Larva-26009 Uses Remote-Access Tools and SoftEther VPN in MS-SQL Server Attacks
Summary
AhnLab details attacks on MS-SQL servers attributed to Larva-26009, involving web shells, credential-theft tools, remote access and backdoors, XMRig mining, and SoftEther VPN infrastructure.
Key points
- The initial intrusion method is unknown; attackers used MS-SQL command execution to download and install additional payloads.
- On systems with IIS, attackers installed an ASPX web shell, and they also used a PowerShell web shell for remote control.
- Tools and techniques included registry dumping for credential theft, browser-data theft, privilege-escalation utilities, internal network scanning, and in-memory shellcode execution.
- Attackers used GotoHTTP, VShell, Chrome Remote Desktop, Cloudflared, and backdoor accounts to maintain control or expose systems.
- An observed attack installed XMRig, delivered through a shellcode loader.
- Attackers installed SoftEther VPN using a cascade connection to another VPN server, which AhnLab says may help obscure the actual command-and-control server.
- AhnLab recommends strong, periodically changed MS-SQL passwords, updated security software, and firewall access controls for publicly accessible database servers.
Article Details
- Attack Vectors
- The actor exploited an MS-SQL server to execute commands and download additional payloads; the initial intrusion method is unknown.
- A web shell was installed on systems with an IIS web server to maintain persistence and control.
- The actor used PowerShell and other command execution to download and execute payloads, including shellcode loaders and encrypted files.
- The actor added backdoor accounts for potential remote control over RDP.
- Cloudflared was used in some cases to expose local ports externally, with the generated access URL sent to a C2 server.
- The actor used remote-control tools, VShell, and SoftEther VPN configured to cascade to another VPN server.
- XMRig was installed to mine cryptocurrency.
- Defensive Notes
- Use difficult-to-guess passwords for database servers and change them periodically to reduce brute-force and dictionary-attack risk.
- Keep V3 updated to the latest version to help block malware infections.
- Use firewalls or other security products to control access to database servers exposed to the internet.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | microsftapiedge[.]com | Domain listed in the article's threat-indicator section. |
| DOMAIN | update[.]microsftapiedge[.]com | FQDN listed in the article's threat-indicator section. |
| IPV4 | 159[.]223[.]46[.]140 | IP address listed in the article's threat-indicator section. |
| IPV4 | 38[.]60[.]253[.]35 | IP address listed in the article's threat-indicator section. |
| MD5 | 03bbee2c93c8b78bba321396a92bf026 | MD5 indicator listed in the article's threat-indicator section. |
| MD5 | 0429b9f291f570db0945282aa77c2d98 | MD5 indicator listed in the article's threat-indicator section. |
| MD5 | 056ffa80af31d17e0cee037b44e0c7ef | MD5 indicator listed in the article's threat-indicator section. |
| MD5 | 0eb0f57afd54c9733c720fbac82b754b | MD5 indicator listed in the article's threat-indicator section. |
| MD5 | 0ebab847d4e21bb7a3c22c291be0ac3a | MD5 indicator listed in the article's threat-indicator section. |
| URL | hxxp[:]//pub-c4c8e8c336c3429d97195076bf3bb6eb[.]r2[.]dev/009/qd_c_joke1[.]2[.]Ps1 | Threat-actor download URL for a script associated with the SoftEther VPN configuration. |
| URL | hxxp[:]//pub-c4c8e8c336c3429d97195076bf3bb6eb[.]r2[.]dev/goto/gojoke[.]Png | Payload URL used to download an encrypted file that the loader decrypts and executes. |
| URL | hxxp[:]//pub-c4c8e8c336c3429d97195076bf3bb6eb[.]r2[.]dev/wk/009/xmr-1[.]Zip | Payload URL used to download the archive containing the XMRig loader and payload. |
| URL | hxxps[:]//ams-pub-dev[.]s3[.]dualstack[.]eu-west-1[.]amazonaws[.]com/test/hub/update[.]zip | Specific cloud-hosted URL listed as a threat indicator. |
| URL | hxxps[:]//imagefiles-backup[.]oss-ap-southeast-7[.]aliyuncs[.]com/apaches[.]aspx | Specific cloud-hosted web shell URL listed as a threat indicator. |
