[null, null, null, {"document_url": "http://blog.morphisec.com/iranian-fileless-cyberattack-on-israel-word-vulnerability%20", "unformatted_src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/cyberattack-on-israel-97521494.jpg?t=1508452531780&width=750&height=450&name=cyberattack-on-israel-97521494.jpg", "src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/cyberattack-on-israel-97521494.jpg?t=1508452531780&width=750&height=450&name=cyberattack-on-israel-97521494.jpg", "formatted_filename": "cyberattack on israel", "alt_text": "cyberattack-on-israel-97521494.jpg", "rendered_width": 750, "rendered_height": 450}, null, {"document_url": "http://blog.morphisec.com/iranian-fileless-cyberattack-on-israel-word-vulnerability%20", "unformatted_src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Iranian%20Cyberattack%20on%20Israel_01.png?t=1508452531780&width=750&height=404&name=Iranian%20Cyberattack%20on%20Israel_01.png", "src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Iranian%20Cyberattack%20on%20Israel_01.png?t=1508452531780&width=750&height=404&name=Iranian%20Cyberattack%20on%20Israel_01.png", "formatted_filename": "Iranian Cyberattack on Israel", "alt_text": "Iranian Cyberattack on Israel_01.png", "rendered_width": 750, "rendered_height": 404}, null, {"document_url": "http://blog.morphisec.com/iranian-fileless-cyberattack-on-israel-word-vulnerability%20", "unformatted_src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_02.png?t=1508452531780&width=750&name=Cyberattack%20on%20Israel_02.png", "src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_02.png?t=1508452531780&width=750&name=Cyberattack%20on%20Israel_02.png", "formatted_filename": "Cyberattack on Israel", "alt_text": "Cyberattack on Israel_02.png", "rendered_width": 750}, null, {"document_url": "http://blog.morphisec.com/iranian-fileless-cyberattack-on-israel-word-vulnerability%20", "unformatted_src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_03.png?t=1508452531780&width=750&name=Cyberattack%20on%20Israel_03.png", "src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_03.png?t=1508452531780&width=750&name=Cyberattack%20on%20Israel_03.png", "formatted_filename": "Cyberattack on Israel", "alt_text": "Iranian Cyberattack on Israel_03.png", "rendered_width": 750}, null, {"document_url": "http://blog.morphisec.com/iranian-fileless-cyberattack-on-israel-word-vulnerability%20", "unformatted_src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_04.png?t=1508452531780&width=750&name=Cyberattack%20on%20Israel_04.png", "src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_04.png?t=1508452531780&width=750&name=Cyberattack%20on%20Israel_04.png", "formatted_filename": "Cyberattack on Israel", "alt_text": "Cyberattack on Israel_04.png", "rendered_width": 750}, {"document_url": "http://blog.morphisec.com/iranian-fileless-cyberattack-on-israel-word-vulnerability%20", "unformatted_src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_05.png?t=1508452531780&width=750&name=Cyberattack%20on%20Israel_05.png", "src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_05.png?t=1508452531780&width=750&name=Cyberattack%20on%20Israel_05.png", "formatted_filename": "Cyberattack on Israel", "alt_text": "Cyberattack on Israel_05.png", "rendered_width": 750}, null, {"document_url": "http://blog.morphisec.com/iranian-fileless-cyberattack-on-israel-word-vulnerability%20", "unformatted_src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_06.png?t=1508452531780&width=452&height=229&name=Cyberattack%20on%20Israel_06.png", "src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_06.png?t=1508452531780&width=452&height=229&name=Cyberattack%20on%20Israel_06.png", "formatted_filename": "Cyberattack on Israel", "alt_text": "Cyberattack on Israel_06.png", "rendered_width": 452, "rendered_height": 229}, null, {"document_url": "http://blog.morphisec.com/iranian-fileless-cyberattack-on-israel-word-vulnerability%20", "unformatted_src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_07.png?t=1508452531780&width=328&height=404&name=Cyberattack%20on%20Israel_07.png", "src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_07.png?t=1508452531780&width=328&height=404&name=Cyberattack%20on%20Israel_07.png", "formatted_filename": "Cyberattack on Israel", "alt_text": "Cyberattack on Israel_07.png", "rendered_width": 328, "rendered_height": 404}, null, {"document_url": "http://blog.morphisec.com/iranian-fileless-cyberattack-on-israel-word-vulnerability%20", "unformatted_src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_08.png?t=1508452531780&width=750&name=Cyberattack%20on%20Israel_08.png", "src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_08.png?t=1508452531780&width=750&name=Cyberattack%20on%20Israel_08.png", "formatted_filename": "Cyberattack on Israel", "alt_text": "Cyberattack