Article Content The BlackEnergy malware is crimeware turned APT tool and is used in significant geopolitical operations lightly documented over the past year An even more interesting part of the BlackEnergy story is the relatively unknown custom plugin capabilities to attack ARM and MIPS platforms, scripts for Cisco network devices, destructive plugins, a certificate stealer and more Here, we present available data – it is difficult to collect on this APT. We will also present more details on targets previously unavailable and present related victim profile data These attackers are careful to hide and defend their long-term presence within compromised environments The malware’s previously undescribed breadth means attackers present new technical challenges in unusual environments, including SCADA networks Challenges, like mitigating the attackers’ lateral movement across compromised network routers, may take an organization’s defenders far beyond their standard routine and out of their comfort zone Brief History BlackEnergy2 and BlackEnergy3 are known tools Initially, cybercriminals used BlackEnergy custom plugins for launching DDoS attacks There are no indications of how many groups possess this tool Over time, BlackEnergy2 was assumed into the toolset of the BE2/Sandworm actor While another crimeware group continues to use BlackEnergy to launch DDoS attacks, the BE2 APT appears to have used this tool exclusively throughout 2014 at victim sites and included custom plugins and scripts of their own To be clear, our name for this actor has been the BE2 APT, while it has been called “Sandworm Team” also The Plugins and Config Files Before evidence of BlackEnergy2 use in targeted attacks was uncovered, we tracked strange activity on one of the BlackEnergy CnC servers in 2013 As described in Dmitry’s 2010 Black DDoS’ analysis, a configuration file is downloaded from the server by main.dll on an infected system It also instructs the loader to pass certain commands to the plugins This new module push must have been among the first for this group, because all of the module versions were listed as “version 1”, including the ddos plugin:  Config downloaded from BE2 server The ‘ps’ plugin turned out to be password stealer The ‘vsnet’ plugin was intended to spread and launch a payload (BlackEnergy2 dropper itself at the moment) in the local network by using PsExec, as well as gaining primary information on the user’s computer and network Most surprising was the ‘weap_hwi’ plugin It was a ddos tool compiled to run on ARM systems:  Weap_hwi plugin At first, we didn’t know whether the ARM plugin was listed intentionally or by mistake, so we proceeded to collect the CnC’s config files After pulling multiple config files, we confirmed that this ARM object inclusion was not a one-off mistake The server definitely delivered config files not only for Windows, but also for the ARM/MIPS platform Though unusual, the ARM module was delivered by the same server and it processed the same config file Linux plugins Over time we were able to collect several plugins as well as the main module for ARM and MIPS architectures All of these ARM/MIPS object files were compiled from the same source and later pushed out in one config: “weap_msl”, “weap_mps”, “nm_hwi”, “nm_mps”, “weap_hwi”, and “nm_msl” It’s interesting that the BE2 developers upgraded the ddos plugin to version 2, along with the nm_hwi, nm_mps, and nm_msl plugins They simultaneously released version 5 of the weap_msl, weap_mps, and weap_hmi plugins This structure obfuscation may be a rewrite effort to better modularize the code, but could also be intended to complicate analysis Regardless, it is likely that different individuals coded the different plugins So, the BE2 effort must have its own small team of plugin and multiplatform developers During an extended period, we were able to collect many Windows plugins from different CnC servers, without ever noticing Linux plugins being downloaded as described above It appears the BE2/SandWorm gang protected their servers by keeping their non-Windows hacker tools and plugins in separate servers or server folders Finally, each CnC server hosts a different set of plugins, meaning that each server works with different victims and uses plugins based on its current needs Here is the summary list of all known plugins at the moment:    fs searches for given file types, gets primary system and network information   ps password stealer from various sources   ss makes screenshots   vsnet spreads payload in the local network  (uses psexec, accesses admin shares), gets primary system and network information   rd remote desktop   scan scans ports of a given host   grc backup channel via plus.google.com   jn file infector (local, shares, removable devices) with