phishing email, which initiated a download of an executable file masquerading as a .cab extension.
This specific banking trojan is particularly sophisticated, with multiple new command and control (C2) domains registered – identifiable because several distinct Domain Generation Algorithms (DGA) were observed across different networks – the majority of which were only registered the day prior to the campaign.
Figure 1: A timeline of the attack
Phishing email catches organizations unaware
The malware itself was delivered via phishing email. The attack was not recognized by antivirus solutions at the time of delivery, slipping through the organization’s perimeter solutions and landing in employees’ inboxes. Unknowingly, an employee opened a disguised attachment containing macros, downloading an executable file masquerading as a .cab extension.
Interestingly, the malware also used new User Agents imitating Zoom and Webex, a clear attempt to blend in with assumed network traffic. After the malware was downloaded, several devices were observed making connections using these Zoom or Webex User Agents to non-Zoom and non-Webex domains, another attempt to blend in.
Figure 2: Darktrace’s Breach Event Log shows a number of models were triggered
Figure 3: Darktrace’s Device Event Log showing the device was connected to Outlook at the time of the executable file download
After the downloads, Darktrace’s AI observed beaconing to rare DGA domains. The majority of these domains were Russian and registered within the previous 24 hours.
Figure 4: A screenshot taken from one of the C2 domains observed, tobmojiol2adf[.]com, which appears to host a login page
Figure 5: The External Sites Summary of one of the C2 domains observed, tobmojiol2adf[.]com, which was identified as 100% rare for the network at the time of the model breach.
This attack managed to evade the rest of the organization’s security stack since the domains observed were recently registered and the majority of the file hashes and IoCs had not yet been flagged by OSINT tools, thus bypassing all signature-based detections. The initial file downloads also purported to be .cab files, but Darktrace’s AI identified that these were in fact executable files.
Multiple Darktrace detections, including the ‘Masqueraded File Transfer’ model and the ‘Initial Breach Chain Compromise’ model, alerted the security team to this activity. At the same time, the models triggered Darktrace’s Cyber AI Analyst to launch an automated investigation into the security incident, which surfaced additional vital information and dramatically reduced time to triage.
Figure 6: The Cyber AI Analyst output showing the subsequent C2 connections made by the device after the executable file download
Figure 7: Model breaches from the affected device, showing the malicious file download and subsequent command and control beaconing activity
Figure 8: Model Breach Event Log, showing Antigena’s response after the masqueraded file download and a new outbound connection
The case for Autonomous Response
The Ursnif banking trojan presents a particularly lethal threat: silent, stealthy, and capable of stealing vital financial information, email credentials, and other sensitive data at machine speeds. The rise of advanced malware like this demonstrates the need for security technology that can stay ahead of attackers. For this organization, the malware download and subsequent command and control activity could have represented the start of a costly attack.
Luckily the organization had Antigena Network installed in active mode. The C2 communications from infected devices were blocked seconds after the initial connection, preventing further C2 activity and the download of any additional malware. Using information surfaced by the Cyber AI Analyst, the security team could catch up and the threat was quickly contained.
This attack highlights the continuously evolving approaches used by malicious actors to evade detection. In the same week as the events explained above, Darktrace identified the Urnsnif malware in numerous other customers in the US and Italy, across multiple industries. Attackers are targeting businesses indiscriminately and are not slowing down.
Thanks to Darktrace analysts Grace Carballo and Hiromi Watanabe for their insights on the above threat find.
To learn how cyber-criminals are using AI to augment their attacks, download the White Paper: The Battle of the Algorithms
Technical details
IoCs:
Commenttobmojiol2adf[.]com – C2 domain, registered July 9 qumogtromb2a[.]com – Not yet registered amehota2gfgh[.]com – C2 domain, registered July 8 gofast22gfor[.]com – C2 domain, registered July 8 xquptbabzxhxw[.]com – Not yet registered e9bja[.]com
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
AUTHOR
ABOUT ThE AUTHOR
Max Heinemeyer
Chief Product Officer
Max is a cyber security expert with over a decade of experience in the field, specializing in a wide range of areas such as Penetration Testing, Red-Teaming, SIEM and SOC consulting and hunting Advanced Persistent Threat (APT) groups. At Darktrace, Max is closely involved with Darktrace’s strategic customers & prospects. He works with the R&D team at Darktrace, shaping research into new AI innovations and their various defensive and offensive applications. Max’s insights are regularly featured in international media outlets such as the BBC, Forbes and WIRED. Max holds an MSc from the University of Duisburg-Essen and a BSc from the Cooperative State University Stuttgart in International Business Information Systems.
