Posté par: igor51 le août 02, 2018, 04:00:52
[html]
FIN7’s Innovation Enabled their Success
Throughout FireEye’s tracking of FIN7 campaigns, the attackers have
attempted to stay ahead of the game and thwart detection, using novel
tactics and displaying characteristics of a well-resourced operation.
For example, in April 2017,
blogged about FIN7’s spear phishing emails that leveraged hidden
shortcut files (LNK files) to initiate the infection and
VBScript functionality launched by mshta.exe to infect the victim.
This was a direct departure from their established use of weaponized
Office macros and highlighted the group’s adaptive nature to evade detection.
FireEye also previously reported on FIN7’s use of the
backdoor as a post-exploitation tool to cement their foothold in a
network and maintain access to victim environments. CARBANAK is well
known for its use in highly profitable and sophisticated attacks
dating back to 2013, with usage attributable to FIN7 beginning in late
2015, although how interconnected the campaigns employing the malware
over this five-year span are is unclear. FIN7’s use of CARBANAK is
particularly notable due to their use of creative persistence
mechanisms to launch the backdoor. The group
an application shim database that injected a malicious in-memory
patch into the Services Control Manager ("services.exe")
process, and then spawned a CARBANAK backdoor process. FIN7 also
used this tactic to install a payment card harvesting utility.
Another notable characteristic of FIN7 has been their heavy use of
certificates. Unsurprisingly, malicious threat actors have sought
to exploit the legitimacy afforded by these certificates. By digitally
signing their phishing documents, backdoors and later stage tools,
FIN7 was able to bypass many security controls that may limit
execution of macros from Office documents and restrict execution of
unsigned binaries on trusted systems.
|
|
|
|
Korsar Travel TOV | valign="top"> | korsartravel@bk.ru | |
Kaitschuck James | valign="top"> | valign="top"> | |
Park Travel | valign="top"> | inga@parktravel-mx.ru |
Table 1: Sample FIN7 code signing certificates
FIN7 developed evasive techniques at a rapid pace. Throughout 2017,
FIN7 was observed
novel obfuscation methods, and in some cases modifying the
methods on a daily basis while launching attacks targeting multiple
victims. The threat group regularly tested malicious DOC, DOCX, and
RTF phishing documents against public repositories to check static
detection engine coverage. Their development of a payload obfuscation
style using the Windows command interpreter's (cmd.exe) native string
substitution was so unique that FireEye dubbed it
"FINcoding." These methods inspired
command line obfuscation research and the release of Daniel
Bohannon's
Reference Table 2 and Table 3 for a selection of samples and their
associated command line obfuscation techniques.
FIN7’s Relentless Phone Calls and Bellyaching
Over the three years of responding to a multitude of compromises and
proactively defending against FIN7, FireEye observed unprecedented
social engineering prowess. From leveraging web forms for initial
contact to targeting and engaging directly with pre-determined store
managers, the operators demonstrated a range of capabilities. FIN7’s
reach extended beyond their targets’ computer systems. FireEye has
responded to incidents where FIN7 has called victims prior to
lodging digital complaints laden with malicious documents as well as
after the phishing documents have been sent, in order to check if they
were received – a crude but effective FIN7 email delivery tracking technique.
As FIN7 has matured, so did the quality of their phishing lures and
templates, which were most often sent from fake but thoroughly
disguised individuals and businesses – and occasionally from sender
addresses impersonating legitimate government entities. Their phishing
has often exploited urgent, high value business matters tailored to
their chosen targets. At individual stores, managers were contacted
about lost items or sent a “receipt” claiming overcharging. Other FIN7
phishing emails masqueraded as detailed catering orders or requests
for special menus tailored to individuals with dietary restrictions.
In early 2017, a pattern of complaints emerged and has continued for
well over a year, where FIN7 has contacted stores and corporate
offices to lodge food poisoning complaints with malicious attachments.
Internally dubbed “
by FireEye, this pattern of detailed complaints eventually expanded
beyond individual complaints and into litigious concerns raised on
behalf of “the government”, as shown in Figure 1.