the given payload downloaded from CnC   cert certificate stealer   sn logs traffic, extracts login-passwords from different protocol (HTTP, LDAP, FTP, POP3, IMAP, Telnet )   tv sets password hash in the registry for TeamViewer   prx Proxy server   dstr Destroys hard disk by overwriting with random data (on application level and driver level) at a certain time   kl keylogger   upd BE2 service file updater   usb gathers information on connected USBs  (Device instance ID,  drive geometry)   bios gathers information on BIOS, motherboard, processor,  OS    We are pretty sure that our list of BE2 tools is not complete For example, we have yet to obtain the router access plugin, but we are confident that it exists Our current collection represents the BE2 attackers’ capabilities quite well Some plugins remain mysterious and their purpose is not yet clear, like ‘usb’ and ‘bios’ Why would the attackers need information on usb and bios characteristics? It suggests that based on a specific USB and BIOS devices, the attackers may upload specific plugins to carry out additional actions Perhaps destructive, perhaps to further infect devices We don’t know yet It’s also interesting to point out another plugin – ‘grc’ In some of the BE2 configuration files, we can notice an value with a “gid” type:  The addr number in the config This number is an ID for the plus.google.com service and is used by the ‘grc’ plugin to parse html The decrypted PNG is supposed to contain a new config file, but we never observed one We are aware of two related GooglePlus IDs The first one, plus.google.com/115125387226417117030/, contains an abnormal number of views At the time of writing, the count is 75 million:  BE2 plus profile The second one – plus.google.com/116769597454024178039/posts – is currently more modest at a little over 5,000 views All of that account’s posts are deleted 188.128.123.52 belongs to the Russian Ministry of Defense and 212.175.109.10 belongs to the Turkish Ministry of Interior’s government site While many researchers suspect a Russian actor is behind BE2, judging by their tracked activities and the victim profiles, it’s still unclear whose interests they represent While observing some other CnCs and pulling down config files, we stumbled upon some strange mistakes and mis-typing They are highlighted in the image below:  BE2 config file mistakes First, these mistakes suggest that the BE2 attackers manually edit these config files Secondly, it shows that even skilled hackers make mistakes Hard-Coded Command and Control The contents of the config files themselves are fairly interesting They all contain a callback c2 with a hardcoded ip address, contain timeouts, and some contain the commands listed above BE2 Targets and Victims BlackEnergy2 victims are widely distributed geographically We identified BlackEnergy2 targets and victims in the following countries starting in late 2013 There are likely more victims Interesting BE2 incidents are presented here Victim #1 The BE2 attackers successfully spearphished an organization with an exploit for which there is no current CVE, and a metasploit module has been available This email message contained a ZIP archive with EXE file inside that did not appear to be an executable BE2 spearphish example The attached exe file turned out to be ‘BlackEnergy-like’ malware, which researchers already dubbed ‘BlackEnergy3’ – the gang uses it along with BlackEnergy2 Kaspersky Lab detects ‘BlackEnergy3’ malware as Backdoor.Win32.Fonten – naming it after its dropped file “FONTCACHE.DAT” When investigating computers in the company’s network, only BE2 associated files were found, suggesting BE3 was used as only a first-stage tool on this network After decrypting these files, we could retrieve plugins launched on infected machines: ps, vsnet, fs, ss, dstr By all appearances, the attackers pushed the ‘dstr’ module when they understood that they were revealed, and wanted to hide their presence on the machines Some machines already launched the plugin, lost their data and became unbootable Victim #2 The second organization was hacked via the first victim’s stolen VPN credentials After the second organization was notified about the infection they started an internal investigation They confirmed that some data was destroyed on their machines, so the BE2 attackers have exhibited some level of destructive activity And, they revealed that their Cisco routers with different IOS versions were hacked They weren’t able to connect to the routers any more by telnet and found the following “farewell” tcl scripts in the router’s file system: Ciscoapi.tcl – contains various wrappers over cisco EXEC-commands as described in the comments The comment includes a punchy message for “kasperRsky”:  BE2 ciscoapi.tcl fragment Killint.tcl – uses Ciscoapi.tcl, implements destroying functions:  BE2 killint.tcl fragment The script tries to download ciscoapi.tcl from a certain FTP server which served as a storage for BE2 files The BE2 actor performs careful, professional activity covering their tracks: ciscoapi.tcl killint.tcl telnetapi2.tcl telnetu.tcl stub.tcl stub1.tcl There is evidence that the logs produced by some scripts were also stored on the FTP server, in particular the information on CDP neighbors which is provided by one of the procedures of ciscoapi.tcl Victim #3 The third organization got compromised by the same type of attack as the first one (an EXE file spoofing a doc within a Zip archive) All the plugins discovered in BE2 files were known, and there was no revelation of hacked network devices on their side and no destroyed data The noticeable thing is that many computers contained both BE2 and BE3 files and some config files contained the following URL: hxxps://46.165.222(dot)28/upgrade/f3395cd54cf857ddf8f2056768ff49ae/getcfg.php The URL contains the md5 of the string ‘router’ Starting in March 2014 and ending in July 2014, Siemens “ccprojectmgr.exe” downloaded and executed a handful of different payloads hosted at 94.185.85.122/favicon.ico They are all detected as variants of “Backdoor.Win32.Blakken” Build IDs Each config file within BE2 main.dll has a field called build_id which identifies the malware version for the operators Currently this particular BE/SandWorm gang uses a certain pattern for the build ids containing three hex numbers and three letters, as follows: 0C0703hji The numbers indicate the date of file creation in the format: Year-Month-Day Still, the purpose of the letters is unknown, but most likely it indicates the targets. The hex numbers weren’t used all the time, sometimes we observed decimal numbers: 100914_mg 100929nrT Most interesting for us was the earliest build id we could find Currently it is “OB020Ad0V”, meaning that the BE2/SandWorm APT started operating as early as the beginning of 2010 Appendix: IoC Since BE dropper installs its driver under a randomly picked non-used Windows driver name, there is no a static name for a driver to use it as IOC The driver is self-signed on 64-bit systems However, new “APT” BE2 uses one of the following filenames that are used as an encrypted storage for plugins and the network settings
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content The BlackEnergy malware is crimeware turned APT tool and is used in significant geopolitical operations lightly documented over the past year An even more interesting part of the BlackEnergy story is the relatively unknown custom plugin capabilities to attack ARM and MIPS platforms, scripts for Cisco network devices, destructive plugins, a certificate stealer and more Here, we present available data – it is difficult to collect on this APT. We will also present more details on targets previously unavailable and present related victim profile data These attackers are careful to hide and defend their long-term presence within compromised environments The malware’s previously undescribed breadth means attackers present new technical challenges in unusual environments, including SCADA networks Challenges, like mitigating the attackers’ lateral movement across compromised network routers, may take an organization’s defenders far beyond their standard routine and out of their comfort zone Brief History BlackEnergy2 and BlackEnergy3 are known tools Initially, cybercriminals used BlackEnergy custom plugins for launching DDoS attacks There are no indications of how many groups possess this tool Over time, BlackEnergy2 was assumed into the toolset of the BE2/Sandworm actor While another crimeware group continues to use BlackEnergy to launch DDoS attacks, the BE2 APT appears to have used this tool exclusively throughout 2014 at victim sites and included custom plugins and scripts of their own To be clear, our name for this actor has been the BE2 APT, while it has been called “Sandworm Team” also The Plugins and Config Files Before evidence of BlackEnergy2 use in targeted attacks was uncovered, we tracked strange activity on one of the BlackEnergy CnC servers in 2013 As described in Dmitry’s 2010 Black DDoS’ analysis, a configuration file is downloaded from the server by main.dll on an infected system It also instructs the loader to pass certain commands to the plugins This new module push must have been among the first for this group, because all of the module versions were listed as “version 1”, including the ddos plugin:  Config downloaded from BE2 server The ‘ps’ plugin turned out to be password stealer The ‘vsnet’ plugin was intended to spread and launch a payload (BlackEnergy2 dropper itself at the moment) in the local network by using