With the rise of GenAI and novel attacks, organizations can no longer rely solely on traditional network security solutions that depend on historical attack data, such as signatures and detection rules, to identify threats. However, in many cases network security vendors and traditional solutions like IDS/IPS focus on detecting known attacks using historical data. What happens is organizations are left vulnerable to unknown and novel threats, as these approaches only detect known malicious behavior and cannot keep up with unknown threats or zero-day attacks.
Advanced threats
Darktrace's End of Year Threat Report for 2023 highlights significant changes in the cyber threat landscape, particularly due to advancements in technology such as generative AI. The report notes a substantial increase in sophisticated attacks, including those utilizing generative AI, which have made it more challenging for traditional security measures to keep up. The report also details the rise of multi-functional malware, like Black Basta ransomware, which not only encrypts data for ransom but also spreads other types of malware such as the Qbot banking trojan. These complex attacks are increasingly being deployed by advanced cybercriminal groups, underscoring the need for organizations to adopt advanced security measures that can detect and respond to novel threats in real-time.
Defenders need a solution that can level the playing field, especially when they are operating with limited resources and getting overloaded with endless alerts. Most network security tools on the market have a siloed approach and do not integrate with the rest of an organization’s digital estate, but attackers don’t operate in a single domain.
Disparate workforce
With so many organizations continuing to support a remote or hybrid working environment, the need to secure devices that are outside the corporate network or off-VPN is increasingly important. While endpoint protection or endpoint detection and response (EDR) tools are a fundamental part of any security stack, it’s not possible to install an agent on every device, which can leave blind spots in an organization’s attack surface. Managing trust and access policies is also necessary to protect identities, however this comes with its own set of challenges in terms of implementation and minimizing business disruption.
This blog will dive into these challenges and show examples of how Darktrace has helped mitigate risk and stop novel and never-before-seen threats.
Network Security Challenge 1: Managing trust
What is trust in cybersecurity?
Trust in cybersecurity means that an entity can be relied upon. This can involve a person, organization, or system to be authorized or authenticated by proving their identity is legitimate and can be trusted to have access to the network or sensitive information.
Why is trust important in cybersecurity?
Granting access and privileges to your workforce and select affiliates has profound implications for cybersecurity, brand reputation, regulatory compliance, and financial liability. In a traditional network security model, traffic gets divided into two categories — trusted and untrusted — with some entities and segments of the network deemed more creditable than others.
How do you manage trust in cybersecurity?
Zero trust is too little, but any is too much.
Modern network security challenges point to an urgent need for organizations to review and update their approaches to managing trust. External pressure to adopt zero trust security postures literally suggests trusting no one, but that impedes your freedom to do business. IT leaders need a proven but practical process for deciding who should be allowed to use your network and how.
Questions to ask in updating Trusted User policies include:
What process should you follow to place trust in third parties and applications?
Do you subject trusted entities to testing and other due diligence first?
How often do you review this process — and trusted relationships themselves — after making initial decisions?
How do you tell when trusted users should no longer be trusted?
Once trust has been established, security teams need new and better ways to autonomously verify that those transacting within your network are indeed those trusted users that they claim to be, taking only the authorized actions you’ve allowed them to take.
Exploiting trust in the network
Insider threats have a major head start. The opposite of attacks launched by nameless, faceless strangers, insider threats originate through parties once deemed trustworthy. That might mean a current or former member of your workforce or a partner, vendor, investor, or service provider authorized by IT to access corporate systems and data. Threats also arise when a “pawn” gets unwittingly tricked into disclosing credentials or downloading malware.
