Article Content INTRODUCTION On June 7, 2017, Morphisec Lab identified a new, highly sophisticated fileless attack targeting restaurants across the US The ongoing campaign allows hackers to seize system control and install a backdoor to steal financial information at will It incorporates some never before seen evasive techniques that allow it to bypass most security solutions – signature and behavior based Aside from these updated techniques, Morphisec’s investigation revealed an almost perfect match to FIN7 attack methods Past highly successful and damaging attacks on banks, SEC personnel, large restaurant chains and hospitality organizations have all been attributed to the financially-motivated FIN7 group FIN7, which is also associated with the Carbanak gang, must be seen as one of the leading threat actor groups operating today The Word document executes a fileless attack that uses DNS queries to deliver the next shellcode stage (Meterpreter) OpenDNS investigate data, shared in coordination with the Cisco Advanced Threat Research & Efficacy Team, shows that this is a large-scale, currently active attack with peaks of more than 10K DNS requests per hour This means the attackers successfully bypass static analysis by most of the security solutions By contrast, Morphisec’s Moving Target Defense-based technology prevents the attack in its early stages, before any channel to the attacker is opened TECHNICAL ANALYSIS Below we describe the full technical details, beginning with the initial email through the final Meterpreter session used to hijack the computer PHISHING EMAIL: As seen in the email below, FIN7’s attack campaign targets restaurants The content of the email is well crafted to avoid suspicion Some of the email attachments are called menu.rtf, others Olive Garden.rtf or Chick Fil A Order.rtf (all the identified hashes are listed at the end) WORD DELIVERY: The attached .rtf file uses OLE and has many similarities to previous FIN7 attacks But this attack, instead of activating hta files (mshta.exe) from within the link, executes obfuscated JavaScript code All the victim needs to do is double click on the envelope and press OK PERSISTENCY: In some cases, an additional scheduled task “AdobeFlashSync” is created for persistency Afterwards, it deletes its own JavaScript code traces The shellcode is the primary differentiating technique between this campaign and past attacks by FIN7 and other threat actors This shellcode iterates over process environment block and looks immediately for dnsapi.dll name (xor 13) and its DnsQueryA function Basically, FIN7 implemented a shellcode that gets the next stage shellcode using the DNS messaging technique directly from memory This way they can successfully evade many of the behavior based solutions In the DNS query pattern, it is very clear to see that alphabetical modification of the subdomain prefix is used:  Each such DNS query results in an additional snippet of shellcode being appended to a reallocated buffer (It takes a few minutes for the DNS queries to finish This prefix indicates it may be a dll, and its deletion helps the attack to evade memory scanning solutions Just before this step executed, we extracted the dll from memory and uploaded it to VirusTotal If this dll was saved on disk, many security solutions would immediately identify it as a CobaltStrike Meterpreter, which is used by many attackers and pen testers CONCLUSIONS: FIN7 constantly upgrades their attacks and evasion techniques, thus becoming even more dangerous and unpredictable The analysis of this attack shows, how easy it is for them to bypass static, dynamic and behavior based solutions These attacks pose a severe risk to enterprises Fileless attacks are on the rise – Carbon Black reports that researchers found a 33% rise in severe non-malware attacks in Q4 2016 compared to Q1 Defenders will see more attacks on their businesses by hacker groups utilizing memory for evasion while keeping executable artifacts far away from disk In this continuously evolving threat landscape, enterprises need to look for new defenses that are resilient to such changes and are able to prevent fileless attacks Morphisec Endpoint Threat Prevention specializes in preventing in-memory attacks, using Moving Target Defense to make the target itself unpredictable
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content INTRODUCTION On June 7, 2017, Morphisec Lab identified a new, highly sophisticated fileless attack targeting restaurants across the US The ongoing campaign allows hackers to seize system control and install a backdoor to steal financial information at will It incorporates some never before seen evasive techniques that allow it to bypass most security solutions – signature and behavior based Aside from these updated techniques, Morphisec’s investigation revealed an almost perfect match to FIN7 attack methods Past highly successful and damaging attacks on banks, SEC personnel, large restaurant chains and hospitality organizations have all been attributed to the financially-motivated FIN7 group FIN7, which is also associated with the Carbanak gang, must be seen as one of the leading threat actor groups operating today The Word document executes a fileless attack that uses DNS queries to deliver the next shellcode stage (Meterpreter) OpenDNS investigate data, shared in coordination with the Cisco Advanced Threat Research & Efficacy Team, shows that this is a large-scale, currently active attack with peaks of more than 10K DNS requests per hour This means the attackers successfully bypass static analysis by most of the security solutions By contrast, Morphisec’s Moving Target Defense-based technology prevents the attack in its early stages, before any channel to the attacker is opened TECHNICAL ANALYSIS Below we describe the full technical details, beginning with the initial email through the final Meterpreter session used to hijack the computer PHISHING EMAIL: As seen in the email below, FIN7’s attack campaign targets restaurants The content of the email is well crafted to avoid suspicion Some of the email attachments are called menu.rtf, others Olive Garden.rtf or Chick Fil A Order.rtf (all the identified hashes are listed at the end) WORD DELIVERY: The attached .rtf file uses OLE and has many similarities to previous FIN7 attacks But this attack, instead of activating hta files (mshta.exe) from within the link, executes obfuscated JavaScript code All the victim needs to do is double click on the envelope and press OK PERSISTENCY: In some cases, an additional scheduled task “AdobeFlashSync” is created for persistency Afterwards, it deletes its own JavaScript code traces The shellcode is the primary differentiating technique between this campaign and past attacks by FIN7 and other threat actors This shellcode iterates over process environment block and looks immediately for dnsapi.dll name (xor 13) and its DnsQueryA function Basically, FIN7 implemented a shellcode that gets the next stage shellcode using the DNS messaging technique directly from memory This way they can successfully evade many of the behavior based solutions In the DNS query pattern, it is very clear to see that alphabetical modification of the subdomain prefix is used:  Each such DNS query results in an additional snippet of shellcode being appended to a reallocated buffer (It takes a few minutes for the DNS queries to finish This prefix indicates it may be a dll, and its deletion helps the attack to evade memory scanning solutions Just before this step executed, we extracted the dll from memory and uploaded it to VirusTotal If this dll was saved on disk, many security solutions would immediately identify it as a CobaltStrike Meterpreter, which is used by many attackers and pen testers CONCLUSIONS: FIN7 constantly upgrades their attacks and evasion techniques, thus becoming even more dangerous and unpredictable The analysis of this attack shows, how easy it is for them to bypass static, dynamic and behavior based solutions These attacks pose a severe risk to enterprises Fileless attacks are on the rise – Carbon Black reports that researchers found a 33% rise in severe non-malware attacks in Q4 2016 compared to Q1 Defenders will see more attacks on their businesses by hacker groups utilizing memory for evasion while keeping executable artifacts far away from disk In this continuously evolving threat landscape, enterprises need to look for new defenses that are resilient to such changes and are able to prevent fileless attacks Morphisec Endpoint Threat Prevention specializes in preventing in-memory attacks, using Moving Target Defense to make the target itself unpredictable ### Response: .