Blog
‍

Inside the SOC

From BumbleBee to Cobalt Strike: Steps of a BumbleBee intrusion

Sep 2022

In April 2022, Darktrace observed threat actors using the loader known as ‘BumbleBee’ to install Cobalt Strike Beacon onto target systems. This blog provides details of the steps threat actors took during their intrusions, along with details of the network-based behaviours which served as evidence of their activities.

Introduction

Throughout April 2022, Darktrace observed several cases in which threat actors used the loader known as ‘BumbleBee’ to install Cobalt Strike Beacon onto victim systems. The threat actors then leveraged Cobalt Strike Beacon to conduct network reconnaissance, obtain account password data, and write malicious payloads across the network. In this article, we will provide details of the actions threat actors took during their intrusions, as well as details of the network-based behaviours which served as evidence of the actors’ activities.

BumbleBee

In March 2022, Google’s Threat Analysis Group (TAG) provided details of the activities of an Initial Access Broker (IAB) group dubbed ‘Exotic Lily’ [1]. Before March 2022, Google’s TAG observed Exotic Lily leveraging sophisticated impersonation techniques to trick employees of targeted organisations into downloading ISO disc image files from legitimate file storage services such as WeTransfer. These ISO files contained a Windows shortcut LNK file and a BazarLoader Dynamic Link Library (i.e, DLL). BazarLoader is a member of the Bazar family — a family of malware (including both BazarLoader and BazarBackdoor) with strong ties to the Trickbot malware, the Anchor malware family, and Conti ransomware. BazarLoader, which is typically distributed via email campaigns or via fraudulent call campaigns, has been known to drop Cobalt Strike as a precursor to Conti ransomware deployment [2].

In March 2022, Google’s TAG observed Exotic Lily leveraging file storage services to distribute an ISO file containing a DLL which, when executed, caused the victim machine to make HTTP requests with the user-agent string ‘bumblebee’. Google’s TAG consequently called this DLL payload ‘BumbleBee’. Since Google’s discovery of BumbleBee back in March, several threat research teams have reported BumbleBee samples dropping Cobalt Strike [1]/[3]/[4]/[5]. It has also been reported by Proofpoint [3] that other threat actors such as TA578 and TA579 transitioned to BumbleBee in March 2022.

Interestingly, BazarLoader’s replacement with BumbleBee seems to coincide with the leaking of the Conti ransomware gang’s Jabber chat logs at the end of February 2022. On February 25^th, 2022, the Conti gang published a blog post announcing their full support for the Russian state’s invasion of Ukraine [6].

Figure 1: The Conti gang's public declaration of their support for Russia's invasion of Ukraine

Within days of sharing their support for Russia, logs from a server hosting the group’s Jabber communications began to be leaked on Twitter by @ContiLeaks [7]. The leaked logs included records of conversations among nearly 500 threat actors between Jan 2020 and March 2022 [8]. The Jabber logs were supposedly stolen and leaked by a Ukrainian security researcher [3]/[6].

Affiliates of the Conti ransomware group were known to use BazarLoader to deliver Conti ransomware [9]. BumbleBee has now also been linked to the Conti ransomware group by several threat research teams [1]/[10]/[11]. The fact that threat actors’ transition from BazarLoader to BumbleBee coincides with the leak of Conti’s Jabber chat logs may indicate that the transition occurred as a result of the leaks [3]. Since the transition, BumbleBee has become a significant tool in the cyber-crime ecosystem, with links to several ransomware operations such as Conti, Quantum, and Mountlocker [11]. The rising use of BumbleBee by threat actors, and particularly ransomware actors, makes the early detection of BumbleBee key to identifying the preparatory stages of ransomware attacks.