Figure 1: FDA themed spear phishing email
It is noteworthy that the BATELEUR backdoor activity
identified by Proofpoint in July 2017, which FireEye tracks as a
suspected FIN7 subgroup, uses highly-customized graphics for their
targets, often created in Adobe Photoshop. In this same phishing
campaign, FIN7’s malicious attachment was graphically themed to match,
as shown in Figure 2.
Figure 2: FDA themed spear phishing attachment
Throughout their operations, the professional design and continued
development of phishing elements in parallel to other post-compromise
tools indicated to FireEye that FIN7 was most likely a well-resourced
criminal operation.
It’s Just Metadata
FireEye has tracked several FIN7 personas throughout their
operations by collecting and parsing filetypes of forensic value for
juicy metadata. In a previous blog, we shared how LNK files created by
FIN7 unintentionally revealed valuable information about their
development environment.
LNK files can contain metadata that reveals attributes about the
systems on which the LNKs were created, including original file paths,
volume serial numbers, MAC addresses, and hostnames. By studying
values within the LNK metadata we often identify
"toolmarks," or unique values associated with distinct
malware developer and operator personas.
FIN7 LNK metadata shows that the actors routinely used virtual
machines with generic hostnames such as ANDY-PC or USER-PC, and
default hostnames with the structure WIN-[A-Z0-9]{11} (e.g. WIN-ABCDEFGH1JK).
FireEye has tracked several hostname and path toolmarks associated
with FIN7’s operations, which we have used to link clusters of threat
activity together. These toolmarks may be linked to FIN7 members who
are involved in tool development or the broader criminal operation.
Notable personas from the technical data, which are explored in more
detail in the Technical Appendix section, include:
- "andy" /
"andy-pc" - "Hass"
- "jimbo"
- "Константин"
(Konstantin) - "oleg"
This analysis allowed us to understand FIN7’s systems and correlate
future attack activity to the different personas. Furthermore, the
metadata analysis helped us monitor for files generated by the group
and use the established toolmarks to establish detection for other
adversary methodologies (such as direct RDP or SMB access) if the
group changed TTPs.
Video Playback of FIN7 Operations
While responding to multiple FIN7 intrusions, FireEye recovered a
custom video recording capability used by FIN7 as a part of their
operations. FireEye’s FLARE team reverse engineered the video
protocol, which appeared to be custom-written by FIN7 as it has no
external library dependencies, contained Cyrillic comments in the
code, and required the use of a bespoke video player unique to FIN7.
The attackers most likely leveraged this video recording capability in
their arsenal to monitor operations in victim environments to inform
later stages of their intrusions.
FireEye obtained a version of the criminal developers’ video player
from a trusted source and with the knowledge of the reverse engineered
protocol, the FLARE team modified the source code to support multiple
versions of FIN7’s custom encoding. With the patched source code,
FireEye can decode and playback FIN7’s video monitoring for affected
victims in possession of these files.
Recent Shifts in FIN7 Operations
Throughout 2018, FireEye has continued to identify multiple domains
registered using patterns consistent with prior FIN7 activity, as well
as campaigns using disparate TTPs that we have attributed to FIN7 with
varying degrees of confidence. ZIP archives delivering the BIRDDOG
backdoor were hosted on a portion of suspected FIN7 domains registered
in 2018. Some evidence further characterizing the nature of this
campaign suggests these malicious documents were sent to financial
institution customers in Eastern Europe and Central Asia as early as
September 2017. The targeting of individuals rather than organizations
would mark a significant shift in their targeting, although it is also
possible that the banks spoofed in these campaigns were FIN7's
ultimate targets.
Additionally, we have identified similarities between FIN7 activity
and BATELEUR campaigns, which began as early as mid-2017 and have been
primarily aimed at U.S.-based restaurant chains. These campaigns
leveraged macro-embedded Word documents directly attached to the
emails as well as ones hosted on Google Drive. The documents were
meticulously crafted to appear as though they came from legitimate
organizations (e.g. restaurant associations and suppliers of POS
hardware). This suspected FIN7 activity continued past the date of
most recent arrest announced by U.S. law enforcement, although the
attackers are now leveraging an updated JavaScript backdoor dubbed GRIFFON.
