Larva-26002 Uses ICE Cloud Scanner Against Exposed MS-SQL Servers
Summary
AhnLab reports that Larva-26002 targets exposed MS-SQL servers with weak credentials and deploys the Go-based ICE Cloud Client, which receives scan targets and credentials from C2 and reports successful logins.
Key points
- Larva-26002 targets internet-exposed MS-SQL servers with weak account credentials using brute-force and dictionary attacks.
- The actor uses MS-SQL’s BCP utility to export a stored malware binary to disk; alternatives include downloading a component with curl, Bitsadmin, or PowerShell.
- The downloader installs ICE Cloud Launcher and the Go-based ICE Cloud Client scanner.
- After authenticating to C2, ICE Cloud Client receives MS-SQL targets and credentials, attempts logins, and reports successful results.
- AhnLab says earlier Larva-26002 activity involved Trigona and Mimic ransomware, as well as remote-access tools including AnyDesk and Teramind.
- AhnLab recommends strong database passwords and restricting internet access to exposed database servers with firewalls.
Article Details
- Attack Vectors
- Larva-26002 targets internet-exposed, improperly managed MS-SQL servers using brute-force and dictionary attacks against weak account credentials.
- The actor uses the MS-SQL BCP utility to export a malware binary stored in a database table to a local file.
- Where BCP is not used, curl, bitsadmin, or PowerShell downloads api.exe, which installs the ICE Cloud components.
- ICE Cloud Client receives MS-SQL target addresses and credentials from its C2, attempts logins, and reports successful authentications back to the C2.
- Defensive Notes
- Use hard-to-guess passwords for database accounts and change them regularly.
- Restrict external access to internet-exposed database servers using firewalls or other security solutions.
- Keep V3 updated to help prevent malware infection.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 0a9f2e2ff98e9f19428da79680e80b77 | MD5 hash listed for a malware sample in the report. |
| MD5 | 28847cb6859b8239f59cbf2b8f194770 | MD5 hash listed for a malware sample in the report. |
| MD5 | 5200410ec674184707b731b697154522 | MD5 hash listed for a malware sample in the report. |
| MD5 | 7fbbf16256c7c89d952fee47b70ea759 | MD5 hash listed for a malware sample in the report. |
| MD5 | 89bf428b2d9214a66e2ea78623e8b5c9 | MD5 hash listed for a malware sample in the report. |
| URL | hxxp[:]//109[.]205[.]211[.]13/api[.]exe | Downloader URL used to deliver api.exe and the ICE Cloud components. |
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe report says the actor used a port forwarder to allow RDP connections during earlier activity.T1046 · Network Service DiscoveryICE Cloud Client scans MS-SQL targets supplied by its C2 and attempts authentication against them.T1059.001 · PowerShellPowerShell is used as an alternative method to download the scanner malware.T1071.001 · Web ProtocolsThe report describes web-protocol exchanges for ICE Cloud Launcher authentication, scanner download requests, and reporting scan results to the C2.T1105 · Ingress Tool TransferThe actor downloads api.exe from a remote URL using curl or bitsadmin.T1110 · Brute ForceLarva-26002 uses brute-force and dictionary attacks against exposed MS-SQL accounts.T1219 · Remote Access ToolsThe report says AnyDesk and Teramind were installed in earlier activity to maintain remote access.
Threat Actors
Malware
ICE Cloud ClientThe latest campaign installs a Goâbased scanner called ICE Cloud Client that authenticates with a C2, receives MSSQL scanning targets and credentials, and reports successful logins back to the server.ICE Cloud LauncherThe api.exe downloader installs ICE Cloud Launcher and then the ICE Cloud Client scanner (both written in Go); the scanner contains Turkish strings and AIâstyle emoticons.MimicPast Larva-26002 activity included deploying Trigona and Mimic ransomware and installing remote access tools such as AnyDesk and RMM like Teramind to maintain access.TrigonaPast Larva-26002 activity included deploying Trigona and Mimic ransomware and installing remote access tools such as AnyDesk and RMM like Teramind to maintain access.
Products
Tools
AnyDeskPast Larva-26002 activity included deploying Trigona and Mimic ransomware and installing remote access tools such as AnyDesk and RMM like Teramind to maintain access.BCPAhnLab ASEC reports that the Larva-26002 actor continues to target internetâexposed, improperly managed MSâSQL servers and uses the BCP utility or downloaders to create and deploy scanner malware.TeramindPast Larva-26002 activity included deploying Trigona and Mimic ransomware and installing remote access tools such as AnyDesk and RMM like Teramind to maintain access.