لرن سرا

برچسب: Campaigns

  • Exploiting Legitimate Remote Access Tools in Ransomware Campaigns

    Exploiting Legitimate Remote Access Tools in Ransomware Campaigns


    Introduction

    Ransomware is one of the most disruptive cyber threats, encrypting critical organizational data and demanding ransom payments for restoration. While early campaigns relied on mass phishing or opportunistic malware distribution, modern ransomware operations have evolved into highly sophisticated, targeted attacks. Today’s adversaries not only infect machines but also move laterally across networks, harvest credentials, neutralize defences, and maintain persistent control—all while remaining stealthy and evading detection.

    Disclaimer: The Remote Access Tools discussed in this blog are legitimate software products designed to support IT administration and remote support. This article highlights how adversaries may misuse them in ransomware campaigns if they are misconfigured, poorly managed, or left unmonitored. It does not suggest that the tools themselves are inherently vulnerable or malicious.

    A key enabler of these attacks is the exploitation of legitimate Remote Access Tools (RATs) such as AnyDesk, UltraViewer, AppAnywhere, RustDesk, CloneDesk, Splashtop, and TightVNC. Originally designed for IT administration and remote support, many of these tools offer free or freely available versions, which attackers often abuse because they are easy to deploy, widely trusted, and frequently whitelisted in enterprise environments. These tools provide:

    • Unattended access: Connect without user interaction
    • File transfer: Move binaries or exfiltrate data
    • Interactive desktop control: Execute administrative tasks remotely
    • Encrypted communications: Evade network monitoring

    Organizations often whitelist Remote Access Tools and trust their digital signatures, which attackers exploit to bypass security controls and persist stealthily. Understanding how Remote Access Tools are abused is critical for building effective defences against modern ransomware threats.

    The Ransomware Kill Chain: A Step-by-Step Breakdown

    The ransomware kill-chain outlines each stage of an attack, from initial access to final impact. When attackers leverage legitimate Remote Access Tools, they gain stealth, persistence, and control, making detection and mitigation more challenging.

    Stage 1: Initial Access – Credential Compromise

    Attackers gain legitimate access using stolen or brute-forced credentials, bypassing defences while appearing as trusted users. Targeting administrator accounts provides maximum control and enables later stages like Remote Access Tool deployment and lateral movement.

     Common Attack Pathways:

    • Brute-force attacks against RDP/SMB endpoints
    • Credential reuse from leaks or past breaches
    • Targeting administrator accounts for maximum privileges
    • Detection Indicators:
    • Windows Event IDs 4625 → 4624 (multiple failed logins immediately followed by success)
    • RDP logon type 10 at unusual hours
    • Logins from unexpected geolocations.

    Stage 2: Remote Tool Abuse – Hijacking vs. Silent Installation

    After gaining access, attackers focus on Remote Access Tool deployment for stealthy persistence. They can either hijack an existing Remote Access Tool to avoid detection or perform a silent installation using signed installers with minimal footprint. Silent installation often leverages known command-line flags, vendor documentation, or reverse-engineering to find deployment parameters.

    Method 1: Hijacking Existing Remote Access Tools

    • Enumerate installed Remote Access Tools via WMI, registry, or PowerShell.
    • Add attacker credentials or modify access configurations.
    • Avoids creating new files or processes, reducing detection risk.

    Method 2: Silent Installation of Remote Access Tools

    • Deploy lightweight, signed installers without user interaction.
    • Silent Install Flags: /S, /VERYSILENT, /quiet, /NORESTART.

     

    Remote Tools Commands Purpose / Effect
    AnyDesk anydesk.exe –install “C:\ProgramData\AnyDesk” –silent –start-with-win Persistent remote access service
    UltraViewer UltraViewer_Setup.exe /VERYSILENT /NORESTART Install quietly with no reboot
    AppAnywhere msiexec /i AppAnywhere.msi /quiet /norestart Enterprise-style silent deployment
    RustDesk rustdesk.exe –service install –password “Str0ngPass123” Enables unattended remote access
    CloneDesk CloneDesk_Setup.exe /S /D=C:\ProgramData\CloneDesk Minimal footprint installation
    Splashtop Splashtop_Streamer.exe /s /i silent=1 precheck=0 confirm=0 Quiet, enterprise deployment
    TightVNC tightvnc-setup.exe /S /NORESTART CLI-driven hidden installation

     

    Stage 3: Persistence & Privilege Consolidation

    Attackers leverage registry run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run), hidden scheduled tasks, and configuration file modifications to maintain persistence. Privilege escalation is achieved using tools like PowerRun or TrustedInstaller, allowing Remote Access Tools to run with SYSTEM privileges and bypass user-level restrictions.

