Article Content February 4, 2019	  Check Point Research has discovered a new campaign exploiting Linux servers to implant a new Backdoor Trojan The attack targets worldwide servers including AWS hosted machines Check Point researchers have spotted a new campaign exploiting Linux servers to implant a new Backdoor which evades all security vendors The new Trojan, named “SpeakUp” after one of its command and control names, exploits known vulnerabilities in six different Linux distributions The attack is gaining momentum and targeting servers in East Asia and Latin America, including AWS hosted machines SpeakUp acts to propagate internally within the infected subnet, and beyond to new IP ranges, exploiting remote code execution vulnerabilities In addition, SpeakUp presented ability to infect Mac devices with the undetected backdoor While the exact identity of the threat actor behind this new attack is still unconfirmed, Check Point Researchers were able to correlate SpeakUp’s author with malware developer under the name of Zettabit Although SpeakUp is implemented differently, it has a lot in common with Zettabit’s craftmanship Backdoor The sample we analyzed was observed targeting a machine in China on January 14, 2019 and was first submitted to VirusTotal on January 9 2019 At the time of writing this article, it has no detections in VT To our dismay, the C&C communication was also encoded with the same combination The revealed data contains multiple C&C domains, IP addresses and other unique parameters, along with second-stage payloads and additional modules In the below analysis we will go through the malicious code, reveal the different functions and modules the Trojan runs on the victim’s machine The first POST packet sends a victim ID and more introductory information such as the current version of the installed script (Currently 1.0.4) The immediate first C&C response is “needrgr” which means the infected victim is new to the server and needs a registration Afterwards, the Trojan posts “full information” about the machine by executing the following LINUX commands:  Uname (-r, -v, -m, -n,-a, -s) Whoami Ifconfig –a Arp –a cat /proc/cpuinfo | grep -c “cpu family” 2>&1 who –b   Figure 4: The registration process and introductory commands SpeakUp’s Main Functions After the registration process is completed, SpeakUp continuously communicates with its C&C for new tasks on a fixed “knock” interval The following command types are available by the C&C: “newtask”- Execute arbitrary code on the local machine, download and execute a file from any remote server, kill or uninstall the program and sends updated fingerprint data “notask”- Sleep for 3 seconds and ask for additional command newerconfig”- Update the downloaded miner configuration file SpeakUp’s persistence is ensured by using cron and an internal mutex to ensure only one instance remains alive at all times Post-Infection Traffic Once the victim is registered successfully, the C&C begins sending new tasks An interesting point to mention is the User-Agents in use SpeakUp defines three User-Agents that the infected machine must use in every communication with its C&C According to XMRHunter the wallets hold a total of ~107 Monero coins Propagation SpeakUp also equips its backdoors with i (sic), a python script which allows the backdoor to scan and infect more Linux servers within its internal and external subnets A successful exploitation of one of the vulnerabilities will result in deploying the original ibus script on the exploited server Attacker Identity and Leads Ibus client for Unix OS Inside the ibus script, we can see a short description about an IBus client for GNU Emacs The IBus client is an open-source multilingual input framework for Linux and Unix OS While it supports all languages that do not use Latin letters, it seems that the main audience is Asian users The description and the file name are the only elements that link SpeakUp to the Ibus framework; the content has no similarities whatsoever This may imply a connection between SpeakUp to East Asia Interestingly enough, the string turned out to be the md5 hash of the word liteHTTP Googling liteHTTP leads to the liteHTTP github project While liteHTTP is a C# based bot which targets Windows clients, its modules are somewhat similar to our SpeakUp Trojan Figure 7: Zettabit`s user description on Hack Forums The Hack Forums profile may imply the author of SpeakUp backdoor is Russian speaking, as many of the comments are written in this language He also seems to be a botnet developer, providing recommendations and publishing his LiteHTTP bot, which seems to have a well-designed GUI interface Another interesting thing to note is the use of the acronym “Knock” on several occasions in his posts It is hard to imagine anyone would build such a compound array of payloads just to deploy few miners The threat actor behind this campaign can at any given time deploy additional payloads, potentially more intrusive and offensive It has the ability to scan the surrounding network of an infected server and distribute the malware This campaign, while still relatively new, can evolve into something bigger and potentially more harmful Indeed, the threat actor behind this campaign, ‘Zettabithf’ himself, provides some ‘words of wisdom’ in this respect:  CloudGuard IaaS is an advanced threat prevention technology that protects against on your cloud infrastructure, including new Trojans like ‘SpeakUp’
