Government Agency in Middle East Targeted by Cyberespionage Attack

One sentence summary – A government agency in the Middle East has been targeted by a cyberespionage attack orchestrated by the state-sponsored hacking group Stealth Falcon APT, using a backdoor malware called “Deadglyph” that has previously been associated with campaigns targeting activists, journalists, and dissidents; meanwhile, the P2PInfect worm has seen a surge in activity, targeting poorly secured Redis instances and employing various methods for initial access, with indications of attempted crypto miner payload retrieval and speculation that the developers may be withholding additional functionality or selling access to the botnet.

At a glance

• A government agency in the Middle East was targeted by a sophisticated cyberespionage attack orchestrated by the Stealth Falcon APT, a state-sponsored hacking group believed to be operating from the UAE.
• The attack utilized a backdoor malware called “Deadglyph,” which has been previously associated with the group’s campaigns targeting activists, journalists, and dissidents.
• The Deadglyph malware has a complex infection process involving three key components: a registry shellcode loader, an Executor component, and an Orchestrator component.
• Deadglyph is capable of downloading additional modules from the command and control (C2) server, including a process creator, an info collector, and a file reader.
• Another malware called P2PInfect has seen a surge in activity, targeting poorly secured Redis instances and employing various methods for initial access, including exploiting vulnerabilities and overwriting SSH authorized_keys files.

The details

A recent cyberespionage incident has seen a government agency in the Middle East targeted by a sophisticated attack.

The attack was orchestrated by the Stealth Falcon APT, a state-sponsored hacking group believed to be operating from the UAE.

The group employed a backdoor malware known as “Deadglyph” in the attack.

Deadglyph has been previously associated with the group’s campaigns targeting activists, journalists, and dissidents.

ESET researcher Filip Jurčacko has extensively analyzed the Deadglyph malware and its intricate infection process.

The exact means of initial infection remain unknown, but it is suspected that a malicious executable may be employed.

The loading chain of Deadglyph involves three key components: a registry shellcode loader, an Executor component, and an Orchestrator component.

To evade detection, the initial component exists as a DLL file on the compromised system’s disk.

This DLL file employs homoglyph techniques to mimic legitimate Microsoft information.

Upon execution, the loader retrieves encrypted shellcode from the Windows Registry.

This shellcode is then decrypted and executed by the Executor component.

The Executor component is responsible for loading AES-encrypted configurations, initializing the .NET runtime, and acting as a library.

The Orchestrator component handles communication with the command and control (C2) server.

This enables the malware to receive commands and exfiltrate data.

In the event of communication failure with the C2 server, Deadglyph triggers a self-removal mechanism to prevent analysis.

The malware exhibits modularity, allowing it to download additional modules from the C2 server for expanded functionality.

ESET researchers have obtained three modules so far: a process creator, an info collector, and a file reader.

The process creator enables the execution of specified commands as new processes.

The info collector gathers system data through WMI queries.

The file reader reads file content and can delete files after reading them.

Specific details regarding the initial infection method remain unknown, making it challenging to devise targeted defense strategies.

Defenders can rely on the indicators of compromise (IoCs) released in the report to detect and mitigate potential Deadglyph infections.

In a separate development, the P2PInfect worm has witnessed a surge in activity since late August 2023.

The malware developers have exhibited a high development cadence, resulting in the proliferation of numerous variants in the wild.

The majority of compromised systems have been reported in China, the United States, Germany, the United Kingdom, Singapore, Hong Kong, and Japan.

Initially, P2PInfect targeted poorly secured Redis instances.

It exploited vulnerabilities in the Redis SLAVEOF command and abused the database’s replication feature to deliver its payload.

Recent variants have employed alternative methods for initial access.

These newer versions establish persistence through a cron job and retrieve the malware binary from a peer.

P2PInfect also employs a technique to overwrite SSH authorized_keys files with an attacker-controlled SSH key.

This effectively locks out legitimate users from accessing the compromised system.

The primary payload attempts to change user passwords to a specific format but requires root access.

While the exact objectives of P2PInfect remain unclear, there have been indications of attempted crypto miner payload retrieval.

Speculation suggests that the developers may be withholding additional functionality or potentially selling access to the botnet.

This comprehensive overview of the Deadglyph malware and the P2PInfect worm highlights the sophisticated and evolving nature of cyber threats targeting government agencies and Redis instances.

Organizations are advised to remain vigilant, implement robust security measures, and stay updated on the indicators of compromise associated with these threats.

Article X-ray