    Mechanisms:

    • Registry Run Keys: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks: Hidden tasks to auto-restart Remote Access Tools
    • Configuration Files: Modify config.toml (RustDesk) for unattended access
    • Privilege Escalation: Launch Remote Access Tool as SYSTEM using PowerRun or TrustedInstaller
    • Monitoring: New registry keys, scheduled tasks, elevated Remote Access Tool processes

    Stage 4: Antivirus Neutralization & Anti-Forensics

    Using Remote Access Tools, attackers can interactively stop Antivirus services, manipulate group policies, and add Remote Access Tool directories to exclusion lists. Critical logs are cleared, and file shredding tools are used to remove forensic evidence, making post-incident investigation difficult.

    Techniques:

    • Stop Antivirus services: sc stop <service> or net stop <service>
    • Policy manipulation: Add Remote Access Tool directories to exclusions.
    • Log clearing: Adversaries often use the following command lines as part of Anti-Forensics to clear event logs:
      wevtutil cl Security
      wevtutil cl System
      wevtutil cl Application
    • File shredding: Remove forensic artifacts

    Stage 5: Payload Deployment & Execution

    Attackers stop Antivirus services, modify security policies, disable recovery mechanisms, clear event logs, and shred sensitive files to evade detection and hinder forensic investigations. They may also tamper with backup solutions, disable shadow copies, and use Living-off-the-Land Binaries (LOLBins) like rundll32 or PowerShell to blend malicious actions with legitimate processes. These actions ensure minimal visibility for defenders and create a safe environment for ransomware execution.

    Mechanism:

    • Ransomware is delivered through Remote Access Tool channels, often disguised as trusted updates or administrative actions, and executed within existing remote sessions to bypass user suspicion and security monitoring.

    Stage 6: Lateral Expansion

    Lateral movement is facilitated through credential reuse, Remote Access Tool propagation, or exploiting enterprise Remote Access Tool deployments.

    Mechanisms:

    • Credential reuse across endpoints
    • Enterprise Remote Access Tool exploitation for mass deployment

    Indicators:

    • Multiple endpoints reporting new Remote Access Tool connections
    • Unauthorized scheduled tasks or registry modifications across machines

    Stage 7: Impact – Encryption & Lockout

    Ransomware payload execution triggers data encryption, account lockouts, and Remote Access Tool credential changes to block administrative remediation. Campaigns such as LockBit, Black and Basta variants demonstrate this final stage in live attacks.

    Outcome:

    • Encrypt files on target systems
    • Lock accounts or change Remote Access Tool credentials to prevent remediation

    Real-World Campaign Examples

    Below are commonly abused Remote Access Tools leveraged by adversaries in ransomware campaigns for persistence, deployment, and lateral movement.

    Remote Access Tool Associated Ransomware Campaigns
    AnyDesk TargetCompany, D3adCrypt, Makop, Mallox, Phobos, LockBit 2.0, LockBit 3.0, LockBit 2025 Renegade, Beast, Dharma, Proton / Shinra, MedusaLocker
    UltraViewer Beast, CERBER, Dharma (.cezar Family), GlobeImposter 2.0, LockBit 3.0, Makop, Phobos, SpiderPrey, TargetCompany
    AppAnywhere Makop, Ryuk, D3adCrypt, Dharma
    RustDesk Mimic, LockXXX, Dyamond, D3adCrypt, Makop
    Splashtop Makop, BlueSky, RansomHub, Proxima
    TightVNC Cerber 4.0 / 5.0

    Threat Actor TTP Mapping (MITRE ATT&CK)

    Understanding the tactics, techniques, and procedures (TTPs) used by adversaries is crucial to defending against Remote Access Tool-driven ransomware campaigns. By mapping these activities to the MITRE ATT&CK framework, security teams can visualize how attackers gain access, deploy tools, maintain persistence, escalate privileges, and eventually deliver impactful payloads. The table below highlights the key stages of attack, the techniques leveraged, and the commonly abused remote access tools aligned to each step.