PsExec, as well as gaining primary information on the user’s computer and network Most surprising was the ‘weap_hwi’ plugin It was a ddos tool compiled to run on ARM systems:  Weap_hwi plugin At first, we didn’t know whether the ARM plugin was listed intentionally or by mistake, so we proceeded to collect the CnC’s config files After pulling multiple config files, we confirmed that this ARM object inclusion was not a one-off mistake The server definitely delivered config files not only for Windows, but also for the ARM/MIPS platform Though unusual, the ARM module was delivered by the same server and it processed the same config file Linux plugins Over time we were able to collect several plugins as well as the main module for ARM and MIPS architectures All of these ARM/MIPS object files were compiled from the same source and later pushed out in one config: “weap_msl”, “weap_mps”, “nm_hwi”, “nm_mps”, “weap_hwi”, and “nm_msl” It’s interesting that the BE2 developers upgraded the ddos plugin to version 2, along with the nm_hwi, nm_mps, and nm_msl plugins They simultaneously released version 5 of the weap_msl, weap_mps, and weap_hmi plugins This structure obfuscation may be a rewrite effort to better modularize the code, but could also be intended to complicate analysis Regardless, it is likely that different individuals coded the different plugins So, the BE2 effort must have its own small team of plugin and multiplatform developers During an extended period, we were able to collect many Windows plugins from different CnC servers, without ever noticing Linux plugins being downloaded as described above It appears the BE2/SandWorm gang protected their servers by keeping their non-Windows hacker tools and plugins in separate servers or server folders Finally, each CnC server hosts a different set of plugins, meaning that each server works with different victims and uses plugins based on its current needs Here is the summary list of all known plugins at the moment:    fs searches for given file types, gets primary system and network information   ps password stealer from various sources   ss makes screenshots   vsnet spreads payload in the local network  (uses psexec, accesses admin shares), gets primary system and network information   rd remote desktop   scan scans ports of a given host   grc backup channel via plus.google.com   jn file infector (local, shares, removable devices) with the given payload downloaded from CnC   cert certificate stealer   sn logs traffic, extracts login-passwords from different protocol (HTTP, LDAP, FTP, POP3, IMAP, Telnet )   tv sets password hash in the registry for TeamViewer   prx Proxy server   dstr Destroys hard disk by overwriting with random data (on application level and driver level) at a certain time   kl keylogger   upd BE2 service file updater   usb gathers information on connected USBs  (Device instance ID,  drive geometry)   bios gathers information on BIOS, motherboard, processor,  OS    We are pretty sure that our list of BE2 tools is not complete For example, we have yet to obtain the router access plugin, but we are confident that it exists Our current collection represents the BE2 attackers’ capabilities quite well Some plugins remain mysterious and their purpose is not yet clear, like ‘usb’ and ‘bios’ Why would the attackers need information on usb and bios characteristics? It suggests that based on a specific USB and BIOS devices, the attackers may upload specific plugins to carry out additional actions Perhaps destructive, perhaps to further infect devices We don’t know yet It’s also interesting to point out another plugin – ‘grc’ In some of the BE2 configuration files, we can notice an value with a “gid” type:  The addr number in the config This number is an ID for the plus.google.com service and is used by the ‘grc’ plugin to parse html The decrypted PNG is supposed to contain a new config file, but we never observed one We are aware of two related GooglePlus IDs The first one, plus.google.com/115125387226417117030/, contains an abnormal number of views At the time of writing, the count is 75 million:  BE2 plus profile The second one – plus.google.com/116769597454024178039/posts – is currently more modest at a little over 5,000 views All of that account’s posts are deleted 188.128.123.52 belongs to the Russian Ministry of Defense and 212.175.109.10 belongs to the Turkish Ministry of Interior’s government site While many researchers suspect a Russian actor is behind BE2, judging by their tracked activities and the victim profiles, it’s still unclear whose interests they represent While observing some other CnCs and pulling down config files, we stumbled upon some strange mistakes and mis-typing They are highlighted in the image below:  BE2 config file mistakes First, these