Cryptocurrency mining was recently been used as a way to hide the purpose of their activity and to avoid triggering high-priority alerts by an advanced threat group called Bismuth.
Typically regarded as a non-critical security issue, the method of coin mining allows the actor to establish persistence and move laterally on the compromised network, at the same time monetizing from the attack.
Human and civil rights organizations are regularly being targeted by Bismuth. However, its list of victims includes multinational companies, financial services, educational institutions, and entities in the government sector.
It is being assumed that the threat actor group has been running its cyberespionage operations since at least 2012. Since then its attacks have increased in complexity combining custom tools with freely available ones.
Monero coin miners were utilized on compromised systems belonging to private and government organizations in France and Vietnam by Bismuth in its recent attacks campaigns.
After detecting the attacks that occurred in July and August, Microsoft learned that the cryptojacking activity did not change the actor’s objective, continuing to monitor and steal information of interest.
“The use of coin miners by BISMUTH was unexpected, but it was consistent with the group’s longtime methods of blending in” – Microsoft.
Hackers studied the victims before sending spear-phishing emails created for a specific recipient to obtain initial access. According to researchers, the attacker even virtually interacted with the victim to build trust and increase the chance of a successful infection.
Using older applications for DLL side loading
Hackers used Gmail accounts specifically tailored for each recipient. It is believed by Microsoft that information from public sources was used by Bismuth hackers to determine their targets and customize the messages.
Bismuth also used a widely used technique, DLL side-loading, that takes advantage of how Windows applications handle these file types to load a malicious DLL that spoofs a legitimate one.
Older versions of several applications that were still vulnerable to DLL side-loading were planned and attacked by the threat actors in their summer attack campaign. Among these applications were Microsoft Defender, the Sysinternals DebugView tool, Microsoft Word 2007, and an exploited cybersecurity product among others.
<Bismuth attack chain>
Based on a custom malware named KerrDown dropped during the infection chain and used exclusively by Bismuth, the researchers were able to attribute these attacks to Bismuth. The malware impersonated a DLL from Microsoft Word 2007 and executed in the context of the application.
Discovery and Escalation
According to Microsoft, Bismuth spent nearly a month identifying computers on the victim network before they moved laterally to servers that enabled them to spread further.
Bismuth hackers collected details about the domain and local administrators, checked user privileges on local machines, and pulled device information, all while scanning the network.
With the help of PowerShell, the threat actors could remain undetected and execute multiple cmdlets that helped with moving across the network and carry out the attack. The activity involved the following stages:
- Stealing credentials from the Security Account Manager (SAM) database
- Collecting information pertaining to domain group and user
- Connecting to devices via WMI (Windows Management Instrumentation)
- Collection of credentials from security logs under Event ID 680 (possibly targeting logs related to NTLM fallbacks)
- Collecting domain trust info and ping database and file servers identified during reconnaissance
- Installation of a Cobalt Strike beacon via DLL side loading, using an outdated copy of exploited cybersecurity product that runs with elevated privileges
On the local system, Installation of the coin miners preceded credential theft efforts via Mimikatz. It acted as a smokescreen for real activities since the hackers did not make much money from this.
By registering them under a legitimate service name they were able to hide this activity as well. A common Virtual Machine process was used in one case.
“Because BISMUTH’s attacks involved techniques that ranged from typical to more advanced, devices with common threat activities like phishing and coin mining should be elevated and inspected for advanced threats” – Microsoft.
The strategy used by this threat to blend in with regular network activity and the use of common threats that are often disregarded as non-critical allow them to run their operation without the pressure of immediate action against them.
Furthermore, according to the tech giant Bismuth shares similarities with a nation-state group called OceanLotus (APT 32).
Our internal experts recommend companies not to dismiss identified common threats like coin mining and to investigate them for more advanced hacker activity.
To read more, please check eScan Blog