     

    Stages Technique MITRE ATT&CK Sub-Technique ID Observations
    Initial Access Brute Force T1110.001 Targeting RDP/SMB endpoints to gain initial access
    Tool Deployment Ingress Tool Transfer T1105 Remote access utilities transferred for execution
    Execution Remote Services T1021.001 Remote sessions used to execute payloads
    Persistence Registry Run Keys T1547.001 Registry keys created/modified for tool persistence
    Privilege Escalation Abuse Elevation Control Mechanism T1548.002 Elevation of privileges observed to run tools with SYSTEM rights
    Defense Evasion Impair Defenses T1562.001 Security services disabled, logs cleared
    Lateral Movement Remote Services T1021.001 Remote services abused to move across endpoints
    Impact Data Encrypted for Impact T1486 Tools leveraged to deploy ransomware and encrypt data

    Emerging Trends & Future Threats

    As ransomware operators evolve, new tactics are emerging that expand beyond traditional on-premise exploitation. These trends highlight how attackers are combining automation, cloud abuse, and RaaS ecosystems to maximize the scale and stealth of their operations.

     

    • AI-driven Remote Access Tool deployment: Automated decision-making for payloads
    • Cloud Remote Access Tool abuse: Exploiting cloud-based remote access portals
    • RaaS integration: Remote Access Tools embedded in ransomware-as-a-service offerings for enterprise campaigns
    • Multi-stage attacks: Initial Remote Access Tool compromise followed by secondary payloads (data exfiltration, cryptojacking, lateral ransomware)

    How Quick Heal / Seqrite Protect Against These Activities.

     Ransomware actors may try to weaponize trusted tools, but Quick Heal and Seqrite are built with multiple layers of defence to stop them in their tracks. By combining real-time monitoring, self-protection, and advanced behavioural detection, these solutions ensure that attackers can’t easily disable security or slip past unnoticed.

    • Virus Protection: Actively detects and neutralizes trojanized installers or hidden payloads before they can execute.
    • Antivirus Self Protection: Prevents attackers from forcefully terminating or uninstalling security services.
    • Behaviour-Based Detection: Monitors for abnormal activities linked to ransomware, such as mass file changes or suspicious process launches.
    • Ransomware Protection: Blocks unauthorized encryption attempts in real time, cutting off the attack before data is locked.
    • Application Control: Restricts the use of unauthorized remote tools, ensuring only trusted applications are allowed to run.

    Security Best Practices & Recommendations

    Defending against ransomware isn’t just about having the right tools — it’s also about using them wisely and building strong day-to-day habits. Here are some practical steps every organization can take to stay ahead of attackers:

    • Restrict Remote Access Tool Usage: Only keep the remote tools you really need and remove the rest. The fewer entry points, the safer your systems are.
    • Enforce Multi-Factor Authentication (MFA): Even if attackers steal a password, MFA makes it much harder for them to log in.
    • Limit Administrative Rights: Don’t hand out admin privileges unless absolutely necessary. Less privilege means less damage if an account is compromised.
    • Audit & Monitor Logs Continuously: Keep a close watch on your logs — unusual logins, silent installs, or strange setup commands can be early warning signs.
    • Regular Updates & Patching: Stay on top of updates for both your operating systems and security tools so attackers can’t exploit old flaws.
    • User Awareness Training: People are the first line of defence. Training staff to spot phishing emails or suspicious remote support activity can stop attacks before they even start.

    Conclusion:

    Legitimate IT tools can easily become hidden attack vectors when mismanaged, and Remote Access Tool abuse is now a critical enabler of next-generation ransomware. To counter this risk, enterprises need a layered approach that combines governance, monitoring, and rapid response.

    Quick Heal and Seqrite play a central role in this defence strategy, providing strong Antivirus protection, behavioural detection, and Anti-Ransomware protection. When paired with strict governance and incident response, organizations can stay ahead of attackers.

    Key measures include:

    • Remote Access Tool governance and whitelisting
    • Multi-layered Antivirus protections powered by Quick Heal / Seqrite
    • Behavioural detection and outbound filtering
    • Rapid incident response for containment and recovery

    By adopting this multi-layered defence strategy, organizations can proactively detect, contain, and mitigate Remote Access Tool–based ransomware campaigns—turning trusted tools from potential threats into controlled, manageable assets.