Common motives for insider attacks include revenge, stealing or leaking sensitive data, taking down IT systems, stealing assets or IP, compromising your organization’s credibility, and simply harassing your workforce. Put simply, rules and signatures based security solutions won’t flag insider threats because an insider does not immediately present themselves as an intruder. Insider threats can only be stopped by an evolving understanding of ‘normal’ for every user that immediately alerts your team when trusted users do something strange.
“By 2026, 10% of large enterprises will have a comprehensive, mature and measurable zero-trust program in place, up from less than 1% today.” [1]
Darktrace/OT detected a subtle deviation from normal behavior when a reprogram command was sent by an engineering workstation to a PLC controlling a pump, an action an insider threat with legitimized access to OT systems would take to alter the physical process without any malware involved. In this instance, AI Analyst, Darktrace’s investigation tool that triages events to reveal the full security incident, detected the event as unusual based on multiple metrics including the source of the command, the destination device, the time of the activity, and the command itself.
As a result, AI Analyst created a complete security incident, with a natural language summary, the technical details of the activity, and an investigation process explaining how it came to its conclusion. By leveraging Explainable AI, a security team can quickly triage and escalate Darktrace incidents in real time before it becomes disruptive, and even when performed by a trusted insider.
Ransomware is a type of malware that encrypts valuable files on a victim’s device, denying the account holder access, and demanding money in exchange for the encryption key. Ransomware has been increasingly difficult to deal with, especially with ransom payments being made in crypto currency which is untraceable. Ransomware can enter a system by clicking a link dangerous or downloading malicious files.
Avoiding ransomware attacks ranks at the top of most CISOs’ and risk managers’ priority lists, and with good reason. Extortion was involved in 25% of all breaches in 2022, with front-page attacks wreaking havoc across healthcare, gas pipelines, food processing plants, and other global supply chains. [2]
What else is new?
The availability of “DIY” toolkits and subscription-based ransom- ware-as-a-service (RaaS) on the dark web equips novice threat actors to launch highly sophisticated attacks at machine speed. For less than $500, virtually anyone can acquire and tweak RaaS offerings such as Philadelphia that come with accessible customer interfaces, reviews, discounts, and feature updates — all the signature features of commercial SaaS offerings.
The preeminence of ransomware keeps security teams on high alert for indicators of attack but hypervigilance — and too many tools churning out too many alerts — quickly exhausts analysts’ bandwidth. To reverse this trend, AI needs to help prioritize and resolve versus merely detect risk.
Darktrace uses AI to recognize and contextualize possible signs of ransomware attacks as they appear in your network and across multiple domains. Viewing behaviors in the context of your organization’s normal ‘pattern of life’ updates and enhances detection that watches for a repeat of previous techniques.
Darktrace's AI brings the added advantage of continuously analyzing behavior in your environment at machine speed.
Darktrace AI also performs Autonomous Response, shutting down attacks at every stage of the ransomware cycle, including the first telltale signs of exfiltration and encryption of data for extortion purposes.
Hive is distributed via a RaaS model where its developers update and maintain the code, in return for a percentage of the eventual ransom payment, while users (or affiliates) are given the tools to carry out attacks using a highly sophisticated and complex malware they would otherwise be unable to use.
In early 2022, Darktrace/Network identified several instances of Hive ransomware on the networks of multiple customers. Using its anomaly-based detection, Darktrace was able to successfully detect the attacks and multiple stages of the kill chain, including command and control (C2) activity, lateral movement, data exfiltration, and ultimately data encryption and the writing of ransom notes.
Darktrace’s AI understands customer networks and learns the expected patterns of behavior across an organization’s digital estate. Using its anomaly-based detection Darktrace is able to identify emerging threats through the detection of unusual or unexpected behavior, without relying on rules and signatures, or known IoCs.
You can’t predict tomorrow’s weather by reading yesterday’s forecast, yet that’s essentially what happens when network security tools only look for known attacks.
What are novel attacks?
“Novel attacks” include unknown or previously unseen exploits such as zero-days, or new variations of known threats that evade existing detection rules.