on Israel_08.png", "rendered_width": 750}, {"document_url": "http://blog.morphisec.com/iranian-fileless-cyberattack-on-israel-word-vulnerability%20", "unformatted_src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_09.png?t=1508452531780&width=598&height=167&name=Cyberattack%20on%20Israel_09.png", "src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_09.png?t=1508452531780&width=598&height=167&name=Cyberattack%20on%20Israel_09.png", "formatted_filename": "Cyberattack on Israel", "alt_text": "Cyberattack on Israel_09.png", "rendered_width": 598, "rendered_height": 167}, null, {"document_url": "http://blog.morphisec.com/iranian-fileless-cyberattack-on-israel-word-vulnerability%20", "unformatted_src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_10.png?t=1508452531780&width=750&name=Cyberattack%20on%20Israel_10.png", "src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_10.png?t=1508452531780&width=750&name=Cyberattack%20on%20Israel_10.png", "formatted_filename": "Cyberattack on Israel", "alt_text": "Cyberattack on Israel_10.png", "rendered_width": 750}, null, {"document_url": "http://blog.morphisec.com/iranian-fileless-cyberattack-on-israel-word-vulnerability%20", "unformatted_src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_11.png?t=1508452531780&width=750&name=Cyberattack%20on%20Israel_11.png", "src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_11.png?t=1508452531780&width=750&name=Cyberattack%20on%20Israel_11.png", "formatted_filename": "Cyberattack on Israel", "alt_text": "Cyberattack on Israel_11.png", "rendered_width": 750}, null, {"document_url": "http://blog.morphisec.com/iranian-fileless-cyberattack-on-israel-word-vulnerability%20", "unformatted_src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_12.png?t=1508452531780&width=750&name=Cyberattack%20on%20Israel_12.png", "src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_12.png?t=1508452531780&width=750&name=Cyberattack%20on%20Israel_12.png", "formatted_filename": "Cyberattack on Israel", "alt_text": "Cyberattack on Israel_12.png", "rendered_width": 750}, {"document_url": "http://blog.morphisec.com/iranian-fileless-cyberattack-on-israel-word-vulnerability%20", "unformatted_src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_13.png?t=1508452531780&width=750&name=Cyberattack%20on%20Israel_13.png", "src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_13.png?t=1508452531780&width=750&name=Cyberattack%20on%20Israel_13.png", "formatted_filename": "Cyberattack on Israel", "alt_text": "Cyberattack on Israel_13.png", "rendered_width": 750}, null, {"document_url": "http://blog.morphisec.com/iranian-fileless-cyberattack-on-israel-word-vulnerability%20", "unformatted_src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_14.png?t=1508452531780&width=750&name=Cyberattack%20on%20Israel_14.png", "src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_14.png?t=1508452531780&width=750&name=Cyberattack%20on%20Israel_14.png", "formatted_filename": "Cyberattack on Israel", "alt_text": "Cyberattack on Israel_14.png", "rendered_width": 750}, null, {"document_url": "http://blog.morphisec.com/iranian-fileless-cyberattack-on-israel-word-vulnerability%20", "unformatted_src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_15.png?t=1508452531780&width=750&height=498&name=Cyberattack%20on%20Israel_15.png", "src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_15.png?t=1508452531780&width=750&height=498&name=Cyberattack%20on%20Israel_15.png", "formatted_filename": "Cyberattack on Israel", "alt_text": "Cyberattack on Israel_15.png", "rendered_width": 750, "rendered_height": 498}, null, {"document_url": "http://blog.morphisec.com/iranian-fileless-cyberattack-on-israel-word-vulnerability%20", "unformatted_src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_16.png?t=1508452531780&width=750&height=625&name=Cyberattack%20on%20Israel_16.png", "src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/17-04/CVE-2017-0199/Cyberattack%20on%20Israel_16.png?t=1508452531780&width=750&height=625&name=Cyberattack%20on%20Israel_16.png", "formatted_filename": "Cyberattack on Israel", "alt_text": "Cyberattack on Israel_16.png", "rendered_width": 750, "rendered_height": 625}, null, {"document_url": "http://blog.morphisec.com/iranian-fileless-cyberattack-on-israel-word-vulnerability%20", "unformatted_src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/Gartner_Cool_Vendor_2016_160px.png?t=1508452531780&width=162&name=Gartner_Cool_Vendor_2016_160px.png", "src": "https://blog.morphisec.com/hs-fs/hubfs/Blog_images/Gartner_Cool_Vendor_2016_160px.png?t=1508452531780&width=162&name=Gartner_Cool_Vendor_2016_160px.png", "formatted_filename": "Gartner Cool Vendor px", "alt_text": "Morphisec is a Gartner Cool Vendor 2016", "rendered_width": 162}, null, null]
   