mistakes suggest that the BE2 attackers manually edit these config files Secondly, it shows that even skilled hackers make mistakes Hard-Coded Command and Control The contents of the config files themselves are fairly interesting They all contain a callback c2 with a hardcoded ip address, contain timeouts, and some contain the commands listed above BE2 Targets and Victims BlackEnergy2 victims are widely distributed geographically We identified BlackEnergy2 targets and victims in the following countries starting in late 2013 There are likely more victims Interesting BE2 incidents are presented here Victim #1 The BE2 attackers successfully spearphished an organization with an exploit for which there is no current CVE, and a metasploit module has been available This email message contained a ZIP archive with EXE file inside that did not appear to be an executable BE2 spearphish example The attached exe file turned out to be ‘BlackEnergy-like’ malware, which researchers already dubbed ‘BlackEnergy3’ – the gang uses it along with BlackEnergy2 Kaspersky Lab detects ‘BlackEnergy3’ malware as Backdoor.Win32.Fonten – naming it after its dropped file “FONTCACHE.DAT” When investigating computers in the company’s network, only BE2 associated files were found, suggesting BE3 was used as only a first-stage tool on this network After decrypting these files, we could retrieve plugins launched on infected machines: ps, vsnet, fs, ss, dstr By all appearances, the attackers pushed the ‘dstr’ module when they understood that they were revealed, and wanted to hide their presence on the machines Some machines already launched the plugin, lost their data and became unbootable Victim #2 The second organization was hacked via the first victim’s stolen VPN credentials After the second organization was notified about the infection they started an internal investigation They confirmed that some data was destroyed on their machines, so the BE2 attackers have exhibited some level of destructive activity And, they revealed that their Cisco routers with different IOS versions were hacked They weren’t able to connect to the routers any more by telnet and found the following “farewell” tcl scripts in the router’s file system: Ciscoapi.tcl – contains various wrappers over cisco EXEC-commands as described in the comments The comment includes a punchy message for “kasperRsky”:  BE2 ciscoapi.tcl fragment Killint.tcl – uses Ciscoapi.tcl, implements destroying functions:  BE2 killint.tcl fragment The script tries to download ciscoapi.tcl from a certain FTP server which served as a storage for BE2 files The BE2 actor performs careful, professional activity covering their tracks: ciscoapi.tcl killint.tcl telnetapi2.tcl telnetu.tcl stub.tcl stub1.tcl There is evidence that the logs produced by some scripts were also stored on the FTP server, in particular the information on CDP neighbors which is provided by one of the procedures of ciscoapi.tcl Victim #3 The third organization got compromised by the same type of attack as the first one (an EXE file spoofing a doc within a Zip archive) All the plugins discovered in BE2 files were known, and there was no revelation of hacked network devices on their side and no destroyed data The noticeable thing is that many computers contained both BE2 and BE3 files and some config files contained the following URL: hxxps://46.165.222(dot)28/upgrade/f3395cd54cf857ddf8f2056768ff49ae/getcfg.php The URL contains the md5 of the string ‘router’ Starting in March 2014 and ending in July 2014, Siemens “ccprojectmgr.exe” downloaded and executed a handful of different payloads hosted at 94.185.85.122/favicon.ico They are all detected as variants of “Backdoor.Win32.Blakken” Build IDs Each config file within BE2 main.dll has a field called build_id which identifies the malware version for the operators Currently this particular BE/SandWorm gang uses a certain pattern for the build ids containing three hex numbers and three letters, as follows: 0C0703hji The numbers indicate the date of file creation in the format: Year-Month-Day Still, the purpose of the letters is unknown, but most likely it indicates the targets. The hex numbers weren’t used all the time, sometimes we observed decimal numbers: 100914_mg 100929nrT Most interesting for us was the earliest build id we could find Currently it is “OB020Ad0V”, meaning that the BE2/SandWorm APT started operating as early as the beginning of 2010 Appendix: IoC Since BE dropper installs its driver under a randomly picked non-used Windows driver name, there is no a static name for a driver to use it as IOC The driver is self-signed on 64-bit systems However, new “APT” BE2 uses one of the following filenames that are used as an encrypted storage for plugins and the network settings ### Response: .