Unmasking the Cyber Mirage: A Journey Through Gulf Region Cyberattacks

October 15, 2024

Unmasking the Cyber Mirage: A Journey Through Gulf Region Cyberattacks

Have you ever wondered how cybercriminals weave into secure networks, especially in regions as digitally fortified as the Gulf? Grab a cup of coffee (or tea, if you prefer), and let’s dive into a tale that unravels the mysterious cyberattacks targeting the UAE and Gulf regions.

The Digital Sandstorm: Understanding the Attack

Imagine you’re sitting in your office in Dubai, overlooking the stunning skyline. Suddenly, an email pops up with the subject line: “Exclusive Investment Opportunity in Oil Reserves!” Intriguing, right? You click on it, and just like that, you’ve unwittingly opened the gates to a cyber onslaught.

This is how groups like Earth Simnavaz operate. They craft well-researched, personalized emails — known as spear phishing — to lure unsuspecting individuals into clicking malicious links or downloading infected attachments.

Reconnaissance: The attackers scan for vulnerable Exchange servers or public-facing applications (T1190 — Exploit Public-Facing Application) to find entry points.
Initial Access via Exploit: They leverage vulnerabilities like CVE-2024–30088 to exploit public-facing servers, often Microsoft Exchange, by sending spear-phishing emails or exploiting known vulnerabilities.
Execution of Web Shell: Once access is obtained, they deploy a web shell on the Exchange server to maintain persistence and execute arbitrary commands remotely. The web shell communicates back to the threat actor, facilitating further intrusion (T1059 — Command and Scripting Interpreter).
Persistence: The attackers install an Exchange backdoor and set up mechanisms to maintain persistence (T1041 — Exfiltration Over C2 Channel) via tools like the ngrok service, which tunnels through firewalls and bypasses detection using obfuscated protocol tunneling (T1572).
Privilege Escalation: They leverage the CVE-2024–30088 vulnerability or other privilege escalation techniques (T1068) to gain higher privileges, allowing them full control over the compromised system. They register malicious password filter DLLs (T1566.002) to capture credentials.
Defense Evasion: They disable logging mechanisms and use obfuscated tunnels to communicate back to the Command and Control (C2) server to avoid detection.
Credential Access and Data Exfiltration: Using the backdoor, attackers gather sensitive data such as credentials and internal documents, exfiltrating it through secure communication channels back to their servers.
Command and Control (C2): Communication between the compromised system and the attacker’s server continues via encrypted tunnels (T1071 — Application Layer Protocol), maintaining control of the system.

Image taken from Earth Simnavaz Levies Advanced Cyberattacks Against UAE and Gulf Regions | Trend Micro (US)

1. The Sneaky Web Shell

Imagine a secret door hidden in plain sight, allowing someone to slip into your house without a key. That’s essentially what a web shell is — a malicious script uploaded to a web server that provides remote access and control.

How It Works Without the Fancy Graphics

HTTP Request Handling: The web shell receives commands through HTTP headers. Think of it like passing secret notes in class.
Extracting Values: It looks for specific headers like “func” and “command.”
“func” Parameter: Determines what action to perform — run a command, upload a file, or download a file.
“command” Parameter: Contains the actual instructions, often encrypted to avoid detection.
Executing Commands: Runs PowerShell commands sent by the attacker.
Uploading Files: Allows the attacker to place malicious files on the server.
Downloading Files: This enables the attacker to retrieve files from the server.

It’s like the attacker is sending secret instructions to the server, telling it what mischief to carry out.

2. The Art of Decryption and Encryption

To keep their communications secret, attackers use encryption — like speaking in code that only they can understand.

Decryption Function:

Purpose: Takes an encrypted, Base64-encoded string and turns it back into readable text.
How It Works: Uses a predefined key and initialization vector (IV) to decrypt the data.
Result: The original command or data is revealed.

Encryption Function:

Purpose: Encrypts the server’s responses before sending them back to the attacker.
How It Works: Uses the same key and IV to ensure only the attacker can decrypt the information.
Result: Keeps the communication hidden from prying eyes.

Imagine sending messages in a language only you and your friend understand, so no one else can eavesdrop.

3. The Loader and Privilege Escalation

This is where the attacker levels up their game, gaining more control over the system.

The Loader:

Role: A small program that prepares the main payload (the actual malicious code).
Decoding the Payload: Uses a simple method called XOR operation to decrypt the payload.

Privilege Escalation:

What It Achieves: Gains SYSTEM-level privileges — the highest level of access on a Windows system.
How It’s Done: Exploits a known vulnerability (let’s say CVE-2024–30088 for illustration).
Vulnerability Exploitation: Takes advantage of a flaw in the system to execute code with elevated privileges.
Result: The attacker can now perform any action on the system, unrestricted.

It’s like finding the master key to every lock in a building — suddenly, no door is off-limits.

4. Making Themselves at Home: Persistence

Attackers don’t want their hard-earned access to vanish after a system reboot, so they set up ways to stick around.

PowerShell Script for Scheduled Tasks:

What It Does: Creates a scheduled task using an XML file.
How It Works: The task is set to run at startup or specific intervals, executing the malicious script automatically.

Outcome:

Maintained Access: Even if the system restarts, the attacker’s code runs again.
Stealth: By using legitimate system features, it avoids raising immediate suspicions.

