EHA
Home Cyber Attack ToneShell: The Backdoor Exploiting RDP Certificates to Target VIPs

ToneShell: The Backdoor Exploiting RDP Certificates to Target VIPs

0

The ToneShell backdoor, a cyber espionage tool associated with the Mustang Panda threat group, has been used to target attendees of the 2024 IISS Defense Summit in Prague, which highlights the intersection of cyber espionage and international strategy as nations seek to gather sensitive security and defense information. 

The IISS Prague Defence Summit, a new event focused on defense and security in the Euro-Atlantic region, is a potential target for cyber espionage. 

With attendees including senior political leaders and defense officials, the summit offers adversaries a valuable opportunity to gain insights into sensitive military strategies, defense cooperation, and responses to geopolitical tensions. 

Cyberattacks could compromise the confidentiality of discussions, potentially providing adversaries with a strategic advantage.

Hatching Triage Sandbox Analysis of suspicious EXE

Analysts discovered a suspicious executable, “IISS PRAGUE DEFENCE SUMMIT (8–10 November 2024 ).exe,” during triage on Hatching Triage, whose relevance to a high-profile event raised concerns, prompting further investigation. 

Analysis of the PCAP revealed network traffic communication with a C2 server using the magic bytes “17 03 03,” a known indicator of Toneshell and PubLoad malware activity. Additionally, the same executable exhibited similar behavior on ANY.RUN, solidifying suspicions of malicious intent. 

Document posing as an agenda for the upcoming IISS Defence Summit

The archive used in this attack employs social engineering tactics through a decoy PDF. Upon extraction, the archive presents two folders: one containing the malicious executable and another containing a seemingly legitimate PDF titled “Annex 2 – IISS PRAGUE DEFENCE SUMMIT… – Copy.pdf.” 

This PDF is an exact replica of a genuine document found on the IISS website, with the only difference being its filename, which aims to build trust in the target by presenting a familiar and relevant document, lowering suspicion and allowing the malware to run undetected in the background. 

Debug strings for X user Rainmaker1973

An attacker sent a ZIP file containing a decoy PDF and a malicious PIF file disguised as an agenda document that dropped SFFWallpaperCore.exe and libemb.dll and used a scheduled task to run SFFWallpaperCore.exe every 6 minutes. 

SFFWallpaperCore.exe likely sideloaded libemb.dll, a Mustang Panda C++ DLL containing references to Twitter accounts and communicating with the C2 server at 103.27.108.14 on port 443 using raw TCP disguised as TLS. 

 Results of the search for servers hosting RDP certificates bearing the same not-before date

APT group Mustang Panda is using self-signed RDP certificates to hide their C2 server, which is hosted on Topway Global Limited’s ASN in Hong Kong. The RDP certificate was issued on August 25, 2021, and only lasted for a short period of time. 

Hunt’s Advanced Search identified other servers using the same certificate; all except one are on the same ASN as the C2 server, which suggests that these servers are likely controlled by the same threat actor and are used for maintaining operational control and flexibility.

Also Read:

NO COMMENTS

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Exit mobile version