Rewterz Threat Alert – Buhtrap Group uses Zero Day in latest Espionage Campaigns

Severity

High

Analysis Summary

The Buhtrap group is well known for its targeting of financial institutions and businesses in Russia. However, since late 2015, an interesting change in its traditional targets. From a pure criminal group perpetrating cybercrime for financial gain, its toolset has been expanded with malware used to conduct espionage in Eastern Europe and Central Asia.

Throughout the tracking, this group deploy its main backdoor as well as other tools against various victims, but June 2019 was the first time the Buhtrap group use a zero-day exploit as part of a campaign. In that case, we observed Buhtrap using a local privilege escalation exploit, CVE-2019-1132, against one of its victims. The exploit abuses a local privilege escalation vulnerability in Microsoft Windows, specifically a NULL pointer dereference in the win32k.sys component. Once the exploit was discovered and analyzed, it was reported to the Microsoft Security Response Center, who promptly fixed the vulnerability and released a patch.

New tools have been added to their arsenal and updates applied to older ones, the tactics, techniques and procedures (TTPs) used in the different Buhtrap campaigns have not changed dramatically over all these years. They still make extensive use of NSIS installers as droppers and these are mainly delivered through malicious documents. Also, several of their tools are signed with valid code-signing certificates and abuse a known, legitimate application to side-load their malicious payloads.

Impact

Privilege escalation

Indicators of Compromise

URLs

• 7812[.]reg0.5204[.]toor[.]win10[.]ipv6-microsoft[.]org
• 7812[.]reg0[.]5267[.]toor[.]win10[.]ipv6-microsoft[.]org
• 7812[.]reg0.5314[.]toor.win10[.]ipv6-microsoft[.]org
• 7812[.]reg0.5361[.]toor[.]win10.ipv6-microsoft[.]org
• 7812[.]reg0[.]4621.toor[.]win10.ipv6-microsoft[.]org
• 7812[.]reg0[.]5173[.]toor.win10[.]ipv6-microsoft[.]org
• corp-microsoft[.]co

Malware Hash (MD5/SHA1/SH256)

• 2f2640720cce2f83ca2f0633330f13651384dd6a
• 6e820b5732cd8bb95546cf39aeb6babe90cf4cc7dde675b718710babcf1740b5
• b475f14a1ffdeaf883c73e97724544b9bba0f6c481830bd25e3ba0d0f69b9181
• c17c335b7ddb5c8979444ec36ab668ae8e4e0a72
• e0f3557ea9f2ba4f7074caa0d0cf3b187c4472ff
• fd6c772c31da19a66283af4703d1d5072a9158d03031a4094ac2eb8dccd3d6d1

Remediation

Search for the existing IOC’s in your environment.
Patch for the exploited vulnerability.

https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2019-1132