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content February 4, 2019	  Check Point Research has discovered a new campaign exploiting Linux servers to implant a new Backdoor Trojan The attack targets worldwide servers including AWS hosted machines Check Point researchers have spotted a new campaign exploiting Linux servers to implant a new Backdoor which evades all security vendors The new Trojan, named “SpeakUp” after one of its command and control names, exploits known vulnerabilities in six different Linux distributions The attack is gaining momentum and targeting servers in East Asia and Latin America, including AWS hosted machines SpeakUp acts to propagate internally within the infected subnet, and beyond to new IP ranges, exploiting remote code execution vulnerabilities In addition, SpeakUp presented ability to infect Mac devices with the undetected backdoor While the exact identity of the threat actor behind this new attack is still unconfirmed, Check Point Researchers were able to correlate SpeakUp’s author with malware developer under the name of Zettabit Although SpeakUp is implemented differently, it has a lot in common with Zettabit’s craftmanship Backdoor The sample we analyzed was observed targeting a machine in China on January 14, 2019 and was first submitted to VirusTotal on January 9 2019 At the time of writing this article, it has no detections in VT To our dismay, the C&C communication was also encoded with the same combination The revealed data contains multiple C&C domains, IP addresses and other unique parameters, along with second-stage payloads and additional modules In the below analysis we will go through the malicious code, reveal the different functions and modules the Trojan runs on the victim’s machine The first POST packet sends a victim ID and more introductory information such as the current version of the installed script (Currently 1.0.4) The immediate first C&C response is “needrgr” which means the infected victim is new to the server and needs a registration Afterwards, the Trojan posts “full information” about the machine by executing the following LINUX commands:  Uname (-r, -v, -m, -n,-a, -s) Whoami Ifconfig –a Arp –a cat /proc/cpuinfo | grep -c “cpu family” 2>&1 who –b   Figure 4: The registration process and introductory commands SpeakUp’s Main Functions After the registration process is completed, SpeakUp continuously communicates with its C&C for new tasks on a fixed “knock” interval The following command types are available by the C&C: “newtask”- Execute arbitrary code on the local machine, download and execute a file from any remote server, kill or uninstall the program and sends updated fingerprint data “notask”- Sleep for 3 seconds and ask for additional command newerconfig”- Update the downloaded miner configuration file SpeakUp’s persistence is ensured by using cron and an internal mutex to ensure only one instance remains alive at all times Post-Infection Traffic Once the victim is registered successfully, the C&C begins sending new tasks An interesting point to mention is the User-Agents in use SpeakUp defines three User-Agents that the infected machine must use in every communication with its C&C According to XMRHunter the wallets hold a total of ~107 Monero coins Propagation SpeakUp also equips its backdoors with i (sic), a python script which allows the backdoor to scan and infect more Linux servers within its internal and external subnets A successful exploitation of one of the vulnerabilities will result in deploying the original ibus script on the exploited server Attacker Identity and Leads Ibus client for Unix OS Inside the ibus script, we can see a short description about an IBus client for GNU Emacs The IBus client is an open-source multilingual input framework for Linux and Unix OS While it supports all languages that do not use Latin letters, it seems that the main audience is Asian users The description and the file name are the only elements that link SpeakUp to the Ibus framework; the content has no similarities whatsoever This may imply a connection between SpeakUp to East Asia Interestingly enough, the string turned out to be the md5 hash of the word liteHTTP Googling liteHTTP leads to the liteHTTP github project While liteHTTP is a C# based bot which targets Windows clients, its modules are somewhat similar to our SpeakUp Trojan Figure 7: Zettabit`s user description on Hack Forums The Hack Forums profile may imply the author of SpeakUp backdoor is Russian speaking, as many of the comments are written in this language He also seems to be a botnet developer, providing recommendations and publishing his LiteHTTP bot, which seems to have a well-designed GUI interface Another interesting thing to note is the use of the acronym “Knock” on several occasions in his posts It is hard to imagine anyone would build such a compound array of payloads just to deploy few miners The threat actor behind this campaign can at any given time deploy additional payloads, potentially more intrusive and offensive It has the ability to scan the surrounding network of an infected server and distribute the malware This campaign, while still relatively new, can evolve into something bigger and potentially more harmful Indeed, the threat actor behind this campaign, ‘Zettabithf’ himself, provides some ‘words of wisdom’ in this respect:  CloudGuard IaaS is an advanced threat prevention technology that protects against on your cloud infrastructure, including new Trojans like ‘SpeakUp’ ### Response: .