These recent campaigns could be representative of a decisive effort
to diversify TTPs to avoid detection or could indicate the formation
of FIN7 splinter groups carrying out autonomous campaigns. As a
result, organizations need to remain vigilant and continue to monitor
for changes in the methods employed by the FIN7 actors.
Unveiling FIN7’s Front Company and Industry
Figure 3: Combi Security logo as
retrieved from 2016 cache of combisecurity.com
According to U.S. law enforcement, at least a portion of FIN7
activity was run out of a front company dubbed Combi Security. A cache
of its website reveals that the company purported to be “the world
leaders in the field of comprehensive protection of large information
systems from modern cyber threats” with headquarters in Moscow, Haifa,
and Odessa. We have identified job advertisements for Combi Security
that have been posted on popular Russian, Ukrainian, and Uzbek job
recruitment sites, as well as numerous individuals who most likely
worked for the company. Due to the seeming legitimacy of the
recruitment postings, some individuals may have been unaware of
illicit nature of their work. While the recruitment of unwitting
individuals as puppets has been a common component of at least some
criminal schemes – for example, reshipping mules who are recruited
through postings on career sites advertising attractive work-from-home
jobs – FIN7’s veiling of full-scale financial compromises as
legitimate offensive security engagements is particularly notable. The
apparent success of Combi Security in recruiting unsuspecting
individuals in this manner, may lead to more of this type of technical
recruitment by cyber criminals in the future.
Splitting Up?
The criminal organization behind FIN7 is almost certainly comprised
of many additional individuals beyond those already apprehended by law
enforcement authorities. FireEye iSIGHT Intelligence expects that at
least a portion of these malicious actors are likely to continue
conducting cyber crime activity in some capacity. Although we expect
activity to continue, it is extremely common for threat actors to
either modify their TTPs or temporarily halt operations following
significant developments such as arrests of high-level members and/or
public disclosure of TTPs that they employ.
Depending on the organizational and communication structure of the
group, it is also plausible that multiple subgroups could form and
carry out independent operations in the future. Recent campaigns, as
well as those using tactics that were atypical for historical FIN7
campaigns, such as the SEC campaigns with widespread targeting, may be
representative of semi-autonomous groups pre-existing within, or
cooperating with, the FIN7 criminal organization. As noted in our
overview, certain malware families and techniques transcend
strictly defined threat groups, and may be re-used by developers and
operators as they transition between organizations and campaigns.
Conclusion
These recent announcements by U.S. law enforcement highlight the
positive impact that can result from synergy between private and
public sector organizations in disrupting organized cyber crime
operations. As demonstrated by FIN7, financially-motivated threat
actors are becoming extremely advanced and are capable of inflicting
significant harm on organizations through vast, but carefully
orchestrated campaigns. As sophisticated threat groups continue to
emerge, partnerships, such as those exhibited here, will almost
certainly play a key role in combating these threats.
Acknowledgements
Jordan Nuce, Tom Bennett, Michael Bailey, and Daniel Bohannon
Technical Appendix
FireEye has responded to many FIN7 incidents, which has provided us
extensive insight into their operations. As part of this blog post, we
are also including numerous indicators that we attribute to FIN7 and
an overview of their techniques to aid organizations in identifying
malicious activity across their networks.
Phishing Documents Technical Details
In addition to LNK metadata, FIN7 phishing documents consistently
contained artifacts detailing the local file system paths of component
files used to construct the spear phishing documents. In the following
tables, we have also included examples of the myriad of command line
obfuscation techniques used by FIN7. Of particular note is the quick
turnaround time between documents employing different techniques.
