Researchers Detail Speagle Infostealer’s Abuse of Cobra DocGuard
Summary
Symantec and Carbon Black describe Speagle, a .NET infostealer that runs on systems with Cobra DocGuard, collects system, file, and browser data, and exfiltrates it through a server the researchers believe was compromised. Its infection vector remains unknown.
Key points
- Speagle is a 32-bit .NET infostealer that proceeds with full collection and exfiltration only when it detects Cobra DocGuard.
- It collects system identifiers, WMI output, file listings, browser artifacts, and, in one variant, searches for documents related to Chinese ballistic missiles.
- Speagle serializes collected data as XML, compresses it with Deflate, encrypts it with AES-128-CBC, and sends it over HTTP to a Cobra DocGuard server researchers believe was compromised.
- The malware attempts to delete itself using the Cobra DocGuard driver and file-renaming and deletion APIs.
- Researchers say the infection vector is unknown; a trojanized software update is a low-confidence hypothesis, not an established delivery method.
- The researchers call the actor Runningcrab but have not linked it to a known threat actor; state sponsorship or a private contractor are hypotheses.
Article Details
- Attack Vectors
- Speagle's initial infection vector is unknown. A supply-chain attack, potentially involving a Trojanized Cobra DocGuard update, is a low-confidence hypothesis.
- Speagle targets systems with Cobra DocGuard installed and uses its client functionality and a reportedly compromised Cobra DocGuard server to disguise exfiltration as legitimate client-server traffic.
- Defensive Notes
- Symantec Endpoint products will detect and block the file if the IOC is malicious and the file is available to them.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 03298f85eaf8880222cf8a83b8ed75d90712c34a8a5299a60f47927ad044b43b | Hash identified in the article as an Infostealer.Speagle malware sample. |
| SHA256 | d7f167cbf1676c14fd487219447e30fadf26885eb25ec4cafdeabe333bddf877 | Hash identified in the article as an Infostealer.Speagle malware sample. |
| SHA256 | dcd3f06093bf34d81837d837c5a5935beb859ba6258e5a80c3a5f95638a13d4d | Hash identified in the article as an Infostealer.Speagle variant with additional targeted collection functionality. |
| SHA256 | fad8d0307db5328c8b9f283a2cc6f7e4f4333001623fef5bd5c32a1c094bf890 | Hash identified in the article as an Infostealer.Speagle malware sample. |
| URL | hxxp[:]//222[.]222[.]254[.]165:8090/CDGServer3/CDGClientDiagnostics?flag=syn_user_policy | Additional hardcoded Speagle exfiltration endpoint listed in the article as hosted on a hijacked Cobra DocGuard server. |
| URL | hxxp[:]//60[.]30[.]147[.]18:8091/CDGServer3/CDGClientDiagnostics?flag=syn_user_policy | Hardcoded Speagle exfiltration endpoint on a Cobra DocGuard server the researchers suspect was compromised. |
MITRE ATT&CK
T1005 · Data from Local SystemSpeagle collects local file and folder listings, WMI output, and browser artifacts including history, autofill data, downloads, shortcuts, and bookmarks.T1027 · Obfuscated Files or InformationSpeagle serializes collected data as XML, compresses it with Deflate, encrypts it with AES-128-CBC, and hexlifies it before transmission.T1036 · MasqueradingSpeagle hijacks Cobra DocGuard client functionality and server infrastructure to make malicious exfiltration appear as legitimate client-server traffic.T1041 · Exfiltration Over C2 ChannelSpeagle sends encrypted, hexlified collected data by HTTP POST to hardcoded URLs on Cobra DocGuard servers the researchers suspect were compromised.T1070.004 · File DeletionAfter its operations, Speagle attempts to delete its executable, including by renaming the running file and marking it for deletion.T1082 · System Information DiscoverySpeagle collects identifiers including the current username, computer name, client ID, and old ID.T1195 · Supply Chain CompromiseA supply-chain delivery through a Trojanized Cobra DocGuard update is a low-confidence hypothesis; the infection vector remains unknown.
People
Threat Actors
CarderbeeThe article identifies Carderbee as an APT group that used Cobra DocGuard in a supply-chain attack to deliver the Korplug backdoor to organizations in Hong Kong and other Asian countries.RunningcrabThe researchers assigned this name to the actor behind Speagle, while stating they could not associate it with a known threat actor. The actor's identity and whether it is state-sponsored or a private contractor remain uncertain.
Malware
Infostealer.SpeagleSymantec and Carbon Black researchers uncovered Infostealer.Speagle, a stealthy .NET infostealer that hijacks the functionality and infrastructure of the legitimate Cobra DocGuard client and uses compromised CobraKorplugan APT group named Carderbee using Cobra DocGuard to perform a supply chain attack to deliver the Korplug backdoor (aka PlugX) to multiple organizations in Hong Kong and a number of Asian countries.PlugXCarderbee using Cobra DocGuard to perform a supply chain attack to deliver the Korplug backdoor (aka PlugX) to multiple organizations in Hong Kong and a number of Asian countries.
Vendors
Carbon BlackSymantec and Carbon Black researchers uncovered Infostealer.Speagle, a stealthy .NET infostealer that hijacks the functionality and infrastructure of the legitimate Cobra DocGuard client and uses compromised CobraEsafeNetCobra DocGuard is a legitimate document security and encryption platform that is developed by Chinese company EsafeNet.SymantecSymantec and Carbon Black researchers uncovered Infostealer.Speagle, a stealthy .NET infostealer that hijacks the functionality and infrastructure of the legitimate Cobra DocGuard client and uses compromised Cobra
Products
Cobra DocGuarda stealthy .NET infostealer that hijacks the functionality and infrastructure of the legitimate Cobra DocGuard client and uses compromised Cobra DocGuard servers to exfiltrate stolen data while appearing asSymantec EndpointIf an IOC is malicious and the file available to us, Symantec Endpoint products will detect and block that file.