Investigating the DPRK’s strategic use of Python and carefully crafted social engineering, this publication sheds light on how they breach highly secure networks with evolving and effective cyber attacks.

Preamble

Key takeaways

RookeryCapital_PythonTest.zip 

PasswordManager.py

Pyperclip module

__init__.py

Obfuscated Python Script

__inity__.py

Campaign intersections

Detection, Hunting and Mitigation Strategies 

[Detection] Python Subprocess Shell Tempfile Execution and Remote Network Connection

[Hunt] Python Executable File Creation in Temporary Directory

[Hunt] Interactive Shell Execution via Python

[Hunt] Suspicious Python Child Process Execution

Conclusion and Future Trends

Resources

Code of Conduct: DPRK’s Python-fueled intrusions into secured networks

This research looks at a recently found macOS malware campaign using the macOS Endpoint Security Framework paired with the Elastic Agent to hunt and detect the behaviors this malware exhibits.

UltraEdit

.test

.fseventsd

Summary

References

Sinking macOS Pirate Ships with Elastic Behavior Detections

Elastic Security Labs exposes an attempt by the DPRK to infect blockchain engineers with novel macOS malware.

Execution flow

Stage 0 Initial compromise: Watcher.py

Stage 1 droppers testSpeed.py and FinderTools

Stage 2 payload .sld and .log: SUGARLOADER

Obfuscation

Execution

Stage 3 loader Discord: HLOADER

Persistence

Stage 4 Payload: KANDYKORN

Command and control

Command 0xD1

Command 0xD2

Command 0xD3

Command 0xD4

Command 0xD5

Command 0xD6

Command 0xD7

Command 0xD8

Command 0xD9

Command 0xDA

Command 0xDB

Command 0xDC

Command 0xDD

Command 0xDE

Command 0xDF

Command 0xE0

Network protocol

Network infrastructure

tp-globa[.]xyz

23.254.226[.]90

The Diamond Model

[Malware] and MITRE ATT&CK

Tactics

Techniques

Malware prevention capabilities

Malware detection capabilities

Hunting queries

EQL queries

YARA

Observations

Elastic catches DPRK passing out KANDYKORN

Watch out! We’ve recently discovered a variant of RUSTBUCKET. Read this article to understand the new capabilities we’ve observed, as well as how to identify it in your own network.

RUSTBUCKET code analysis

Overview

Stage 1

Stage 2

Stage 3

Command ID 0x31

Command ID 0x30

The undetected version of RUSTBUCKET

RUSTBUCKET and REF9135 analysis

Networking infrastructure

Defense evasion

Victimology

Observed adversary tactics and techniques

Diamond model

Detection logic

Prevention

A DPRK campaign using a new variant of the RUSTBUCKET malware is underway with updated capabilities and reduced signature detection.

The DPRK strikes using a new variant of RUSTBUCKET

Explore JOKERSPY, a recently discovered campaign that targets financial institutions with Python backdoors. This article covers reconnaissance, attack patterns, and methods of identifying JOKERSPY in your network.

Analysis

The xcc binary

XCode artifacts

Abusing TCC

Initial access

Deployed cryptographic libraries

The sh.py backdoor

Swiftbelt

Diamond Model

Observed tactics and techniques

MITRE ATT&CK Tactics

MITRE ATT&CK Techniques / Sub techniques

An overview of JOKERSPY, discovered in June 2023, which deployed custom and open source macOS tools to exploit a cryptocurrency exchange located in Japan.

Initial research exposing JOKERSPY

The Elastic Container Project provides a single shell script that will allow you to stand up and manage an entire Elastic Stack using Docker. This open source project enables rapid deployment for testing use cases.

The Elastic Stack

Elasticsearch

Kibana

The Elastic Agent

The Elastic Container Project

Introduction

Prerequisites

macOS

Linux

Cloning the project repository

Setting credentials

The shell script

Stage

Start

Stop

Destroy

Restart

Restarting all Elastic Stack components.

Name Command State Ports

Status

Clear

Help

Getting Started

Updating variables

Starting the Elastic Stack

Accessing the Elastic Stack

Enabling the Platinum Features

Creating a Fleet policy

Enabling Elastic’s Prebuilt Detection Rules

Enrolling an Elastic Agent

Test fire some malware

Using Docker to stand up the Elastic Stack

The Elastic Container Project for Security Research

Elastic Security is releasing detection logic for the Dirty Pipe exploit.

What is Dirty Pipe (CVE-2022-0847)?

What is the impact?

What is Elastic doing about it?

Dirty Pipe Details

Linux Pipes & CVE-2022-0847

Proof Of Concept Code

Finding systems vulnerable to Dirty Pipe

Using the Elastic Security Integration

Using the Osquery Manager Integration

Detecting CVE-2022-0847 exploitation using Auditd

Auditd rules

Linux Auditing System event collection with Elastic

The Elastic Agent w/Auditd Integration

Auditbeat

Define audit rules here

Create file watches (-w) or syscall audits (-a or -A). Uncomment these

examples or add your own rules

Filebeat

Detecting Dirty Pipe with Elastic

Hunt queries in Kibana

Detection Engine alerts

Respond to Observed Threats

Defense in Depth Recommendations

Detecting and responding to Dirty Pipe with Elastic

In this research piece, we explore BPFDoor — a backdoor payload specifically crafted for Linux in order to gain re-entry into a previously or actively compromised target environment.

作者

Colson Wilhoit

文章

行为准则：朝鲜利用 Python 入侵安全网络

使用 Elastic 行为检测击沉 macOS 海盗船

Elastic 捕获朝鲜散播 KANDYKORN

朝鲜使用新变体的 RUSTBUCKET 发起攻击

揭露 JOKERSPY 的初步研究

用于安全研究的 Elastic 容器项目

使用 Elastic 检测和响应 Dirty Pipe

BPFDoor 背后的窥视