6 ms·
Indian threat actor Patchwork APT caught in its own web
- vlovich123 5y agoWait. How does the malware author injecting themselves with their own malware lead to Malwarebytes getting screenshots of the attackers machine? Did they somehow breach the APT’s network or hijack the malware? Is there some context I’m missing behind this blog post?
- reflexe 5y agoIn Figure 3 you can see what looks like a webshell. They probably found a way to upload php files to the server which allowed them to do anything. Alternatively, they might have guessed the password and then uploaded the file from the web gui.
- goatsi 5y agoThe malware appears to use a web based command and control server, so there could be a vulnerability in it, a easily brute forced password or even open access. For example, Zeus, the first major banking trojan, would store logs for each infected victim in a folder on its web server. If the owner was careless, these would be exposed in an open directory. If this was the case, the very first folder would almost always be a test infection of the owner, and the very first password capture in it would be the owner logging into the control panel to see if it was working. Good fun back in the day.
- hsbauauvhabzb 5y agoThe logic in the php snippet which captures IP addresses is not correct. Any user is able to add an x-forwarded-for header to mask their real IP from the logs. I wouldn’t be surprised if the log file can have additional entries spoofed with new lines also ;)
- chmod775 5y agoNot necessarily. That code could be written assuming it is running behind a reverse proxy/other infrastructure (that would obviously strip/replace any x-forwarded-for etc. provided by the user). The comments seem to indicate it is running behind a proxy of the author's choosing, but that may just be bad English. At the very least something has to be providing that HTTP_CLIENT_IP which is given the highest priority. It would be odd to prioritize that over HTTP_X_FORWARDED_FOR if you weren't adding special cases for different upstream proxies.
- amriksohata 5y agoHow do they even know it's Indian? What footprint is used
- schleck8 5y agoSignature approaches most likely, like code style, languages, exploits, software, infrastructure https://attack.mitre.org/groups/G0040/ https://attack.mitre.org/groups/G0040/
- Asooka 5y agoI would guess by IP.
- ashishknitcs 5y agoIP may not be right choice as VPN are used
- ashishknitcs 5y agoKeyboard setup says EN IN
- dharmatva 5y agoNo one - literally no one in India uses the 'EN IN' locale in India. Everyone uses the 'EN US' locale in India.
- rl3 5y ago>That file contains an exploit (Microsoft Equation Editor) which is meant to compromise the victim’s computer and execute the final payload (RAT). When your attempt to copy the Equation Group is a little too literal.
- ChrisMarshallNY 5y agoYeesh. OLE objects. I thought it was a bad idea, back then, and I think most folks were of the same mind. I’m actually shocked that OLE is still a thing.
- archi42 5y agoStrictly speaking, they're wrong about the keyboard layout. "ENG\nIN" means something like "English (India)" - the layout selector only shows the currently active layout (if more than one layout is configured). The other layouts are only shown when clicking on it and might be anything. Also, when defining a custom keyboard layout you have relative freedom in picking the name and language/region it's classified as. So that "ENG\nIN" could be anything. Source: I have two layouts installed. The default regional keyboard layout so co-workers using my machine don't go insane (shown as "DEU \nDE" [=Language\nRegion]), and for myself a customized variant of the US layout. I can't recall the exact reason why I configured it as it is (maybe to avoid installing the "ENG" language pack?), but that custom US layout shows as plain "DEU" (no second line).
- mijoharas 5y agoCan someone tell me what APT stands for in this context? it doesn't appear to be defined in the linked article.
- detaro 5y agohttps://en.wikipedia.org/wiki/Advanced_persistent_threat https://en.wikipedia.org/wiki/Advanced_persistent_threat Kind of a buzzword, not really applied all that consistently (sounds scary, if you're selling something it gets attention, if you're explaining why you failed to defend it always helps to make the attacker seem sophisticated)
- throwawayvibes 5y ago