A cybercriminal threat actor known as TA577 has been identified as employing a new attack strategy to steal NT LAN Manager (NTLM) authentication information.
This sophisticated activity is designed to gather sensitive information and facilitate subsequent malicious actions.
Technical Analysis
Proofpoint uncovered two distinct campaigns orchestrated by TA577 on February 26 and 27, 2024.
These campaigns involved tens of thousands of messages targeting numerous organizations worldwide.
The attackers utilized thread hijacking, where messages were disguised as replies to previous emails and contained zipped HTML attachments tailored for each recipient.
The malicious attachments, each with a unique file hash, triggered system connection attempts via HTML files to an external Server Message Block (SMB) server.
By capturing NTLMv2 Challenge/Response pairs from the SMB server, TA577 aimed to steal NTLM hashes for potential password cracking or “Pass-The-Hash” attacks within targeted organizations.
Using the open-source toolkit Impacket on the SMB servers indicated the attackers’ intent to exploit vulnerabilities and move laterally within compromised environments.
Proofpoint’s research highlighted the increasing trend of threat actors utilizing file scheme URIs to direct victims to external file shares for malware delivery.
Implications and Mitigation
Allowing connections to these compromised SMB servers posed risks of compromising NTLM hashes and exposing sensitive information like usernames and domain names.
Notably, the attackers delivered the malicious HTML within zip archives to evade detection by Outlook mail clients.
Disabling guest access to SMB did not prevent the attack, emphasizing the need for proactive security measures.
TA577, a well-known cybercrime threat actor previously associated with ransomware infections like Black Basta, has recently shifted towards using Pikabot as an initial payload.
This shift in tactics underscores the evolving nature of cyber threats and the importance of staying vigilant against emerging attack vectors.
Emerging Threats and Recommendations
Organizations are advised to block outbound SMB connections to mitigate risks associated with such attacks and stay abreast of emerging threat signatures.
TA577’s innovative tactics underscore the evolving landscape of cyber threats, necessitating continuous vigilance and proactive cybersecurity measures to safeguard against sophisticated attacks.
- 2044665 – ET INFO Outbound SMB NTLM Auth Attempt to External Address
- 2051116 – ET INFO Outbound SMB2 NTLM Auth Attempt to External Address
- 2051432 – ET INFO [ANY.RUN] Impacket Framework Default SMB Server GUID Detected
- 2051433 – ET INFO Impacket Framework Default SMB NTLMSSP Challenge
IOCs
| Indicator | Description |
| file://89[.]117[.]1[.]161/mtdi/ZQCw[.]txt | File Scheme URL Redirect Targets |
| file://89[.]117[.]2[.]33/hvwsuw/udrh[.]txt | File Scheme URL Redirect Targets |
| file://146[.]19[.]213[.]36/vei/yEZZ[.]txt | File Scheme URL Redirect Targets |
| file://176[.]123[.]2[.]146/vbcsn/UOx[.]txt | File Scheme URL Redirect Targets |
| file://89[.]117[.]1[.]160/4bvt1yw/iC[.]txt | File Scheme URL Redirect Targets |
| file://89[.]117[.]2[.]34/4qp/8Y[.]txt | File Scheme URL Redirect Targets |
| file://104[.]129[.]20[.]167/xhsmd/bOWEU[.]txt | File Scheme URL Redirect Targets |
| file://146[.]19[.]213[.]36/dbna/H[.]txt | File Scheme URL Redirect Targets |
| file://89[.]117[.]2[.]33/7ipw/7ohq[.]txt | File Scheme URL Redirect Targets |
| file://89[.]117[.]2[.]34/3m3sxh6/IuM[.]txt | File Scheme URL Redirect Targets |
| file://103[.]124[.]104[.]22/zjxb/bO[.]txt | File Scheme URL Redirect Targets |
| file://89[.]117[.]1[.]161/epxq/A[.]txt | File Scheme URL Redirect Targets |
| file://176[.]123[.]2[.]146/5aohv/9mn[.]txt | File Scheme URL Redirect Targets |
| file://66[.]63[.]188[.]19/bmkmsw/2[.]txt | File Scheme URL Redirect Targets |
| file://89[.]117[.]1[.]160/zkf2r4j/VmD[.]txt | File Scheme URL Redirect Targets |
| file://103[.]124[.]104[.]76/wsr6oh/Y[.]txt | File Scheme URL Redirect Targets |
| file://103[.]124[.]105[.]208/wha5uxh/D[.]txt | File Scheme URL Redirect Targets |
| file://103[.]124[.]105[.]233/yusx/dMA[.]txt | File Scheme URL Redirect Targets |
| file://103[.]124[.]106[.]224/uuny19/bb1nG[.]txt | File Scheme URL Redirect Targets |
| file://85[.]239[.]33[.]149/naams/p3aV[.]txt | File Scheme URL Redirect Targets |
| file://155[.]94[.]208[.]137/tgnd/zH9[.]txt | File Scheme URL Redirect Targets |
You can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits, with Perimeter81 malware protection. All are incredibly harmful, can wreak havoc, and damage your network.
Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.