    Author: Matin Tadvi

    Co-Author: Umar Khan



    Source link

  • Espionage Campaigns Uncovered by Seqrite Labs

    Espionage Campaigns Uncovered by Seqrite Labs


    Seqrite Labs APT-Team has identified and tracked UNG0002 also known as Unknown Group 0002, a bunch of espionage-oriented operations which has been grouped under the same cluster conducting campaigns across multiple Asian jurisdictions including China, Hong Kong, and Pakistan. This threat entity demonstrates a strong preference for using shortcut files (LNK), VBScript, and post-exploitation tools such as Cobalt Strike and Metasploit, while consistently deploying CV-themed decoy documents to lure victims.

    The cluster’s operations span two major campaigns: Operation Cobalt Whisper (May 2024 – September 2024) and Operation AmberMist (January 2025 – May 2025). During Operation Cobalt Whisper, 20 infection chains were observed targeting defense, electrotechnical engineering, and civil aviation sectors. The more recent Operation AmberMist campaign has evolved to target gaming, software development, and academic institutions with improved lightweight implants including Shadow RAT, Blister DLL Implant, and INET RAT.

    In the recent operation AmberMist, the threat entity has also abused the ClickFix Technique – a social engineering method that tricks victims into executing malicious PowerShell scripts through fake CAPTCHA verification pages. Additionally, UNG0002 leverages DLL sideloading techniques, particularly abusing legitimate Windows applications like Rasphone and Node-Webkit binaries to execute malicious payloads.

    • Multi-Stage Attacks: UNG0002 employs sophisticated infection chains using malicious LNK files, VBScript, batch scripts, and PowerShell to deploy custom RAT implants including Shadow RAT, INET RAT, and Blister DLL.
    • ClickFix Social Engineering: The group utilizes fake CAPTCHA verification pages to trick victims into executing malicious PowerShell scripts, notably spoofing Pakistan’s Ministry of Maritime Affairs website.
    • Abusing DLL Sideloading: In the recent campaign, consistent abuse of legitimate Windows applications (Rasphone, Node-Webkit) for DLL sideloading to execute malicious payloads while evading detection.
    • CV-Themed Decoy Documents: Use of realistic resume documents targeting specific industries, including fake profiles of game UI designers and computer science students from prestigious institutions.
    • Persistent Infrastructure: Maintained command and control infrastructure with consistent naming patterns and operational security across multiple campaigns spanning over a year.

    • Targeted Industry Focus: Systematic targeting of defense, electrotechnical engineering, energy, civil aviation, academia, medical institutions, cybersecurity researchers, gaming, and software development sectors.
    • Attribution Challenges: UNG0002 represents an evolving threat cluster that demonstrates high adaptability by mimicking techniques from other threat actor playbooks to complicate attribution efforts, with Seqrite Labs assessing with high confidence that the group originates from South-East Asia and focuses on espionage activities. As more intelligence becomes available, associated campaigns may be expanded or refined in the future.

    UNG0002 represents a sophisticated and persistent threat entity from South Asia that has maintained consistent operations targeting multiple Asian jurisdictions since at least May 2024. The group demonstrates high adaptability and technical proficiency, continuously evolving their toolset while maintaining consistent tactics, techniques, and procedures.

    The threat actor’s focus on specific geographic regions (China, Hong Kong, Pakistan) and targeted industries suggests a strategic approach to intelligence gathering AKA classic espionage related activities. Their use of legitimate-looking decoy documents, social engineering techniques, and pseudo-advanced evasion methods indicates a well-resourced and experienced operation.

    UNG0002 demonstrates consistent operational patterns across both Operation Cobalt Whisper and Operation AmberMist, maintaining similar infrastructure naming conventions, payload delivery mechanisms, and target selection criteria. The group’s evolution from using primarily Cobalt Strike and Metasploit frameworks to developing custom implants like Shadow RAT, INET RAT, and Blister DLL indicates their persistent nature.

    Notable technical artifacts include PDB paths revealing development environments such as C:\Users\The Freelancer\source\repos\JAN25\mustang\x64\Release\mustang.pdb for Shadow RAT and C:\Users\Shockwave\source\repos\memcom\x64\Release\memcom.pdb for INET RAT, indicating potential code names “Mustang” and “ShockWave” which indicate the mimicry of already-existing threat groups. An in-depth technical analysis of the complete infection chains and detailed campaign specifics can be found in our comprehensive whitepaper.

