The cybercriminal group tracked as TA551 not too long ago confirmed a big change in techniques with the addition of the open-source pentest device Sliver to its arsenal, in response to cybersecurity agency Proofpoint.
Additionally known as Shathak, TA551 is an preliminary entry dealer recognized for the distribution of malware by way of thread hijacking – a way the place the adversary features entry to compromised e-mail accounts or stolen messages to make contact with its victims.
Beforehand, the cybercrime group was noticed delivering malware resembling Emotet, IcedID, Qbot, and Ursnif, in addition to offering ransomware operators with entry to the compromised programs.
Earlier this week, Proofpoint seen that the adversary began sending out emails that pretended to be replies to earlier conversations and which contained as attachments password-protected, archived Phrase paperwork.
These attachments, Proofpoint says, finally led to the deployment of the Sliver framework, an open-source pink teaming device for adversary simulation. The device, developed by offensive safety evaluation agency Bishop Fox, supplies command and management (C&C) performance, course of injection and data harvesting capabilities, and extra, and is obtainable totally free.
In accordance with Brad Duncan, safety researcher and handler on the SANS Institute’s Web Storm Heart, simply as Proofpoint raised the alarm on TA551’s shift in techniques, Sliver-based malware began being delivered as a part of a malicious email campaign he has been monitoring for months.
Named “Stolen Pictures Proof”, the marketing campaign employs emails generated by way of contact kind submissions on numerous web sites, “describing a copyright violation to the supposed sufferer,” Duncan explains. A Google-based URL included within the message physique claims to supply proof of stolen photos resulting in that violation.
The adoption of Sliver by cybercriminals comes just some months after authorities businesses within the U.S. and the U.Ok. warned that Russian state-sponsored cyberspy group APT29 (aka the Dukes, Cozy Bear and Yttrium) added the pentest framework to their arsenal.
The transfer, nonetheless, isn’t a surprise, as safety researchers have lengthy warned of the blurred line between nation-state and cybercriminal actions, with both sides adopting techniques from the opposite, to raised disguise their tracks, or engaging in both types of operations.
In accordance with Proofpoint, the usage of pink teaming instruments amongst cybercriminals is changing into more and more fashionable, with Cobalt Strike registering a 161% surge in risk actor use between 2019 and 2020. Cybercriminals are additionally utilizing offensive frameworks resembling Lemon Tree and Veil.
“TA551’s use of Sliver demonstrates appreciable actor flexibility. […] With Sliver, TA551 actors can achieve direct entry and work together with victims instantly, with extra direct capabilities for execution, persistence, and lateral motion. This doubtlessly removes the reliance on secondary entry,” Proofpoint notes.
Associated: Ransomware Attacks Linked to Chinese Cyberspies