Intrusion Kill Chain

In April 2022, Darktrace observed the following pattern of threat actor activity within the networks of several Darktrace clients:

1. Threat actor socially engineers user via email into running a BumbleBee payload on their device

2. BumbleBee establishes HTTPS communication with a BumbleBee C2 server

3. Threat actor instructs BumbleBee to download and execute Cobalt Strike Beacon

4. Cobalt Strike Beacon establishes HTTPS communication with a Cobalt Strike C2 server

5. Threat actor instructs Cobalt Strike Beacon to scan for open ports and to enumerate network shares

6. Threat actor instructs Cobalt Strike Beacon to use the DCSync technique to obtain password account data from an internal domain controller

7. Threat actor instructs Cobalt Strike Beacon to distribute malicious payloads to other internal systems

With limited visibility over affected clients’ email environments, Darktrace was unable to determine how the threat actors interacted with users to initiate the BumbleBee infection. However, based on open-source reporting on BumbleBee [3]/[4]/[10]/[11]/[12]/[13]/[14]/[15]/[16]/[17], it is likely that the actors tricked target users into running BumbleBee by sending them emails containing either a malicious zipped ISO file or a link to a file storage service hosting the malicious zipped ISO file. These ISO files typically contain a LNK file and a BumbleBee DLL payload. The properties of these LNK files are set in such a way that opening them causes the corresponding DLL payload to run.

In several cases observed by Darktrace, devices contacted a file storage service such as Microsoft OneDrive or Google Cloud Storage immediately before they displayed signs of BumbleBee infection. In these cases, it is likely that BumbleBee was executed on the users’ devices as a result of the users interacting with an ISO file which they were tricked into downloading from a file storage service.

Figure 2: The above figure, taken from the event log for an infected device, shows that the device contacted a OneDrive endpoint immediately before making HTTPS connections to the BumbleBee C2 server, 45.140.146[.]244

Figure 3: The above figure, taken from the event log for an infected device, shows that the device contacted a Google Cloud Storage endpoint and then the malicious endpoint ‘marebust[.]com’ before making HTTPS connections to the BumbleBee C2 servers, 108.62.118[.]61 and 23.227.198[.]217

After users ran a BumbleBee payload, their devices immediately initiated communications with BumbleBee C2 servers. The BumbleBee samples used HTTPS for their C2 communication, and all presented a common JA3 client fingerprint, ‘0c9457ab6f0d6a14fc8a3d1d149547fb’. All analysed samples excluded domain names in their ‘client hello’ messages to the C2 servers, which is unusual for legitimate HTTPS communication. External SSL connections which do not specify a destination domain name and whose JA3 client fingerprint is ‘0c9457ab6f0d6a14fc8a3d1d149547fb’ are potential indicators of BumbleBee infection.

Figure 4:The above figure, taken from Darktrace's Advanced Search interface, depicts an infected device's spike in HTTPS connections with the JA3 client fingerprint ‘0c9457ab6f0d6a14fc8a3d1d149547fb’

Once the threat actors had established HTTPS communication with the BumbleBee-infected systems, they instructed BumbleBee to download and execute Cobalt Strike Beacon. This behaviour resulted in the infected systems making HTTPS connections to Cobalt Strike C2 servers. The Cobalt Strike Beacon samples all had the same JA3 client fingerprint ‘a0e9f5d64349fb13191bc781f81f42e1’ — a fingerprint associated with previously seen Cobalt Strike samples [18]. The domain names ‘fuvataren[.]com’ and ‘cuhirito[.]com’ were observed in the samples’ HTTPS communications.

Figure 5:The above figure, taken from Darktrace's Advanced Search interface, depicts the Cobalt Strike C2 communications which immediately followed a device's BumbleBee C2 activity

Cobalt Strike Beacon payloads call home to C2 servers for instructions. In the cases observed, threat actors first instructed the Beacon payloads to perform reconnaissance tasks, such as SMB port scanning and SMB enumeration. It is likely that the threat actors performed these steps to inform the next stages of their operations. The SMB enumeration activity was evidenced by the infected devices making NetrShareEnum and NetrShareGetInfo requests to the srvsvc RPC interface on internal systems.

