Executive Summary

Activities

FIN7-RYUK Association

New Attack Vectors Exploited by CobaltStrike APTs

Vector A

Vector B

Miscellaneous Intelligence on CobaltStrike Actors

Impact

• As the Cobalt beacon is capable of using various tactics such as process injection methods to evade security systems and remain in the target environment undetected, even legitimate processes running on the target device can get infected. 
• Exfiltration of data and C2 communication can be hidden in innocent looking network traffic by utilising malleable C2 capabilities.

• An attacker can integrate other popular frameworks like Metasploit/ Empire and Mimikatz to carry out post exploitation phases including lateral movement and privilege escalation.
• The threat actor can gain control over the target OS leading to disk access with read/write/execute permissions.
• An attacker can make changes to system services and registries which are crucial elements in any Windows system, to enable persistence.
• CobaltStrike can stage a VNC server to control the victim remotely.
• Integration with PowerShell gives the attacker easy means for further reconnaissance and post exploitation tactics like DLL loading to use custom programs made by attackers to further the attack.
• Two factor authentication can be bypassed by using attack forms like Browser Pivot, to hijack a compromised user’s authenticated session and mimic the target.
• Advanced tunnelling capabilities built into Cobalt let attackers perform pivoting into other segments of the network via compromised footholds.

Mitigation

• Sandboxes should emulate named pipes to detect the presence of Cobalt shellcode as CobaltStrike hides shellcode over named pipes.
• Very strict network traffic examination to detect Cobalt C2 communication. The challenge is that it is a malleable C2 system that can use any profile of legitimate applications dictated by the operator to evade security and detection. The security team should specifically focus on HTTPS traffic as it is the default channel for C2 communication.
• Frequency analysis of network traffic helps in identifying bot traffic from human generated traffic as the latter one will not be uniform.
• If the HOST header of the traffic does not match with that of the destination address, it is likely to be a malicious one.
• Check the URI against various CobaltStrike URI Indicators of Compromise to confirm the presence of the Cobalt beacon.
• Enforce the rule of “least privilege” to domain accounts to restrict a user from having more privilege than they need.
•  Effective utilisation of SIEM systems to monitor ingress and egress traffic.
• Proper isolation and segmentation of the network to protect critical assets.
• Security administrators need to implement effective vulnerability management programmes to roll out patches and keep the systems updated.
• Make users aware of phishing campaigns and client-side attacks to save themselves from phishing attacks. 

Tactics, Techniques and Procedures (CobaltStrike)

Indicators of Compromise