srakatn.blogg.se

1. #COBALT STRIKE BEACON BYPASS EGRESS RESTRICTIONS DOWNLOAD#
2. #COBALT STRIKE BEACON BYPASS EGRESS RESTRICTIONS MAC#
3. #COBALT STRIKE BEACON BYPASS EGRESS RESTRICTIONS WINDOWS#

They opened the documents one-by-one on the remote host via RDP.

Our evidence shows that the attackers then began looking for interesting documents on file shares. The threat actors then used Lazagne again on the domain controller to extract more credentials. After around a four-hour pause of inactivity, the threat actors enabled restricted admin mode via WMI on a domain controller and logged in using RDP.

The threat actors favored RDP and remote WMI as their preferred methods to interact with the hosts and servers of interest throughout the rest of the intrusion. They then targeted several other workstations with Cobalt Strike beacon executables however, no further activity was observed on those endpoints other than the initial lateral movement. With those credentials, the threat actors used RDP from the beachhead host to the already compromised workstation host. Meanwhile on the beachhead host, the threat actors ran Mimikatz via PowerShell to extract credentials. Around an hour after the initial infection, the threat actors ran LaZagne to retrieve all saved credentials from the pivoted workstation.

#COBALT STRIKE BEACON BYPASS EGRESS RESTRICTIONS WINDOWS#

The threat actors collected the results and pivoted to another host via a Cobalt Strike PowerShell beacon.Īfter pivoting, they disabled Windows Defender, before executing a second Cobalt Strike payload for a different command and control server. Upon execution, Gootloader utilized encoded PowerShell scripts to load Cobalt Strike into memory and persist on the host using a combination of registry keys and scheduled tasks.įifteen minutes after the initial execution, we observed the threat actors using the PowerShell implementation of SharpHound (BloodHound) to discover attack paths in the Active Directory-based network.

#COBALT STRIKE BEACON BYPASS EGRESS RESTRICTIONS DOWNLOAD#

The user then clicked on the second search result which led to the download and execution of a malicious javascript file (see video in Initial Access section). The intrusion started with a user searching Bing for “Olymplus Plea Agreement?”. They also contact impacted businesses, monitor for newly created C2 addresses, and make the information public to the community. The researcher behind the account is doing a great job of providing operational intelligence about the most recent malicious infrastructure. You can learn more about Gootloader by reading these references. When the user searches for these phrases and clicks on one of the top results, they are left with a forum looking web page where the user is instructed to download a file, which they accidently execute (double click to open).

#COBALT STRIKE BEACON BYPASS EGRESS RESTRICTIONS MAC#

The threat actors utilize SEO (search engine optimization) poisoning tactics to move compromised websites hosting malware to the top of certain search requests such as “what is the difference between a grand agreement and a contract?” or “freddie mac shared driveway agreement?” Gootloader was the name assigned to the multi-staged payload distribution by Sophos in March 2021. The threat actors then used this access to review sensitive documents. During the post-exploitation phase, the threat actors used RDP, WMI, Mimikatz, Lazagne, WMIExec, and SharpHound. The intrusion lasted two days and comprised discovery, persistence, lateral movement, collection, defense evasion, credential access and command and control activity. In early February 2022, we witnessed an intrusion employing Gootloader (aka GootKit) as the initial access vector.