Figure 6: The above figure, taken from Darktrace’s Advanced Search interface, depicts a spike in srvsvc requests coinciding with the infected device's Cobalt Strike C2 activity

After providing Cobalt Strike Beacon with reconnaissance tasks, the threat actors set out to obtain account password data in preparation for the lateral movement phase of their operation. To obtain account password data, the actors instructed Cobalt Strike Beacon to use the DCSync technique to replicate account password data from an internal domain controller. This activity was evidenced by the infected devices making DRSGetNCChanges requests to the drsuapi RPC interface on internal domain controllers.

Figure 7: The above figure, taken from Darktrace’s Advanced Search interface, depicts a spike in DRSGetNCChanges requests coinciding with the infected device’s Cobalt Strike C2 activity

After leveraging the DCSync technique, the threat actors sought to broaden their presence within the targeted networks. To achieve this, they instructed Cobalt Strike Beacon to get several specially selected internal systems to run a suspiciously named DLL (‘f.dll’). Cobalt Strike first established SMB sessions with target systems using compromised account credentials. During these sessions, Cobalt Strike uploaded the malicious DLL to a hidden network share. To execute the DLL, Cobalt Strike abused the Windows Service Control Manager (SCM) to remotely control and manipulate running services on the targeted internal hosts. Cobalt Strike first opened a binding handle to the svcctl interface on the targeted destination systems. It then went on to make an OpenSCManagerW request, a CreateServiceA request, and a StartServiceA request to the svcctl interface on the targeted hosts:

· Bind request – opens a binding handle to the relevant RPC interface (in this case, the svcctl interface) on the destination device

· OpenSCManagerW request – establishes a connection to the Service Control Manager (SCM) on the destination device and opens a specified SCM database

· CreateServiceA request – creates a service object and adds it to the specified SCM database

· StartServiceA request – starts a specified service

Figure 8: The above figure, taken from Darktrace’s Advanced Search interface, outlines an infected system’s lateral movement activities. After writing a file named ‘f.dll’ to the C$ share on an internal server, the infected device made several RPC requests to the svcctl interface on the targeted server

It is likely that the DLL file which the threat actors distributed was a Cobalt Strike payload. In one case, however, the threat actor was also seen distributing and executing a payload named ‘procdump64.exe’. This may suggest that the threat actor was seeking to use ProcDump to obtain authentication material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). Given that ProcDump is a legitimate Windows Sysinternals tool primarily used for diagnostics and troubleshooting, it is likely that threat actors leveraged it in order to evade detection.

In all the cases which Darktrace observed, threat actors’ attempts to conduct follow-up activities after moving laterally were thwarted with the help of Darktrace’s SOC team. It is likely that the threat actors responsible for the reported activities were seeking to deploy ransomware within the targeted networks. The steps which the threat actors took to make progress towards achieving this objective resulted in highly unusual patterns of network traffic. Darktrace’s detection of these unusual network activities allowed security teams to prevent these threat actors from achieving their disruptive objectives.

Darktrace Coverage

Once threat actors succeeded in tricking users into running BumbleBee on their devices, Darktrace’s Self-Learning AI immediately detected the command-and-control (C2) activity generated by the loader. BumbleBee’s C2 activity caused the following Darktrace models to breach:

· Anomalous Connection / Anomalous SSL without SNI to New External

· Anomalous Connection / Suspicious Self-Signed SSL

· Anomalous Connection / Rare External SSL Self-Signed

· Compromise / Suspicious TLS Beaconing To Rare External

· Compromise / Beacon to Young Endpoint

· Compromise / Beaconing Activity To External Rare

· Compromise / Sustained SSL or HTTP Increase

· Compromise / Suspicious TLS Beaconing To Rare External

· Compromise / SSL Beaconing to Rare Destination

· Compromise / Large Number of Suspicious Successful Connections

· Device / Multiple C2 Model Breaches

BumbleBee’s delivery of Cobalt Strike Beacon onto target systems resulted in those systems communicating with Cobalt Strike C2 servers. Cobalt Strike Beacon’s C2 communications resulted in breaches of the following models:

· Compromise / Beaconing Activity To External Rare

· Compromise / High Volume of Connections with Beacon Score

· Compromise / Large Number of Suspicious Successful Connections

· Compromise / Sustained SSL or HTTP Increase

· Compromise / SSL or HTTP Beacon

· Compromise / Slow Beaconing Activity To External Rare

· Compromise / SSL Beaconing to Rare Destination

The threat actors’ subsequent port scanning and SMB enumeration activities caused the following models to breach:

· Device / Network Scan

· Anomalous Connection / SMB Enumeration

· Device / Possible SMB/NTLM Reconnaissance

· Device / Suspicious Network Scan Activity

The threat actors’ attempts to obtain account password data from domain controllers using the DCSync technique resulted in breaches of the following models:

· Compromise / Unusual SMB Session and DRS

· Anomalous Connection / Anomalous DRSGetNCChanges Operation

Finally, the threat actors’ attempts to internally distribute and execute payloads resulted in breaches of the following models:

· Compliance / SMB Drive Write

· Device / Lateral Movement and C2 Activity

· Device / SMB Lateral Movement

· Device / Multiple Lateral Movement Model Breaches

· Anomalous File / Internal / Unusual SMB Script Write

· Anomalous File / Internal / Unusual Internal EXE File Transfer

· Anomalous Connection / High Volume of New or Uncommon Service Control

If Darktrace/Network had been configured in the targeted environments, then it would have blocked BumbleBee’s C2 communications, which would have likely prevented the threat actors from delivering Cobalt Strike Beacon into the target networks.

Conclusion

Threat actors use loaders to smuggle more harmful payloads into target networks. Prior to March 2022, it was common to see threat actors using the BazarLoader loader to transfer their payloads into target environments. However, since the public disclosure of the Conti gang’s Jabber chat logs at the end of February, the cybersecurity world has witnessed a shift in tradecraft. Threat actors have seemingly transitioned from using BazarLoader to using a novel loader known as ‘BumbleBee’. Since BumbleBee first made an appearance in March 2022, a growing number of threat actors, in particular ransomware actors, have been observed using it.

It is likely that this trend will continue, which makes the detection of BumbleBee activity vital for the prevention of ransomware deployment within organisations’ networks. During April, Darktrace’s SOC team observed a particular pattern of threat actor activity involving the BumbleBee loader. After tricking users into running BumbleBee on their devices, threat actors were seen instructing BumbleBee to drop Cobalt Strike Beacon. Threat actors then leveraged Cobalt Strike Beacon to conduct network reconnaissance, obtain account password data from internal domain controllers, and distribute malicious payloads internally. Darktrace’s detection of these activities prevented the threat actors from achieving their likely harmful objectives.

Thanks to Ross Ellis for his contributions to this blog.‍

Appendices

References

[1] https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/

[2] https://securityintelligence.com/posts/trickbot-gang-doubles-down-enterprise-infection/

[3] https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming

[4] https://www.cynet.com/orion-threat-alert-flight-of-the-bumblebee/

[5] https://research.nccgroup.com/2022/04/29/adventures-in-the-land-of-bumblebee-a-new-malicious-loader/

[6] https://www.bleepingcomputer.com/news/security/conti-ransomwares-internal-chats-leaked-after-siding-with-russia/

[7] https://therecord.media/conti-leaks-the-panama-papers-of-ransomware/

[8] https://www.secureworks.com/blog/gold-ulrick-leaks-reveal-organizational-structure-and-relationships

[9] https://www.prodaft.com/m/reports/Conti_TLPWHITE_v1.6_WVcSEtc.pdf

[10] https://www.kroll.com/en/insights/publications/cyber/bumblebee-loader-linked-conti-used-in-quantum-locker-attacks

[11] https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime

[12] https://isc.sans.edu/diary/TA578+using+thread-hijacked+emails+to+push+ISO+files+for+Bumblebee+malware/28636