Iranian Fileless Attack Infiltrates Israeli Organizations

Posted by Michael Gorelik on Apr 27, 2017 7:11:43 PM From April 19-24, 2017, a politically-motivated, targeted campaign was carried out against numerous Israeli organizations. Morphisec researchers began investigating the attacks on April 24 and continue to uncover more details. Initial reports of the attacks, published April 26 (in Hebrew) by the Israel National Cyber Event Readiness Team (CERT-IL) and The Marker, confirm that the attack was delivered through compromised email accounts at Ben-Gurion University and sent to multiple targets across Israel. Ironically, Ben-Gurion University is home to Israel’s Cyber Security Research Center. Investigators put the origin of the attack as Iranian; Morphisec’s research supports this conclusion and attributes the attacks to the same infamous hacker group responsible for the OilRig malware campaigns.

The attack was delivered via Microsoft Word documents that exploited a former zero-day vulnerability in Word, CVE-2017-0199, to install a fileless variant of the Helminth Trojan agent. Microsoft released the patch for the vulnerability on April 11, but many organizations have not yet deployed the update. The attackers actually based their attack on an existing Proof-of-Concept method that was published by researchers after the patch release.

By hunting through known malware repositories, Morphisec identified matching samples uploaded by Israeli high-tech development companies, medical organizations and education organizations, indicating that they were victims of the attack. For security purposes, Morphisec is not revealing these names.

The delivery was executed by compromising the email accounts of a few high-profile individuals at Ben-Gurion University. The Word document was sent as a reply to legitimate emails sent from those accounts and was propagated to more than 250 individuals in different Israeli companies, according to CERT-IL.

Upon deeper investigation into the installed Helminth fileless agent, we identified a near perfect match to the OilRig campaign executed by an Iranian hacker group against 140 financial institutions in the Middle East last year, as analyzed by FireEye , Palo Alto Networks and Logrhythm. This group has become one of the most active threat actors, with noteworthy abilities, resources and infrastructure; speculations indicate the hacking organization to be sponsored by the Iranian government. In other recent attacks (January 2017), the group used a fake Juniper Networks VPN portal and fake University of Oxford websites to deliver malware as described by ClearSky.

Our report presents the technical details of the attack, emphasizing differences from last year’s attack. In particular, there are several enhancements to different evasive mechanisms and some modifications in the communications protocol, which delivers PowerShell commands from the C&C.

The most important difference is that the use of macros was exchanged with a vulnerability exploit. With their ability to set up the attack in a relatively short time, the threat actors could correctly speculate that their window of opportunity between patch release and patch rollout was still open.

At the time of publication, the C&C servers are still active and will be listed herein as all other signatures and indicators of compromise.


Word Delivery

The different delivered documents, as shown below, are generally named with some random number <random number>.doc. Morphisec identified the following set of documents:

CVE-2017-0199 Vulnerability Exploit

The most notable difference from last year’s OilRig campaign is the way the attack was delivered. In the previous campaign, the Iranian group sent specially crafted Excel and Word files, which contained macros that targeted individuals were convinced to enable.

