Rewterz Threat Alert – “ZeroCleare” Targets Energy Sector in the Middle East

Severity

High

Analysis Summary

Recent APT attack was reported on an oil and gas company compromising a Windows machine via a vulnerable driver. ZeroCleare then pivoted to spread to other devices on the network – setting up the groundwork for a potentially destructive attack. Reconnaissance began months ago by scanning from various low-cost/free VPN providers and gaining access to one of the accounts that was later involved in the attack, as per the spokesperson. During the summer of 2019, the attackers then used a password spray from a system on the local network to gain access to additional accounts, install ASPX webshells and gain domain administration privileges.

These wiper attacks are seen more frequently in the Middle East. The ZeroCleare wiper is part of the final stage of the overall attack. It is designed to deploy two different ways adapted to 32-bit and 64-bit systems. The general flow of events on 64-bit machines includes using a vulnerable, signed driver and then exploiting it on the target device to allow ZeroCleare to bypass the Windows hardware abstraction layer and avoid some operating system safeguards that prevent unsigned drivers from running on 64-bit machines. Since ZeroCleare relies on the EldoS RawDisk driver, which is not a signed driver and would therefore not run by default, the attackers use an intermediary file named soy.exe to perform the workaround. They load a vulnerable but signed VBoxDrv driver which the DSE accepts and runs and then exploit it to load the unsigned driver, thereby avoiding DSE rejection of the EldoS driver. Once loaded, the vulnerable VBoxDrv driver is exploited to run shellcode on the kernel level. 
Post-exploitation, the driver was used to load the unsigned EldoS driver and proceed to the disk wiping phase. The soy.exe sample uses the Turla Driver Loader (TDL) method to exploit the vulnerability in the VirtualBox driver and load and execute the shellcode.

Wiper attacks focus on destroying infrastructure and disrupting operations rather than on data exfiltration. These attacks have been on the rise in 2019, with IRIS observing a 200-percent increase in their telemetry over the past six months.

Impact

• Security Bypass
• Destruction of infrastructure
• Disruption of operations
• Destruction of devices/data

Indicators of Compromise

MD5

• eaea9ccb40c82af8f3867cd0f4dd5e9d
• 993e9cb95301126debdea7dd66b9e121
• 33f98b613b331b49e272512274669844
• 69b0cec55e4df899e649fa00c2979661

SHA-256

• cf3a7d4285d65bf8688215407bce1b51d7c6b22497f09021f0fce31cbeb78986
• 36a4e35abf2217887e97041e3e0b17483aa4d2c1aee6feadd48ef448bf1b9e6c
• 2a2a32a7e820e4a15abc96491cb3345161e189d6eaf02b62e2f86aac2c7d6c3d
• 2fc39463b6db44873c9c07724ac28b63cdd72f5863a4a7064883e3afdd141f8d

Source IP

• 193.111.152[.]13
• 194.187.249[.]103

Remediation

• Block the threat indicators at their respective controls.
• Deploy IAM (Identity and Access Management).
• Limit privileged user accounts.
• Implement Multi Factor Authentication.
• Have backups, test backups, and offline backups in place.