[13] https://isc.sans.edu/diary/rss/28664

[14] https://www.logpoint.com/wp-content/uploads/2022/05/buzz-of-the-bumblebee-a-new-malicious-loader-threat-report-no-3.pdf

[15] https://ghoulsec.medium.com/mal-series-23-malware-loader-bumblebee-6ab3cf69d601

[16] https://blog.cyble.com/2022/06/07/bumblebee-loader-on-the-rise/

[17] https://asec.ahnlab.com/en/35460/

[18] https://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/

‍

INSIDE THE SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

AUTHOR

ABOUT ThE AUTHOR

Sam Lister

SOC Analyst

Watch the NIS2 Webinar

share this article

More in this series

No items found.

Blog
‍

Inside the SOC

Detecting Attacks Across Email, SaaS, and Network Environments with Darktrace’s AI Platform Approach

Apr 2024

The State of AI in Cybersecurity

In a recent survey outlined in Darktrace’s State of AI Cyber Security whitepaper, 95% of cyber security professionals agree that AI-powered security solutions will improve their organization’s detection of cyber-threats [1]. Crucially, a combination of multiple AI methods is the most effective to improve cybersecurity; improving threat detection, accelerating threat investigation and response, and providing visibility across an organization’s digital environment.

In March 2024, Darktrace’s AI-led security platform was able to detect suspicious activity affecting a customer’s email, Software-as-a-Service (SaaS), and network environments, whilst its applied supervised learning capability, Cyber AI Analyst, autonomously correlated and connected all of these events together in one single incident, explained concisely using natural language processing.

Attack Overview

Following an initial email attack vector, an attacker logged into a compromised SaaS user account from the Netherlands, changed inbox rules, and leveraged the account to send thousands of phishing emails to internal and external users. Internal users fell victim to the emails by clicking on contained suspicious links that redirected them to newly registered suspicious domains hosted on same IP address as the hijacked SaaS account login. This activity triggered multiple alerts in Darktrace DETECT™ on both the network and SaaS side, all of which were correlated into one Cyber AI Analyst incident.

In this instance, Darktrace RESPOND™ was not active on any of the customer’s environments, meaning the compromise was able to escalate until their security team acted on the alerts raised by DETECT. Had RESPOND been enabled at the time of the attack, it would have been able to apply swift actions to contain the attack by blocking connections to suspicious endpoints on the network side and disabling users deviating from their normal behavior on the customer’s SaaS environment.

Nevertheless, thanks to DETECT and Cyber AI Analyst, Darktrace was able to provide comprehensive visibility across the customer’s three digital estate environments, decreasing both investigation and response time which enabled them to quickly enact remediation during the attack. This highlights the crucial role that Darktrace’s combined AI approach can play in anomaly detection cyber defense

Attack Details & Darktrace Coverage

1. Email: the initial attack vector

The initial attack vector was likely email, as on March 18, 2024, Darktrace observed a user device making several connections to the email provider “zixmail[.]net”, shortly before it connected to the first suspicious domain. Darktrace/Email identified multiple unusual inbound emails from an unknown sender that contained a suspicious link. Darktrace recognized these emails as potentially malicious and locked the link, ensuring that recipients could not directly click it.

Figure 1: Suspected initial compromise email from an unknown sender, containing a suspicious link, which was locked by Darktrace/Email.

2. Escalation to Network

Later that day, despite Darktrace/Email having locked the link in the suspicious email, the user proceeded to click on it and was directed to a suspicious external location, namely “rz8js7sjbef[.]latovafineart[.]life”, which triggered the Darktrace/Network DETECT model “Suspicious Domain”. Darktrace/Email was able to identify that this domain had only been registered 4 days before this activity and was hosted on an IP address based in the Netherlands, 193.222.96[.]9.

3. SaaS Account Hijack

Just one minute later, Darktrace/Apps observed the user’s Microsoft 365 account logging into the network from the same IP address. Darktrace understood that this represented unusual SaaS activity for this user, who had only previously logged into the customer’s SaaS environment from the US, triggering the “Unusual External Source for SaaS Credential Use” model.

