• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Press Release
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – Malspam campaign dropping XpertRAT Malware via ISO images
July 12, 2019
Rewterz Threat Alert – DNS Infrastructure Hijacking Campaign
July 15, 2019

Rewterz Threat Alert – Buhtrap Group uses Zero Day in latest Espionage Campaigns

July 12, 2019

Severity

High

Analysis Summary


The Buhtrap group is well known for its targeting of financial institutions and businesses in Russia. However, since late 2015, an interesting change in its traditional targets. From a pure criminal group perpetrating cybercrime for financial gain, its toolset has been expanded with malware used to conduct espionage in Eastern Europe and Central Asia.

Throughout the tracking, this group deploy its main backdoor as well as other tools against various victims, but June 2019 was the first time the Buhtrap group use a zero-day exploit as part of a campaign. In that case, we observed Buhtrap using a local privilege escalation exploit, CVE-2019-1132, against one of its victims. The exploit abuses a local privilege escalation vulnerability in Microsoft Windows, specifically a NULL pointer dereference in the win32k.sys component. Once the exploit was discovered and analyzed, it was reported to the Microsoft Security Response Center, who promptly fixed the vulnerability and released a patch.

New tools have been added to their arsenal and updates applied to older ones, the tactics, techniques and procedures (TTPs) used in the different Buhtrap campaigns have not changed dramatically over all these years. They still make extensive use of NSIS installers as droppers and these are mainly delivered through malicious documents. Also, several of their tools are signed with valid code-signing certificates and abuse a known, legitimate application to side-load their malicious payloads.

Impact

Privilege escalation

Indicators of Compromise

URLs

  • 7812[.]reg0.5204[.]toor[.]win10[.]ipv6-microsoft[.]org
  • 7812[.]reg0[.]5267[.]toor[.]win10[.]ipv6-microsoft[.]org
  • 7812[.]reg0.5314[.]toor.win10[.]ipv6-microsoft[.]org
  • 7812[.]reg0.5361[.]toor[.]win10.ipv6-microsoft[.]org
  • 7812[.]reg0[.]4621.toor[.]win10.ipv6-microsoft[.]org
  • 7812[.]reg0[.]5173[.]toor.win10[.]ipv6-microsoft[.]org
  • corp-microsoft[.]co

Malware Hash (MD5/SHA1/SH256)

  • 2f2640720cce2f83ca2f0633330f13651384dd6a
  • 6e820b5732cd8bb95546cf39aeb6babe90cf4cc7dde675b718710babcf1740b5
  • b475f14a1ffdeaf883c73e97724544b9bba0f6c481830bd25e3ba0d0f69b9181
  • c17c335b7ddb5c8979444ec36ab668ae8e4e0a72
  • e0f3557ea9f2ba4f7074caa0d0cf3b187c4472ff
  • fd6c772c31da19a66283af4703d1d5072a9158d03031a4094ac2eb8dccd3d6d1

Remediation

Search for the existing IOC’s in your environment.
Patch for the exploited vulnerability.

https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2019-1132

  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.