Rewterz Threat Alert – Greenbug Targets Pakistani Telecom Sector

Severity

High

Analysis Summary

The Greenbug espionage group is actively targeting telecommunications companies in South Asia, with activity seen as recently as April 2020.Some indications suggest that at least one of the companies was first targeted as early as April 2019.Email appears to be the initial infection vector used by the group. Greenbug is using a mixture of off-the-shelf tools and living-off-the-land techniques in these attacks. It appears the group is interested in gaining access to database servers; we see it stealing credentials then testing connectivity to these servers using the stolen credentials.Analysis revealed that Across multiple victim machines, a file named proposal_pakistan110.chm:error.html was executed via an internet browser. We also see the same file being opened by archiver tools. While we were unable to retrieve the file for analysis, the same technique has been leveraged by Greenbug in the past, as early as 2016. In these earlier attacks, emails were sent to targets containing a link to a likely compromised site, which hosted an archive file. This archive contains a malicious CHM file (compiled HTML Help file), which includes an ADS (alternative data steam) to hide its payload, which is installed when executed. This file usually also contains a decoy PDF file containing an error message that says the file could not be opened correctly.

Greenbug’s activity in this campaign seems to make it clear that its main focus with these victims is to steal credentials, and to maintain a low profile on the victim’s network so the attackers can remain on it for a substantial period of time. This is typical of the activity we have seen in Greenbug victims in the past, with maintaining persistence on a victim network appearing to be one of the group’s primary goals. Greenbug has also been observed targeting telecoms companies in this same region in previous attack campaigns. The setting up of tunnels shows how important keeping a low-profile is for this group. Its focus on stealing credentials, and on establishing connections with database servers, shows that it is aiming to achieve a high level of access to a victim’s network – access that if exploited could cause havoc on a compromised network very quickly. This level of access, if leveraged by actors using disruptive malware or ransomware, could shut down an organization’s entire network very quickly.

Description

Active since at least June 2016, Greenbug most likely uses email to compromise targeted organizations. Symantec believes the group has exclusive access to the malware Trojan.Ismdoor. The group uses additional tools to compromise other computers on the network and steal user names and passwords from operating systems, email accounts, and web browsers.The group mainly targets middle eastern entities for espionage.Greenbug is believed to likely be based out of Iran, and there has been speculation in the past that it has connections to the destructive Shamoon group, which has carried out disk-wiping attacks against organizations in Saudi Arabia.

Impact

• Information Theft
• Reputation Loss

Indicators of Compromise

Domain Name

• apps[.]vvvnews[.]com
• vsiegru[.]com
• kopilkaorukov[.]com

IP

• 95[.]179[.]177[.]157
• 185[.]205[.]210[.]46
• 185[.]243[.]115[.]69
• 185[.]243[.]114[.]247

SHA-256

• 450ebd66ba67bb46bf18d122823ff07ef4a7b11afe63b6f269aec9236a1790cd
• fc002268620fa67ffe260ea9f3a6bbad8637f9bef8ae85b8d6061cec0390b9e2
• 0644b3ffc856eb54b53338ab8ecd22dd005ee5aacfe321f4e61b763a93f82aea
• faba07425c1fa65a9a68a17b99e83663a2a32fbb2a7c3df347b7a7411a7058bc
• 069a29a0642ea5e2034250f5465cb2230edf1b49ad42d16ff4cddfee1f693314
• 471dadfe16cf2cf82566d404d2b7d1baf66b72c385ae272dcc743a285113e280
• 4c7813a1f3eb5d5d8b8a1e53af074c96cfc6ddb14b21188fd84970f001bfc0ff
• ee32bde60d1175709fde6869daf9c63cd3227155e37f06d45a27a2f45818a3dc
• 071e20a982ea6b8f9d482685010be7aaf036401ea45e2977aca867cedcdb0217
• fd95ffb7c70f828ef021e7dbdaf852f54f385095e7f58607f093096b68f40a32
• 53bbc9ebe40725bd74ebf29616f48a8aed0a544dd0e4f40801ac1b522f2cf32f
• f577fc8f22b6eec782dbcbe54f5a8f3b00e8e6d8dc7aa94b2fffcc2b7ce09c6a
• e974237c32f5d28019c5328bd022469236da87eecee19487902133aea89432a0
• 75cee6136011516dfe7bd9e45b25c2cf5d9af149a81fff0b8b3ab157a8cbf321
• 9bf8121e0f3461412dde107c4d1ceb2ed18ec0741f458956830e038fd1be6d44
• 6cb51c7011f27418c772124d4433350a534061f5732c1331f5483d62b42402f7
• abb3ddc945d147a4ed435b71490764bc4a2860f4ad264052f407357911bd6746
• 16e1e886576d0c70af0f96e3ccedfd2e72b8b7640f817c08a82b95ff5d4b1218
• b51eca570abad9341a08ae4d153d2c64827db876ee0491eb941d7e9a48d43554
• 9de28b94aa3f1a849221cf74224554b41a77473c694cadf3f2526ab06480eb85
• b8797931ad99b983239980359ef0ae132615ebedbf6fcb0c0e9979404b4a02a8
• ece23612029589623e0ae27da942440a9b0a9cd4f9681ec866613e64a247969d
• 3c6bc3294a0b4b6e95f747ec847660ce22c5c4eee2681d02cc63f2a88d2d0b86
• 9809aeb6fd388db9ba60843d5a8489fea268ba30e3935cb142ed914d49c79ac5
• 2a3f36c849d9fbfe510c00ac4aca1750452cd8f6d8b1bc234d22bc0c40ea1613

Remediation

• Block all threat indicators at  respective controls.
• Always be suspicious about emails sent by unknown senders. 
• Do not click on the links/attachments sent by unknown senders.