4. SaaS Account Updates

A day later, Darktrace identified an unusual administrative change on the user’s Microsoft 365 account. After logging into the account, the threat actor was observed setting up a new multi-factor authentication (MFA) method on Microsoft Authenticator, namely requiring a 6-digit code to authenticate. Darktrace understood that this authentication method was different to the methods previously used on this account; this, coupled with the unusual login location, triggered the “Unusual Login and Account Update” DETECT model.

5. Obfuscation Email Rule

On March 20, Darktrace detected the threat actor creating a new email rule, named “…”, on the affected account. Attackers are typically known to use ambiguous or obscure names when creating new email rules in order to evade the detection of security teams and endpoints users.

The parameters for the email rule were:

“AlwaysDeleteOutlookRulesBlob: False, Force: False, MoveToFolder: RSS Feeds, Name: ..., MarkAsRead: True, StopProcessingRules: True.”

This rule was seemingly created with the intention of obfuscating the sending of malicious emails, as the rule would move sent emails to the "RSS Feeds” folder, a commonly used tactic by attackers as the folder is often left unchecked by endpoint users. Interestingly, Darktrace identified that, despite the initial unusual login coming from the Netherlands, the email rule was created from a different destination IP, indicating that the attacker was using a Virtual Private Network (VPN) after gaining a foothold in the network.

Figure 2: Hijacked SaaS account making an anomalous login from the unusual Netherlands-based IP, before creating a new email rule.

6. Outbound Phishing Emails Sent

Later that day, the attacker was observed using the compromised customer account to send out numerous phishing emails to both internal and external recipients. Darktrace/Email detected a significant spike in inbound emails on the compromised account, with the account receiving bounce back emails or replies in response to the phishing emails. Darktrace further identified that the phishing emails contained a malicious DocSend link hidden behind the text “Click Here”, falsely claiming to be a link to the presentation platform Prezi.

Figure 3: Darktrace/Email detected that the DocSend link displayed via text “Click Here”, was embedded in a Prezi link.

7. Suspicious Domains and Redirects

After the phishing emails were sent, multiple other internal users accessed the DocSend link, which directed them to another suspicious domain, “thecalebgroup[.]top”, which had been registered on the same day and was hosted on the aforementioned Netherlands-based IP, 193.222.96[.]91. At the time of the attack, this domain had not been reported by any open-source intelligence (OSINT), but it has since been flagged as malicious by multiple vendors [2].

Figure 4: External Sites Summary showing the suspicious domain that had never previously been seen on the network. A total of 11 “Suspicious Domain” models were triggered in response to this activity.

8. Cyber AI Analyst’s Investigation

As this attack was unfolding, Darktrace’s Cyber AI Analyst was able to autonomously investigate the events, correlating them into one wider incident and continually adding a total of 14 new events to the incident as more users fell victim to the phishing links.

Cyber AI Analyst successfully weaved together the initial suspicious domain accessed in the initial email attack vector (Figure 5), the hijack of the SaaS account from the Netherlands IP (Figure 6), and the connection to the suspicious redirect link (Figure 7). Cyber AI Analyst was also able to uncover other related activity that took place at the time, including a potential attempt to exfiltrate data out of the customer’s network.

By autonomously analyzing the thousands of connections taking place on a network at any given time, Darktrace’s Cyber AI Analyst is able to detect seemingly separate anomalous events and link them together in one incident. This not only provides organizations with full visibility over potential compromises on their networks, but also saves their security teams precious time ensuring they can quickly scope out the ongoing incident and begin remediation.

Figure 5: Cyber AI Analyst correlated the attack’s sequence, starting with the initial suspicious domain accessed in the initial email attack vector.

Figure 6: As the attack progressed, Cyber AI Analyst correlated and appended additional events to the same incident, including the SaaS account hijack from the Netherlands-based IP.

Figure 7: Cyber AI Analyst correlated and appended additional events to the same incident, including additional users connecting to the suspicious redirect link following the outbound phishing emails being sent.