|
|
|
|
| ||
2018:05:21 17:32:00 | colspan="2" valign="top"> |
| ||||
| valign="top"> | ||||||
cmd.exe /k "SET | ||||||
|
|
|
|
| ||
2018:01:26 15:59:00 | ||||||
| valign="top"> | ||||||
cmd.exe /c wscript.exe | ||||||
|
|
|
|
| ||
2018:01:11 13:16:00 | ||||||
| valign="top"> | ||||||
cmd.exe /c wscript.exe | ||||||
|
|
|
|
| ||
2017:10:25 07:43:00 | ||||||
| valign="top"> | ||||||
cmd.exe /c wscript.exe | ||||||
|
|
|
|
| ||
2017:06:23 15:18:00 | ||||||
| valign="top"> | ||||||
wscript.exe //b | ||||||
Table 2: Suspected FIN7 spear phishing launch
parameters and attacker local system artifacts
|
|
|
|
| |||
2017:10:06 11:21:00 | Doc0610.docx | ||||||
| valign="top"> | |||||||
cmd /c | |||||||
@set w=wsc@ript /b | |||||||
|
|
|
|
| |||
2017:09:27 11:56:00 | Doc2709.docx | ||||||
| valign="top"> | |||||||
wmic.exe process call | |||||||
cmd.exe /S /D /c" | |||||||
|
|
|
|
| |||
2017:08:08 17:38:00 | valign="top"> | ||||||
| valign="top"> | |||||||
wmic.exe process call | |||||||
mshta.exe | |||||||
|
|
|
|
| |||
2017:07:27 15:51:00 | Dooq.docx | ||||||
| valign="top"> | |||||||
cmd.exe /C set | |||||||
|
|
|
|
| |||
2017:06:28 | FIN7 | HALFBAKED | |||||
| valign="top"> | |||||||
cmd.exe /C set | |||||||
|
|
|
|
| |||
2017:05:11 | FIN7 | HALFBAKED | valign="top"> | ||||
| valign="top"> | |||||||
| valign="top"> | |||||||
|
|
|
|
| |||
2017:04:20 | valign="top"> | valign="top"> | info.rtf | ||||
| valign="top"> | |||||||
| valign="top"> | |||||||
|
|
|
|
| |||
2017:01:12 | FIN7 | HALFBAKED | valign="top"> | ||||
| valign="top"> | |||||||
| valign="top"> | |||||||
|
|
|
|
| |||
2016:08:12 | FIN7 | HALFBAKED | |||||
| valign="top"> | |||||||
| valign="top"> | |||||||
Table 3: FIN7 spear phishing launch parameters
and attacker local system artifacts
FIN7 Tactics, Techniques & Procedures (TTPs)
FireEye is providing insight into FIN7’s notable methodologies
across multiple stages of the attack lifecycle and tips for
identifying evidence of this activity and similarly suspicious
activity in your environment.
|
|
|
| valign="top"> | Inbound emails |
| valign="top"> | New Run and RunOnce |
| valign="top"> | New Scheduled |
| valign="top"> | New Windows |
| valign="top"> | |
| valign="top"> | |
| valign="top"> | |
| valign="top"> | Inbound and |
| valign="top"> | valign="top"> |
| valign="top"> | Unusually long or numerous DNS A, |
| valign="top"> | Newly observed domains registered |
| valign="top"> | Newly observed domains registered |
| valign="top"> | valign="top"> |
| valign="top"> | Outbound connections to newly |
Table 4: FIN7 TTPs
FIN7 Indicators
FireEye is providing these granular technical indicators so that
interested parties can better understand the threat actor and search
for their historical activity across enterprise networks.
Phishing Documents Droppers
|
|
|
|
menu.rtf | FIN7 | ||
| valign="bottom"> | FIN7 | |
3-ThompsonDan.rtf | FIN7 | ||
claim.rtf | FIN7 | ||
order.rtf | FIN7 | ||
order.rtf | FIN7 | ||
Doc2_rtf.rtf | FIN7 | ||
doc1.doc | FIN7 | ||
quote.rtf | FIN7 | ||
Doc2_rtf.rtf | FIN7 | ||
information.doc | FIN7 | ||
Doc_rest_rtf.rtf | FIN7 | ||
doc1.docx | FIN7 | ||
Doc33.docx | FIN7 | ||
info_.rtf | FIN7 | ||
bmg.docx | FIN7 | ||
Doc_0405_1.rtf | FIN7 | ||
doc1.docx | FIN7 | ||
doc0505_1.rtf | FIN7 | ||
DonovanR.docx | FIN7 | ||