| URL | hxxps[:]//imagefiles-backup[.]oss-ap-southeast-7[.]aliyuncs[.]com/batt[.]exe | Specific cloud-hosted executable URL listed as a threat indicator. |
| URL | hxxps[:]//imagefiles-backup[.]oss-ap-southeast-7[.]aliyuncs[.]com/browser[.]exe | Specific cloud-hosted executable URL listed as a threat indicator. |
| URL | hxxps[:]//imagefiles-backup[.]oss-ap-southeast-7[.]aliyuncs[.]com/GotoHTTP_x64[.]exe | Specific cloud-hosted GotoHTTP executable URL listed as a threat indicator. |
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe article says the newly added accounts could provide remote control through RDP.T1059.001 · PowerShellPowerShell was used to download files and run commands, including commands that exposed local ports.T1059.003 · Windows Command ShellThe actor executed Windows command-line commands, including network queries and commands launching privilege-escalation tools.T1090.001 · Internal ProxyCloudflared was used to expose local ports to the outside, and the generated access URL was sent to a C2 server.T1105 · Ingress Tool TransferCommands downloaded payloads and tools from the actor's download infrastructure.T1136.001 · Local AccountA batch script added local accounts named MSSQLSERVERS$, mssql$, and adminweb1$.T1190 · Exploit Public-Facing ApplicationThe actor exploited an MS-SQL server to execute commands; the article does not identify the initial intrusion method.T1496 · Resource HijackingXMRig was installed and executed as a coin miner.T1505.003 · Web ShellWeb shells, including ASPX and PowerShell variants, were installed for persistence and system control.
Threat Actors
Malware
Sharp4WebCmdThe first type is an ASPX web shell named Sharp4WebCmd that supports command execution, while the second type is Suo5, which supports tunneling functionality.Suo5The first type is an ASPX web shell named Sharp4WebCmd that supports command execution, while the second type is Suo5, which supports tunneling functionality.Vshellcommon in attack cases targeting MS-SQL servers, in this particular attack case, the attacker installed VShell and GotoHTTP to gain control over the infected system and also installed SoftEther to use it as a VPNXMRigWhile monitoring attack cases targeting MS-SQL servers, the AhnLab SEcurity intelligence Center (ASEC) identified an instance in which the Larva-26009 threat actor installed the XMRig CoinMiner.
Products
Chrome Remote DesktopChrome Remote DesktopIIS2. Web Shell Installation (IIS Web Server)MS-SQLCase Study: Targeted Attack Case on an MS-SQL Server Involving the Installation of GotoHTTP and SoftEther VPNSoftEtherCase Study: Targeted Attack Case on an MS-SQL Server Involving the Installation of GotoHTTP and SoftEther VPN
Tools
BadPotatoThreat actors are using various privilege escalation tools, such as JuicyPotatoNG, SigmaPotato, BadPotato, and RustPotato.CloudflaredIn some attack cases, Cloudflared was used to expose local ports to the outside.fscanThe Fscan tool has also been uploaded to the download server; it appears that threat actors can use it to scan internal networks as needed to identify Attack Targets for lateral movement.GOSTAdditionally, Mimikatz, the Fscan scanner, the gost proxy, and the user account creation tool can be used as plugins.GotoHTTPCase Study: Targeted Attack Case on an MS-SQL Server Involving the Installation of GotoHTTP and SoftEther VPNHackBrowserDataThe download server contained HackBrowserData, an open-source tool designed for information theft, which includes stealing credentials, history, and cookies stored in web browsers.JuicyPotatoNGThreat actors are using various privilege escalation tools, such as JuicyPotatoNG, SigmaPotato, BadPotato, and RustPotato.MimikatzAdditionally, Mimikatz, the Fscan scanner, the gost proxy, and the user account creation tool can be used as plugins.RasManPotato> RasManPotato.Exe -c “cmd /c ipconfig”RingQShellcode, RingQRustPotatoThreat actors are using various privilege escalation tools, such as JuicyPotatoNG, SigmaPotato, BadPotato, and RustPotato.SigmaPotatoThreat actors are using various privilege escalation tools, such as JuicyPotatoNG, SigmaPotato, BadPotato, and RustPotato.