• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – CStealer Trojan Targeting Chrome Passwords
December 5, 2019
Rewterz Threat Advisory – CVE-2019-18232 – ICS: Thales DIS SafeNet Sentinel LDK License Manager Runtime Privilege Escalation Vulnerability
December 6, 2019

Rewterz Threat Alert – “ZeroCleare” Targets Energy Sector in the Middle East

December 5, 2019

Severity

High

Analysis Summary

Recent APT attack was reported on an oil and gas company compromising a Windows machine via a vulnerable driver. ZeroCleare then pivoted to spread to other devices on the network – setting up the groundwork for a potentially destructive attack. Reconnaissance began months ago by scanning from various low-cost/free VPN providers and gaining access to one of the accounts that was later involved in the attack, as per the spokesperson. During the summer of 2019, the attackers then used a password spray from a system on the local network to gain access to additional accounts, install ASPX webshells and gain domain administration privileges.

zerocleare.png

These wiper attacks are seen more frequently in the Middle East. The ZeroCleare wiper is part of the final stage of the overall attack. It is designed to deploy two different ways adapted to 32-bit and 64-bit systems. The general flow of events on 64-bit machines includes using a vulnerable, signed driver and then exploiting it on the target device to allow ZeroCleare to bypass the Windows hardware abstraction layer and avoid some operating system safeguards that prevent unsigned drivers from running on 64-bit machines. Since ZeroCleare relies on the EldoS RawDisk driver, which is not a signed driver and would therefore not run by default, the attackers use an intermediary file named soy.exe to perform the workaround. They load a vulnerable but signed VBoxDrv driver which the DSE accepts and runs and then exploit it to load the unsigned driver, thereby avoiding DSE rejection of the EldoS driver. Once loaded, the vulnerable VBoxDrv driver is exploited to run shellcode on the kernel level. 
Post-exploitation, the driver was used to load the unsigned EldoS driver and proceed to the disk wiping phase. The soy.exe sample uses the Turla Driver Loader (TDL) method to exploit the vulnerability in the VirtualBox driver and load and execute the shellcode.

Wiper attacks focus on destroying infrastructure and disrupting operations rather than on data exfiltration. These attacks have been on the rise in 2019, with IRIS observing a 200-percent increase in their telemetry over the past six months.

Impact

  • Security Bypass
  • Destruction of infrastructure
  • Disruption of operations
  • Destruction of devices/data

Indicators of Compromise

MD5

  • eaea9ccb40c82af8f3867cd0f4dd5e9d
  • 993e9cb95301126debdea7dd66b9e121
  • 33f98b613b331b49e272512274669844
  • 69b0cec55e4df899e649fa00c2979661

SHA-256

  • cf3a7d4285d65bf8688215407bce1b51d7c6b22497f09021f0fce31cbeb78986
  • 36a4e35abf2217887e97041e3e0b17483aa4d2c1aee6feadd48ef448bf1b9e6c
  • 2a2a32a7e820e4a15abc96491cb3345161e189d6eaf02b62e2f86aac2c7d6c3d
  • 2fc39463b6db44873c9c07724ac28b63cdd72f5863a4a7064883e3afdd141f8d

Source IP

  • 193.111.152[.]13
  • 194.187.249[.]103

Remediation

  • Block the threat indicators at their respective controls.
  • Deploy IAM (Identity and Access Management).
  • Limit privileged user accounts.
  • Implement Multi Factor Authentication.
  • Have backups, test backups, and offline backups in place.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.