Depending on how threats get executed, the term “novel” can refer to brand new tactics, techniques, and procedures (TTPs), or to subtle new twists on perennial threats like DoS, DDoS, and Domain Name Server (DNS) attacks.
Old tools may be blind to new threats
Stopping novel threats is less about deciding whom to trust than it is about learning to spot something brand new. As we’ve seen with ransomware, the growing “aaS” attack market creates a profound paradigm shift by allowing non-technical perpetrators to tweak, customize, and coin never-before-seen threats that elude traditional network, email, VPN, and cloud security.
Tools based on traditional rules and signatures lack a frame of reference. This is where AI’s ability to spot and analyze abnormalities in the context of normal patterns of life comes into play.
Darktrace AI spots what other tools miss
Instead of training in cloud data lakes that pool data from unrelated attacks worldwide, Darktrace AI learns about your unique environment from your environment. By flagging and analyzing everything unusual — instead of only known signs of compromise — Darktrace’s Self-Learning AI keeps security stacks from missing less obvious but potentially more dangerous events.
The real challenge here is achieving faster “time to meaning” and contextualizing behavior that might — or might not — be part of a novel attack. Darktrace/Network does not require a “patient zero” to identify a novel attack, or one exploiting a zero-day vulnerability.
In late May 2023, Darktrace observed multiple instances of Akira ransomware affecting networks across its customer base. Thanks to its anomaly-based approach to threat detection Darktrace successfully identified the novel ransomware attacks and provided full visibility over the cyber kill chain, from the initial compromise to the eventual file encryptions and ransom notes. Darktrace identified Akira ransomware on multiple customer networks, even when threat actors were utilizing seemingly legitimate services (or spoofed versions of them) to carry out malicious activity. While this may have gone unnoticed by traditional security tools, Darktrace’s anomaly-based detection enabled it to recognize malicious activity for what it was. In cases where Darktrace’s autonomous response was enabled these attacks were mitigated in their early stages, thus minimizing any disruption or damage to customer networks.
Post-Exploitation Activities on PAN-OS Devices: A Network-Based Analysis
20
Jun 2024
Introduction
Perimeter devices such as firewalls, virtual private networks (VPNs), and intrusion prevention systems (IPS), have long been the target of adversarial actors attempting to gain access to internal networks. However, recent publications and public service announcements by leading public institutions underscore the increased emphasis threat actors are putting on leveraging such products to initiate compromises.
A blog post by the UK National Cyber Security Center (NCSC) released in early 2024 notes that as improvements are made in the detection of phishing email payloads, threat actors have again begun re-focusing efforts to exploiting network edge devices, many of which are not secure by design, as a means of breach initiation.[i] As such, it comes as no surprise that new Common Vulnerabilities and Exposures (CVEs) are constantly discovered that exploit such internet-exposed systems.
Darktrace analysts frequently observe the impacts of such CVEs first through their investigations via Darktrace’s Security Operations Center (SOC), sometimes even before the public disclosure of proof of concepts for such exploits. Beginning April 2024, Darktrace’s SOC began handling alerts and customer requests for potential incidents involving Palo Alto Networks firewall devices. It was during this time that external researchers publicly disclosed what would later be classified as PAN-OS CVE-2024-3400, a form of remote command execution vulnerability that affects several versions of Palo Alto Networks’ firewall operating System (PAN-OS), namely PAN-OS 11.1, 11.0 and 10.2.
The increase in observed SOC activity for Palo Alto firewall devices, coupled with the public announcement of the new CVE, prompted Darktrace researchers to look for evidence of PAN-OS exploitation on customer networks. Researchers also focused on documenting post-exploitation activity from threat actors leveraging the recently disclosed vulnerability.
As such, this blog highlights the network-based behaviors involved in the CVE-2024-3400 attack chains investigated by Darktrace’s SOC and Threat Research teams. Moreover, this investigation also provides a deeper insight into the post-compromise activities of threat actors leveraging the novel CVE. Such insights will not only prove relevant for cybersecurity teams looking to inhibit compromises in this specific instance, but also highlights general patterns of behavior by threat actors utilizing such CVEs to target internet-facing systems.