Conclusion

In this scenario, Darktrace demonstrated its ability to detect and correlate suspicious activities across three critical areas of a customer’s digital environment: email, SaaS, and network.

It is essential that cyber defenders not only adopt AI but use a combination of AI technology capable of learning and understanding the context of an organization’s entire digital infrastructure. Darktrace’s anomaly-based approach to threat detection allows it to identify subtle deviations from the expected behavior in network devices and SaaS users, indicating potential compromise. Meanwhile, Cyber AI Analyst dynamically correlates related events during an ongoing attack, providing organizations and their security teams with the information needed to respond and remediate effectively.

Credit to Zoe Tilsiter, Analyst Consulting Lead (EMEA), Brianna Leddy, Director of Analysis

Appendices

References

[1] https://darktrace.com/state-of-ai-cyber-security

[2] https://www.virustotal.com/gui/domain/thecalebgroup.top

Darktrace DETECT Model Coverage

SaaS Models

- SaaS / Access / Unusual External Source for SaaS Credential Use

- SaaS / Compromise / Unusual Login and Account Update

- SaaS / Compliance / Anomalous New Email Rule

- SaaS / Compromise / Unusual Login and New Email Rule

Network Models

- Device / Suspicious Domain

- Multiple Device Correlations / Multiple Devices Breaching Same Model

Cyber AI Analyst Incidents

- Possible Hijack of Office365 Account

- Possible SSL Command and Control

Indicators of Compromise (IoCs)

IoC – Type – Description

193.222.96[.]91 – IP – Unusual Login Source

thecalebgroup[.]top – Domain – Possible C2 Endpoint

rz8js7sjbef[.]latovafineart[.]life – Domain – Possible C2 Endpoint

https://docsend[.]com/view/vcdmsmjcskw69jh9 - Domain - Phishing Link

About the author

Zoe Tilsiter

Cyber Analyst

Blog
‍

No items found.

Attack trends: Cloud-Based Cyber-Attacks and the Rise of Alternative Initial Access Methods

Apr 2024

What is the primary entry point for malware attacks?

Phishing attacks targeting employee inboxes are the most common initial access method used by malicious threat actors to deliver malware.

Because email remains the lifeblood of how organizations operate attackers continue to develop new techniques for creating more convincing and sophisticated phishing messages at scale.

What are new entry points cyber attackers are using?

While traditional phishing attacks are very common for attackers, they are not the only method threat actors are using to initiate malware delivery and other malicious campaigns of cyber disruption.

For its End of Year Threat Report, Darktrace analyzed attacks targeting customer environments. While email remains the most common means of attempted initial compromise, the second half of 2023 saw a significant rise in alternative initial access methods.

Much of this is taking advantage of cloud-base applications and collaboration tools including Dropbox, Microsoft Teams, and SharePoint which have become fundamental to how organizations operate in the era of hybrid work.

DarkGate exploits Microsoft Teams

Darktrace analysts have seen threat actors attempting to infect target networks with malware by leveraging Microsoft Teams and SharePoint.

In one example, Darktrace detected an attacker delivering DarkGate a trojan used to download other malware, by sending messages and attachments in Microsoft Teams and SharePoint.

The External Access functionality in Microsoft Teams allows users to contact people who aren’t in their organization. It’s designed as a tool to aid collaboration, but threat actors have realized they can abuse it for their own gain.

Users are told to lookout for suspicious email phishing messages, but often this thinking isn’t applied to Microsoft Teams and other collaboration platforms.

Messages from outside the organization are marked with a note that they are coming from an external source, but a well-designed phishing message with an urgent call to action can persuade the target to ignore this, driving them towards an external SharePoint URL, which tricks the user into downloading and installing malware.

Because this happens outside of the inbox, the activity can be missed by traditional email security solutions. Fortunately, in this case, it was detected by Darktrace DETECT and the activity was contained by Darktrace RESPOND before it could drop any additional malware.

