Live off the Land? How About Bringing Your Own Island? An Overview of UNC1945[html]
Through Mandiant investigation of intrusions, the FLARE Advanced
Practices team observed a group we track as UNC1945 compromise managed
service providers and operate against a tailored set of targets within
the financial and professional consulting industries by leveraging
access to third-party networks (see this href="/content/fireeye-www/en_US/blog/threat-research/2019/03/clustering-and-associating-attacker-activity-at-scale.html">blog
post for an in-depth description of “UNC” groups).
UNC1945 targeted Oracle Solaris operating systems, utilized several
tools and utilities against Windows and Linux operating systems,
loaded and operated custom virtual machines, and employed techniques
to evade detection. UNC1945 demonstrated access to exploits, tools and
malware for multiple operating systems, a disciplined interest in
covering or manipulating their activity, and displayed advanced
technical abilities during interactive operations.
Mandiant discovered and reported to Oracle href="https://nvd.nist.gov/vuln/detail/CVE-2020-14871">CVE-2020-14871,
which was addressed in Oracle's href="https://www.oracle.com/security-alerts/cpuoct2020.html">October
2020 Critical Patch Update. Mandiant recommends staying current
on all current patch updates to ensure a high security posture. We
will discuss this vulnerability in greater detail in a follow up blog post.
UNC1945 Attack Lifecycle
The threat actor demonstrated experience and comfort by utilizing
unique tactics, techniques and procedures (TTPs) within Unix
environments, demonstrating a high level of acumen in conjunction with
ease of operability in Microsoft Windows operating systems. They were
successful navigating multiple segmented networks and leveraging
third-party access to extend operations well beyond the initial
victim. Furthermore, UNC1945 operated from several virtual machines
pre-configured with post-exploitation tools in addition to their
custom toolset to evade detection and forensics.
Initial Compromise
In late 2018, UNC1945 gained access to a Solaris server and
installed a backdoor we track as SLAPSTICK in order to capture
connection details and credentials to facilitate further compromise.
The SSH service of this server was exposed to the internet at the
time, the same time we observed first evidence of threat activity.
Unfortunately, due to insufficient available evidence, the next
indication of activity was in mid-2020 at which time a different
Solaris server was observed connecting to the threat actor
infrastructure. This indicates a dwell time of approximately 519 days
based on recovered artifacts.
- Although we were unable to determine how the late-2018 initial
access was accomplished, we did observe successful UNC1945 SSH
connections directly to the victim Solaris 10 server, since the SSH
service was exposed directly to the internet at the time.
- In mid-2020, we observed UNC1945 deploy EVILSUN—a remote
exploitation tool containing a zero-day exploit for
CVE-2020-14871—on a Solaris 9 server. At the time, connections from
the server to the threat actor IP address were observed over port
8080. - Mandiant discovered and reported CVE-2020-14871, a
recently patched vulnerability in the Oracle Solaris Pluggable
Authentication Module (PAM) that allows an unauthenticated
attacker with network access via multiple protocols to exploit
and compromise the operating system. - According to an
April 2020 post on a black-market website, an “Oracle Solaris
SSHD Remote Root Exploit” was available for approximately $3,000
USD, which may be identifiable with EVILSUN.
- Additionally, we confirmed a Solaris server exposed to the
internet had critical vulnerabilities, which included the
possibility of remote exploitation without authentication.
Establish Foothold and Maintain Persistence
The threat actor used a Solaris Pluggable Authentication Module
backdoor we refer to as SLAPSTICK to establish a foothold on a Solaris
9 server. This facilitated user access to the system with a secret
hard-coded password and allowed the threat actors to escalate
privileges and maintain persistence (see Figure 1).
Log –font –unix | /usr/lib/ssh/sshd sshd
kbdint - can <Encoded Password> <IP REDACTED>
Magical Password
auth.info | sshd[11800]: [ID 800047
auth.info] Accepted keyboard-interactive for root from
<IP REDACTED> port 39680 ssh2
auth.notice | su: [ID 366847 auth.notice]
‘su root’ - succeeded for netcool on
/dev/pts/31 |
Figure 1: SLAPSTICK logs
At the initial victim, UNC1945 placed a copy of a legitimate
pam_unix.so file and SLAPSTICK in the /lib64/security folder. A day
later, the threat actor positioned a custom Linux backdoor, which
Mandiant named LEMONSTICK, on the same workstation. LEMONSTICK
capabilities include command execution, file transfer and execution,
and the ability to establish tunnel connections. (see Figure 2).
FileItem:changed |
/usr/lib64/security/pam_unix,so [57720]
Audit log | [audit_type: USER_END] user
pid=10080 uid=0 auid=0 msg='PAM: session close
acct=root" : exe="/usr/sbin/sshd"
(hostname=1.239.171.32, addr=1.239.171.32, terminal=ssh
res=success)'"
FileItem:Accessed |
/var/tmp/.cache/ocb_static |
Figure 2: UNC1945 emplacement of SLAPSTICK