CVE-2024-3400
In April 2024, the Darktrace SOC observed an uptick in activity involving recurring patterns of malicious activity from Palo Alto firewall appliances. In response to this trend, Darktrace initiated a Threat Research investigation into such activity to try and identify common factors and indicators across seemingly parallel events. As the Threat Research team opened their investigation, external researchers concurrently provided public details of CVE-2024-3400, a form of remote command execution vulnerability in the GlobalProtect feature on Palo Alto Network firewall devices running PAN-OS versions: 10.2, 11.0, and 11.1.[ii]
In their proof of concept, security researchers at watchTowr demonstrated how an attacker can pass session ID (SESSID) values to these PAN-OS devices to request files that do not exist. In response, the system creates a zero-byte file with root privileges with the same name.[iii] Log data is passed on devices running telemetry services to external servers through command line functionality.[iv] Given this functionality, external actors could then request non-existent files in the SESSID containing command parameters which then be interpreted by the command line functionality.[v] Although researchers first believed the exploit could only be used against devices running telemetry services, this was later discovered to be untrue.[vi]
As details of CVE-2024-3400 began to surface, Darktrace’s Threat Research analysts quickly identified distinct overlaps in the observed activity on specific customer deployments and the post-exploitation behavior reported by external researchers. Given the parallels, Darktrace correlated the patterns of activity observed by the SOC team to exploitation of the newly discovered vulnerability in PAN-OS firewall appliances.
Campaign Analysis
Between the April and May 2024, Darktrace identified four main themes of post-exploitation activity involving Palo Alto Network firewall devices likely targeted via CVE-2024-3400: exploitation validation, shell command and tool retrieval, configuration data exfiltration, and ongoing command and control through encrypted channels and application protocols.
1. Exploit Validation and Further Vulnerability Enumeration
Many of the investigated attack chains began with malicious actors using out-of-band application security testing (OAST) services such as Interactsh to validate exploits against Palo Alto firewall appliances. This exploit validation activity typically resulted in devices attempting to contact unusual external endpoints (namely, subdomains of ‘oast[.]pro’, ‘oast[.]live’, ‘oast[.]site’, ‘oast[.]online’, ‘oast[.]fun’, ‘oast[.]me’, and ‘g3n[.]in’) associated with OAST services such as Interactsh. These services can be used by developers to inspect and debug internet traffic, but also have been easily abused by threat actors.
While attempted connections to OAST services do not alone indicate CVE-2024-3400 exploitation, the prevalence of such activities in observed Palo Alto firewall attack chains suggests widespread usage of these OAST services to validate initial access methods and possibly further enumerate systems for additional vulnerabilities.
Figure 1: Model alert log details showcasing a PAN-OS device making DNS queries for Interactsh domain names in what could be exploit validation, and/or further host enumeration.
2. Command and Payload Transmission
The most common feature across analyzed incidents was HTTP GET requests for shell scripts and Linux executable files (ELF) from external IPs associated with exploitation of the CVE. These HTTP requests were frequently initiated using the utilities, cURL and wget. On nearly every device likely targeted by threat actors leveraging the CVE, Darktrace analysts highlighted the retrieval of shell scripts that either featured enumeration commands, the removal of evidence of compromise activity, or commands to retrieve and start binaries on the destination device.
a) Shell Script Retrieval
Investigated devices commonly performed HTTP GET requests to retrieve shell command scripts. Despite this commonality, there was some degree of variety amongst the retrieved payloads and their affiliation with certain command tools. Several distinct types of shell commands and files were identified during the analyzed breaches. For example, some firewall devices were seen requesting .txt files associated with both Sliver C2, whose malicious use has previously been investigated by Darktrace, and Cobalt Strike. The target URIs of devices’ HTTP requests for these files included, “36shr.txt”, “2.txt”, “bin.txt”, and “data.txt”.
More interestingly, though, was the frequency with which analyzed systems requested bash scripts from rare external IP addresses, sometimes over non-standard ports for the HTTP protocol. These bash scripts would feature commands usually for the recipient system to check for certain existing files and or running processes. If the file did not exist, the system would then use cURL or wget to obtain content from external sites, change the permissions of the file, and then execute, sending output to dev/null as a means of likely defense evasion. In some scripts, the system would first make a new folder, and change directories prior to acquiring external content. Additionally, some samples highlighted multiple attempts at enumeration of the host system.