Dropbox has established itself as a leading cloud storage service by allowing users to share and access files, no matter where they are in the world or what device they’re using. But while this is legitimate and useful for organizations, it has also opened a new avenue for threat actors to exploit.

Dropbox as an attack vector

Darktrace recently detected attackers attempting to leverage Dropbox as an initial access method. Emails from ‘no-reply@dropbox[.]com’ – a legitimate email address – were sent to employees at a Darktrace customer.

The emails contained a link to push users towards to a PDF file hosted on Dropbox, which in turn contained a phishing link which if followed, took users to a convincing looking spoof of a Microsoft 365 login page designed to steal usernames and passwords.

A user fell victim to this campaign, unwittingly entering their Microsoft 365 credentials. Shortly after that, Darktrace/Apps started to see suspicious activity relating to the account, with multiple logins from unusual locations which had never been associated with the account previously.

While many traditional security solutions successfully detect and disrupt email-based attacks, many struggle with cloud-based apps and services like Dropbox, Microsoft 365 and others.

There are several reasons for this, including the way in which the use of multiple different cloud services fragments the attack surface, making it hard for network administrators to keep track of everything, alongside the way in which some security solutions don’t take behavior into account in a system which can be accessed from anywhere. That means even from the other side of the world, attackers who have the right cloud credentials could access the network, potentially without being disrupted.

Why are attackers turning to alternative access methods?

Attackers are turning to alternative methods because delivering malicious links and payloads via cloud-based services potentially bypasses traditional cybersecurity protections. That, combined with how attackers can take legitimate login credentials to access system means attackers actions can’t be easily traced.

This rise in alternative initial access methods is likely a result of the continued development and enhancement of traditional email security solutions. But in the cat and mouse game of cybersecurity, threat actors continue to evolve new techniques to get by defenses.

Darktrace’s Self-Learning AI learns the unique digital environment and patterns of each business, meaning it can recognize subtle deviations in activity, even within cloud services, helping to mitigate and neutralize attacks and helping to keep your organization safe from cyber disruption.

Learn more about Darktrace

Join Darktrace LIVE half-day event to understand the reality versus the hype surrounding AI and how to achieve cyber resilience.

For more information on emerging threats read the Darktrace End of Year Threat Report 2023 here.

To learn more about Darktrace’s latest innovations watch the Darktrace Virtual Innovation Launch video here.

About the author

The Darktrace Community

Our ai. Your data.

Elevate your cyber defenses with Darktrace AI

Start your free trial

Darktrace AI protecting a business from cyber threats.

Check out this article by Darktrace: From BumbleBee to Cobalt Strike: Steps of a BumbleBee intrusion

Blog‍

Inside the SOC

From BumbleBee to Cobalt Strike: Steps of a BumbleBee intrusion

Introduction

BumbleBee

Intrusion Kill Chain

Darktrace Coverage

Conclusion

Appendices

References

Like this and want more?

Like this and want more?

More in this series

Blog‍

Inside the SOC

Detecting Attacks Across Email, SaaS, and Network Environments with Darktrace’s AI Platform Approach

The State of AI in Cybersecurity

Attack Overview

Attack Details & Darktrace Coverage

1. Email: the initial attack vector

2. Escalation to Network

3. SaaS Account Hijack

4. SaaS Account Updates

5. Obfuscation Email Rule

6. Outbound Phishing Emails Sent

7. Suspicious Domains and Redirects

8. Cyber AI Analyst’s Investigation

Conclusion

Appendices

References

Darktrace DETECT Model Coverage

Indicators of Compromise (IoCs)

Blog‍

Attack trends: Cloud-Based Cyber-Attacks and the Rise of Alternative Initial Access Methods

What is the primary entry point for malware attacks?

What are new entry points cyber attackers are using?

DarkGate exploits Microsoft Teams

Dropbox as an attack vector

Why are attackers turning to alternative access methods?

Learn more about Darktrace

Elevate your cyber defenses with Darktrace AI

Blog
‍

Blog
‍

Blog
‍