In this campaign, no macros were required. Each document utilized the vulnerability by an embedded link that delivers an .hta file (html executable). Morphisec identified the following delivered test<number>.hta file with the same signature delivered from the following domains:

SHA256: 5ac61ea5142d53412a251eb77f2961e3334a00c83da9087d355a49618220ac43

The .hta file is immediately executed by mshta.exe, the Windows process which executes html executables. As a result, the user is usually shown a warning message, despite the fact that the HTA is still executed even if the user chooses “No”: The .hta file in this attack is much more sophisticated than in previous versions, and actually disables this message by sending an “Enter” command to the warning window. This is covered in the next section.

HTA Execution and Persistency

The HTA execution goes through the following steps: Helminth Trojan Installation and Persistency

0011.ps1 script, which is activated by the .hta file, is in charge of generating the Helminth Trojan PowerShell and VBS files.

Morphisec identified the following structure: This structure matches the attack structure from October 2016, as described by Logrhythm: Aside the unique generation of the files, the structure and the functionality of the trojan is very similar to the previous campaign: Communication Protocol

We will focus here on the DnE1.Ps1 file because all other files are almost identical to the previous campaign. This file executes some of the same commands executed by VBS script in the previous campaign, but there are differences as well. The script connects to a C&C server – vpsupdate[.]tk. At the time of this report’s publication, the C&C server is still live; the server was first registered on April 16, 2017. The goal of the script is to: At each new activation (first) activation of the download command (GET request), the infected computer receives a bat script for activation from the C&C:

The file name of the bat script is then delivered through the response headers, and the content of the bat script is delivered through the response. Both of them are encoded in base 64. The name of the file is default.bat (decoded from Content-Disposition property in the header) and it is saved temporary in the dn folder (described in the next section).

Note: Morphisec identified several other samples of communication with different C&C servers (“alenupdate[.]info” and “maralen[.]tk”) in which a more advanced customized version of Mimikatz was sent to specific users, and an additional agent was installed in the “C:\Program Files (x86)\Microsoft Idle\” directory: Back to the popular variant of the protocol: As soon as the file executes and the result output is written to default.bat.txt (similarly to the previous campaign), the resulting file is uploaded back to the C&C using the following URL command (POST request): At the same time, the DnE1.Ps1 is executed. The DnS1.Ps1 is also executed and communicates with the C&C using DNS exchange queries (the same as in the previous campaign). This kind of communication is very hard to block since DNS is a basic functionality required in any organization.

Delivered Commands

The bat script is a customized version of Mimikatz (with slight modification from the last campaign). Its goal is to gather information from the computer and the network: The added commands are chcp to handle non-ASCII characters (e.g. Hebrew) and the validation of the scheduled task (which should have been added by the persistency mechanism).

As mentioned in the previous section, Morphisec identified an advanced version of the same bat script communicating with the alenupdate[.]info C&C. In that case, the information that is gathered includes A.V., Firewall and AntiSpy product information. The persistent tasks are slightly different as well, “Google Update Core” and “Google Sync Core”. Every few years, a new “logic bug” CVE in OLE object linking is identified; the previous one was three years ago (CVE-2014-4114 and CVE-2014-6352). This kind of vulnerability is rare but powerful. It allows attackers to embed OLE objects (or links in the case of CVE-2017-0199) and bypass Microsoft validation of OLE execution without warning. In essence, it is the same as playing animation in PowerPoint.

Such vulnerabilities should be patched immediately.

It is significant to note how the Iranian threat actors advanced their abilities in such a short time:

With many organizations taking high-risk vulnerabilities seriously and patching them as quickly as possible, attackers can no longer exploit them for an extended period of time. We therefore expect that threat actors will return to macro-based campaigns like Hancitor.

Indicators of Compromise (IOCs)

Document delivery

HTA delivery servers:

HTA files:

Helminth Trojan Installers:



CERT-IL has listed additional IoCs that are not mentioned in this list, which include the January campaign that involved malicious Juniper Networks VPN and fake Oxford registration form executables and their C&C domain server.

Topics: 0-day exploits, Zero-day, Attack Analysis, Fileless Attacks



Morphisec Named a Cool Vendor 2016 follow us:  

© Morphisec Ltd., 2017