Figure 2: Packet capture (PCAP) data highlighting the incoming shell scripts providing instructions to use cURL to obtain external content, change the permissions of the file to execute, and then run the binary using the credentials and details provided.
Figure 3: PCAP data highlighting a variation of a shell script seen in an HTTP response processed by compromised devices. The script provides instructions to make a directory, retrieve and execute external content, and to hide the output.
Not every retrieved file that was not explicitly a binary featured bash scripts. Model alerts on some deployments also included file masquerading attempts by threat actors, whereby the Palo Alto firewall device would request content with a misleading extension in the URI. In one such instance, the requested URI, and HTTP response header suggests the returned content is an image/png, but the actual body response featured configuration parameters for a new daemon service to be run on the system.
Figure 4: PCAP data indicating configuration details likely for a new daemon on an investigated host. Such HTTP body content differs from the image/png extension within the request URI and declared content type in the HTTP response header.
Bash scripts analyzed across customer deployments also mirrored those identified by external security teams. External researchers previously reported on a series of identifiable shell commands in some cases of CVE-2024-3400 exploitation analyzed by their teams. Commands frequently involved a persistence mechanism they later labeled as the “UPSTYLE” backdoor.[vii] This python-based program operates by reading commands hidden in error logs generated by 404 requests to the compromised server. The backdoor interprets the requests and writes the output to CSS files on the device. In many cases, Darktrace’s Threat Research team noted clear parallels between shell commands retrieved via HTTP GET request with those directly involving UPSTYLE. There were also matches with some URI patterns identified with the backdoor and requests observed on Darktrace deployments.
Figure 5: HTTP response data containing shell commands potentially relating to the UPSTYLE backdoor.
The presence of these UPSTYLE-related shell commands in response to Palo Alto firewall devices’ HTTP requests provides further evidence for initial exploitation of the CVE. Many bash scripts in examined cases interacted with folders and files likely related to CVE-2024-3400 exploitation. These scripts frequently sought to delete contents of certain folders, such as “/opt/panlogs/tmp/device_telemetry/minute/*” where evidence of exploitation would likely reside. Moreover, recursive removal and copy commands were frequently seen targeting CSS files within the GlobalProtect folder, already noted as the vulnerable element within PAN-OS versions. This evidence is further corroborated by host-based forensic analysis conducted by external researchers.[viii]
Figure 6: PCAP data from investigated system indicating likely defense evasion by removing content on folders where CVE exploitation occurred.
b) Executable File Retrieval
Typically, following command processing, compromised Palo Alto firewall devices proceeded to make web requests for several unusual and potentially malicious files. Many such executables would be retrieved via processed scripts. While there a fair amount of variety in specific executables and binaries obtained, overall, these executables involved either further command tooling such as Sliver C2 or Cobalt Strike payloads, or unknown executables. Affected systems would also employ uncommon ports for HTTP connections, in a likely attempt to evade detection. Extensions featured within the URI, when visible, frequently noted ‘.elf’ (Linux executable) or ‘.exe’ payloads. While most derived hashes did not feature identifiable open-source intelligence (OSINT) details, some samples did have external information tying the sample to specific malware. For example, one such investigation featured a compromised system requesting a file with a hash identified as the Spark malware (backdoor) while another investigated case included a host requesting a known crypto-miner.
Figure 7: PCAP data highlighting compromised system retrieving ELF content from a rare external server running a simple Python HTTP server.
Figure 8: Darktrace model alert logs highlighting a device labeled “Palo Alto” making a HTTP request on an uncommon port for an executable file following likely CVE exploitation.
