In the world of cybersecurity, a recent incident involving a junior hacker has shed light on some clever tactics and the importance of comprehensive remediation. Let's dive into this intriguing story and explore the implications.
The Hacker's Move
A French-speaking attacker, known as "Poisson," targeted a small automotive business in France. The usual keylogging and credential theft followed, but here's where it gets interesting. Before his command-and-control (C2) server went offline, Poisson installed OpenSSH and Tailscale on a victim's machine, creating a backdoor that bypassed the C2 entirely. This move ensured his access remained intact, even when the C2 server was down.
A Rare Glimpse
What makes this case exceptional is the level of detail captured by Cato Networks. They had access to the entire operation, command by command, thanks to Poisson's mistake of leaving his SSH keys and a detailed playbook in an open storage bucket. This rare insight provides a unique perspective, offering a glimpse into the mind of an attacker.
Junior Operator, Big Impact
Despite being described as a "junior operator," Poisson's actions had significant consequences. His tradecraft may have been basic, but he managed to compromise four machines and gain persistent access. The fact that he operated on a "school schedule" and used free-tier tools highlights the accessibility of such attacks.
The Malware Chain
The malware used in this attack was primarily memory-based, with a VBScript stager and a PowerShell loader. The use of Start-Process -Verb RunAs for elevation is not subtle, and it required multiple attempts. Poisson then secured his access with scheduled tasks, shellcode injection, and a custom RustDesk channel. The keylogger, a simple Python script, captured banking and email credentials, which are valuable targets for small businesses.
The Tailscale Twist
The critical move was the installation of OpenSSH Server and Tailscale. By joining the victim's machine to his private Tailscale network, Poisson created an encrypted mesh, allowing him to access the machine without exposing any ports. This move demonstrated his understanding of creating a stealthy and persistent backdoor.
Implications and Lessons
This incident serves as a reminder that pulling down a C2 server is not enough for effective remediation. Attackers like Poisson can build separate access paths, ensuring their persistence. The tools used are not new or sophisticated, but their combination and the creation of a quiet persistence layer are concerning. As researchers point out, detection strategies often focus on bad files rather than bad behavior, allowing these legitimate binaries to slip through.
Hunting for Persistence
Cato Networks provides a comprehensive list of indicators to watch for, targeting the persistence layer. From monitoring OpenSSH Server installations on Windows workstations to checking for reverse tunnels and suspicious scheduled tasks, these indicators can help identify potential backdoors. The key takeaway is to assume multiple access paths and hunt for the quiet persistence mechanisms.
The Unanswered Question
What remains a mystery is the content of Thales.zip and the activities of the two executables. While this specific question may not have a significant impact, the broader lesson is clear: the C2 is not the intrusion itself; it's just one entry point. Remediation strategies must address all potential access paths to ensure the attacker's persistence is truly disrupted.
Final Thoughts
This story highlights the cat-and-mouse game between attackers and defenders. As attackers become more sophisticated, our detection and remediation strategies must evolve. By learning from incidents like these, we can stay one step ahead and protect our digital assets more effectively. Personally, I find it fascinating how a simple mistake can provide such valuable insights into the mind of an attacker. It's a constant reminder of the importance of staying vigilant and adapting our defenses.