    Attributing threat activity to a specific group is always a complex task. It requires detailed analysis across several areas, including targeting patterns, tactics and techniques (TTPs), geographic focus, and any possible slip-ups in operational security. UNG0002 is an evolving cluster that Seqrite Labs is actively monitoring. As more intelligence becomes available, we may expand or refine the associated campaigns. Based on our current findings, we assess with high confidence that this group originates from South-East Asia and demonstrates a high level of adaptability — often mimicking techniques seen in other threat actor playbooks to complicate attribution focusing on espionage. We also, appreciate other researchers in the community, like malwarehunterteam for hunting these campaigns.

    • Non-PE [Script-Based Files, Shortcut, C2-Config, Encrypted Shellcode blobs]
    File Type Hash (SHA-256)
    LNK (Shortcut) 4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148
    55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9
    4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d
    SCT (Scriptlet) c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7
    VBS (VBScript) ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850
    c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918
    2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc
    Batch Script (.bat) a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5
    PowerShell (.ps1) a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5
    TXT – C2 Config 2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0

    b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e
    Shellcode (.dat) 2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c
    Hash (SHA-256) Malware Type Notes
    c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6 Blister DLL Implant Used in Operation AmberMist, DLL sideloaded via Node-Webkit
    4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8 Blister DLL Implant Same family as above, possible variant
    2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a INET RAT Shadow RAT rewrite with anti-analysis and C2 flexibility
    90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99 Shadow RAT Deployed via Rasphone with decoy and config loader
    Tactic Technique Technique ID Observed Behavior / Example
    Reconnaissance Spearphishing for Information T1598.002 Use of job-themed resumes (e.g., Zhang Wanwan & Li Mingyue CVs) to target specific sectors.
    Resource Development Develop Capabilities T1587 Custom implants: INET RAT (rewrite of Shadow RAT), use of Blister DLL loader.
    Acquire Infrastructure T1583.001, T1583.006 Use of spoofed domains (e.g., moma[.]islamabadpk[.]site); ASN usage.
    Initial Access Spear Phishing Attachment T1566.001 Use of malicious ZIPs with LNKs and VBS (e.g., 张婉婉简历.zip, 李明月_CV.pdf.lnk).
    Drive-by Compromise (ClickFix technique) T1189 Malicious site tricks user into pasting PowerShell copied to clipboard.
    Execution Command and Scripting Interpreter (PowerShell, VBScript, Batch) T1059 Multi-stage execution via VBS ➝ BAT ➝ PowerShell.
    Signed Binary Proxy Execution (wscript, rasphone, regsvr32) T1218 Use of LOLBINs like wscript.exe, regsvr32.exe, rasphone.exe for execution and sideloading.
    Scripting (Scriptlets – .sct files) T1059.005 Use of run.sct via regsvr32 for further payload execution.
    Persistence Scheduled Task/Job T1053.005 Tasks like SysUpdater, UtilityUpdater scheduled for recurring execution.
    Privilege Escalation DLL Search Order Hijacking T1574.001 DLL sideloading via rasphone.exe, node-webkit for Shadow RAT, Blister loader.
    Defense Evasion Obfuscated Files or Information T1027 Scripts with obfuscation, hex-encoded C2 configs, junk code in SCTs.
    Deobfuscate/Decode Files or Information T1140 INET RAT decrypting C2 configuration from list.txt.
    Software Packing (Shellcode loader) T1027.002 Blister decrypts and injects shellcode from update.dat using AES.
    Indirect Command Execution T1202 Executing SCT through regsvr32, using P/Invoke to load DLLs.
    Credential Access Input Capture (potential within Shadow/INET RAT) T1056 RAT capabilities imply possible credential theft.
    Discovery System Information Discovery T1082 INET RAT collects computer/user names upon execution.
    Command & Control Application Layer Protocol: Web Protocols T1071.001 Shadow/INET RATs communicate over HTTP(S).
    Ingress Tool Transfer T1105 Payloads and decoys downloaded from external servers.
    Collection Data from Local System T1005 Likely via RATs for file collection or clipboard access.
    Exfiltration Exfiltration Over C2 Channel T1041 Shadow/INET RAT reverse shell features suggest data tunneling over same HTTP channel.

     

    Authors

    Sathwik Ram Prakki

    Subhajeet Singha

     



    Source link