3. Configuration Data Exfiltration and Unusual HTTP POST Activity
During Darktrace’s investigations, there were also several instances of sensitive data exfiltration from PAN-OS firewall devices. Specifically, targeted systems were observed making HTTP POST requests via destination port 80 to rare external endpoints that OSINT sources associate with CVE-2024-3400 exploitation and activity. PCAP analysis of such HTTP requests revealed that they often contained sensitive configuration details of the targeted Palo Alto firewall devices, including the IP address, default gateway, domain, users, superusers, and password hashes, to name only a few. Threat actors frequently utilized Target URIs such as “/upload” in their HTTP POST requests of this multi-part boundary form data. Again, the User-Agent headers of these HTTP requests largely involved versions of cURL, typically 7.6.1, and wget.
Figure 9: PCAP datahighlighting Palo Alto Firewall device running vulnerable version of PAN-OSposting configuration details to rare external services via HTTP.
Figure 10: Model alert logs highlighting a Palo Alto firewall device performing HTTP POSTs to a rare external IP, without a prior hostname lookup, on an uncommon port using a URI associated with configuration data exfiltration across analyzed incidents
Figure 11: Examples of TargetURIs of HTTP POST requests involving base64 encoded IPs and potential dataegress.
4.Ongoing C2 and Miscellaneous Activity
Lastly, a smaller number of affected Palo Alto firewall devices were seen engaging in repeated beaconing and/or C2 communication via both encrypted and unencrypted protocols during and following the initial series of kill chain events. Such encrypted channels typically involved protocols such as TLS/SSL and SSH. This activity likely represented ongoing communication of targeted systems with attacker infrastructure. Model alerts typically highlighted unusual levels of repeated external connectivity to rare external IP addresses over varying lengths of time. In some investigated incidents, beaconing activity consisted of hundreds of thousands of connections over several days.
Figure 12: Advanced search details highlighting high levels of ongoing external communication to endpoints associated with C2 infrastructure exploiting CVE-2024-3400.
Some beaconing activity appears to have involved the use of the WebSocket protocol, as indicated by the appearance of “/ws” URIs and validated within packet captures. Such connections were then upgraded to an encrypted connection.
Figure 13: PCAP highlighting use of WebSocket protocol to engage in ongoing external connectivity to likely C2 infrastructure following CVE-2024-3400 compromise.
While not directly visible in all the deployments, some investigations also yielded evidence of attempts at further post-exploitation activity. For example, a handful of the analyzed binaries that were downloaded by examined devices had OSINT information suggesting a relation to crypto-mining malware strains. However, crypto-mining activity was not directly observed at this time. Furthermore, several devices also triggered model alerts relating to brute-forcing activity via several authentication protocols (namely, Keberos and RADIUS) during the time of compromise. This brute-force activity likely represented attempts to move laterally from the affected firewall system to deeper parts of the network.
Figure 14: Model alert logs noting repeated SSL connectivity to a Sliver C2-affiliated endpoint in what likely constitutes C2 connectivity.
Figure 15: Model alert logs featuring repeated RADIUS login failures from a compromised PAN-OS device using generic usernames, suggesting brute-force activity.
Conclusion
Between April and late May 2024, Darktrace’s SOC and Threat Research teams identified several instances of likely PAN-OS CVE-2024-3400 exploitation across the Darktrace customer base. The subsequent investigation yielded four major themes that categorize the observed network-based post-exploitation activity. These major themes were exploit validation activity, retrieval of binaries and shell scripts, data exfiltration via HTTP POST activity, and ongoing C2 communication with rare external endpoints. The insights shared in this article will hopefully contribute to the ongoing discussion within the cybersecurity community about how to handle the likely continued exploitation of this vulnerability. Moreover, this article may also help cybersecurity professionals better respond to future exploitation of not only Palo Alto PAN-OS firewall devices, but also of edge devices more broadly.
Threat actors will continue to discover and leverage new CVEs impacting edge infrastructure. Since it is not yet known which CVEs threat actors will exploit next, relying on rules and signatures for the detection of exploitation of such CVEs is not a viable approach. Darktrace’s anomaly-based approach to threat detection, however, is well positioned to robustly adapt to threat actors’ changing methods, since although threat actors can change the CVEs they exploit, they cannot change the fact that their exploitation of CVEs results in highly unusual patterns of activity.
Credit to Adam Potter, Cyber Analyst, Sam Lister, Senior Cyber Analyst
