• Posted by: Eng. Donya Bino
• August 30, 2024

Chinese-Speaking Users Targeted in Sophisticated Cobalt Strike Campaign

A highly organized and sophisticated cyber attack campaign, codenamed SLOW#TEMPEST, is targeting Chinese-speaking users. Researchers from Securonix have uncovered this campaign, which likely leverages phishing emails to deliver Cobalt Strike payloads, compromising Windows systems.

 

Attack Overview

The campaign begins with malicious ZIP files containing a disguised Windows shortcut (LNK) file named "违规远程控制软件人员名单.docx.lnk" (translated to "List of people who violated the remote control software regulations"). When unpacked, these files activate an infection chain that deploys the Cobalt Strike post-exploitation toolkit on compromised systems.

 

Infection Chain

The LNK file acts as a decoy, leading to the execution of a legitimate Microsoft binary, "LicensingUI.exe," through DLL side-loading. This method involves loading a rogue DLL file named "dui70.dll" located in a hidden directory within the ZIP archive, marking the first known instance of DLL side-loading using LicensingUI.exe. The rogue DLL serves as a Cobalt Strike implant, establishing persistent and stealthy access to the infected system by connecting to a remote server at "123.207.74[.]22".

 

Tactics, Techniques, and Procedures

1. Phishing and Social Engineering: The attack likely initiates through phishing emails, tricking victims into opening the malicious ZIP file.

2. DLL Side-Loading: The attackers use DLL side-loading with LicensingUI.exe to load the Cobalt Strike implant.

3. Persistence and Stealth: The campaign sets up a scheduled task to run a malicious executable, "lld.exe," periodically. This executable is designed to run arbitrary shellcode directly in memory, minimizing disk footprints and evading detection.

4. Privilege Escalation: The attackers exploit the built-in Guest user account by elevating its privileges, adding it to the administrative group, and assigning a new password. This tactic allows them to maintain access to the system with minimal detection, as Guest accounts are typically less monitored.

5. Lateral Movement and Network Penetration: The threat actors utilize the Remote Desktop Protocol (RDP) and credentials extracted using the Mimikatz tool to move laterally within the network. They establish remote connections to their command-and-control (C2) server from each compromised machine.

6. Reconnaissance and Data Exfiltration: The post-exploitation phase involves executing various enumeration commands and using the BloodHound tool for Active Directory reconnaissance. The attackers then exfiltrate the gathered information in ZIP file format.

 

Indicators of Compromise

• ZIP Archive Path: Files found in a directory named "\其他信息.MACOS.MACOS_MACOSX_MACOS"
• C2 Server: 123.207.74[.]22, hosted by Shenzhen Tencent Computer Systems Company Limited, China
• Executable Names: "LicensingUI.exe," "dui70.dll," "lld.exe"
• Commands: Enumeration commands, BloodHound execution, Mimikatz password extraction

 

Attribution and Conclusions

While no solid evidence links SLOW#TEMPEST to any known Advanced Persistent Threat (APT) group, the sophistication and methodology of the campaign suggest it is orchestrated by a seasoned threat actor skilled in using advanced exploitation frameworks like Cobalt Strike. The involvement of Chinese infrastructure and artifacts further points to a connection with Chinese cyber operations.

 

Recommendations

Organizations and individuals can take the following steps to defend against similar attacks:

1. Be Cautious of Phishing Emails: Educate employees to recognize phishing attempts and avoid opening suspicious files.
2. Update Security Systems: Ensure that all systems are up to date with the latest security patches.
3. Monitor User Accounts: Pay close attention to user account activities, especially for Guest accounts that may be less monitored.
4. Use Advanced Detection Tools: Deploy advanced threat detection solutions that can identify and respond to Cobalt Strike and other post-exploitation frameworks.
5. Limit Lateral Movement: Implement network segmentation and monitoring to limit and detect unauthorized lateral movement.

 

The SLOW#TEMPEST campaign highlights the increasing sophistication of cyber threats targeting specific language groups and regions. By employing phishing, DLL side-loading, and clever privilege escalation techniques, the attackers could maintain a low profile while compromising critical systems. Ongoing vigilance and proactive security measures are essential to mitigate such threats.