Think of it as setting up camp in someone’s backyard — they might not notice you’re there unless they look closely.

5. The Malicious Password Filter DLL

This tactic is all about capturing secrets without anyone noticing.

Password Filter DLL:

Definition: A Dynamic Link Library that hooks into the system’s password policies.
Malicious Twist: The attacker replaces or adds a DLL that records passwords in plain text.

How It Works:

Interception: When users change their passwords or login, the DLL captures the credentials.
Data Collection: Stores or sends the passwords to the attacker.

Impact:

Access to Accounts: The attacker gains usernames and passwords, potentially including admin accounts.
Escalation: Facilitates further movement within the network.

It’s like someone installing a hidden camera over your shoulder while you type your password.

6. Stealing Data: Exfiltration and Email Sending

Now that the attacker has valuable information, they need to get it out without raising alarms.

Gathering Credentials:

Local Collection: Stolen passwords and data are collected in specific directories.
Email Exfiltration:
Using Legitimate Channels: They use real Exchange credentials and mail servers to send emails.
Sending the Data: Emails are crafted to include the stolen information.

Why It’s Effective:

Blending In: Since legitimate servers and credentials are used, it’s harder for security systems to flag the activity.
Avoiding Detection: Email traffic is common, so unusual activity may go unnoticed.

Picture sending secret documents through the regular mail — they’re less likely to be intercepted than if you used a suspicious courier.

7. Covering Their Tracks with Ngrok

To maintain communication without being detected, attackers use tools that disguise their traffic.

What is Ngrok?

Legitimate Use: A tool that creates secure tunnels to your local machine, useful for developers.
Malicious Use: Attackers use it to tunnel out of a network, bypassing firewall restrictions.

How Attackers Exploit It:

Establishing a Tunnel: Sets up a secure, encrypted connection from the infected system to the attacker’s server.
Bypassing Security Controls: Traffic appears as normal outbound HTTPS traffic, which is often allowed through firewalls.

Benefits for the Attacker:

Stealth Communication: Maintains a persistent connection without raising red flags.
Data Exfiltration: Allows continuous data transfer out of the network.

It’s like digging a secret tunnel under a fortress wall — guards might not notice because everything looks normal on the surface.

Mapping the Attack: The MITRE ATT&CK Framework

To better understand and defend against these threats, cybersecurity professionals use the MITRE ATT&CK Framework. It’s like a detailed playbook of attacker tactics and techniques.

Initial Access (TA0001): How they get in — through phishing or exploiting vulnerabilities.
Execution (TA0002): Running malicious code on your system.
Persistence (TA0003): Ensuring they can stay connected.
Privilege Escalation (TA0004): Gaining higher access levels.
Defense Evasion (TA0005): Avoiding detection by security systems.
Credential Access (TA0006): Stealing login credentials.
Discovery (TA0007): Mapping out your network.
Lateral Movement (TA0008): Moving to other systems within the network.
Collection (TA0009): Gathering sensitive data.
Exfiltration (TA0010): Sending data out of your network.
Command and Control (TA0011): Communicating with compromised systems.

The Detective’s Toolkit: Writing Detection Rules

To automate the detection of suspicious activities, we use rules that alert us when certain conditions are met. Think of it as setting traps that notify you when triggered.

Crafting a Sigma Rule

title: Detection of Malicious PowerShell Scripts and Web Shell Activity (CVE-2024-30088)
id: a1b23c56-7e8c-4c39-b12a-9c3f7f1db12f
description: Detect malicious PowerShell execution related to privilege escalation, credential stealing, and web shell activities.

logsource:
  category: process_creation
  product: windows

detection:
  selection:
    - Image: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
    - CommandLine|contains:
        - '-EncodedCommand'
        - 'ngrok.exe'
        - 'UpdateService'
        - 'C:\Users\Public\e.xml'
        - 'CVE-2024-30088'
        - 'Invoke-WmiMethod'
        - 'Microsoft.Exchange.WebServices.dll'
    - ParentImage: 'C:\Windows\explorer.exe'

  condition: selection

fields:
  - CommandLine
  - ParentImage
  - Image

falsepositives:
  - Legitimate admin PowerShell use

level: high

Key Detection Insights:

PowerShell Execution: The attack involves PowerShell scripts (u.ps1, temp.ps1) and uses obfuscated/encoded PowerShell commands. Detection of PowerShell activity with encoded commands and execution of scripts like ngrok.exe or e.xml is critical.
Persistence Indicators: Monitoring scheduled tasks like MicrosoftEdgeUpdateTaskMachineUAE is a strong signal for persistence.
Use of Web Shells: Any web shell-related files such as Defaults.aspx or Logout.aspx on the server should raise flags, especially if unusual command execution or encryption activities are seen.
Privilege Escalation: Detecting Invoke-WmiMethod with the context of running specific payloads related to CVE-2024-30088 is a key indicator.

Sources:

Earth Simnavaz Levies Advanced Cyberattacks Against UAE and Gulf Regions | Trend Micro (US)
OilRig Exploits Windows Kernel Flaw in Espionage Campaign Targeting UAE and Gulf (thehackernews.com)

Search This Blog

Secure Nutshell