cyber.hendryadrian.com
Threat Research · microsoft.com

Storm-2561 Uses SEO Poisoning to Distribute Fake VPN Clients for Credential Theft

· Original article ↗

Summary

Microsoft details how Storm-2561 used SEO-poisoned pages and signed fake VPN installers to deploy a Hyrax infostealer, steal VPN credentials and configuration data, and send the data to attacker-controlled infrastructure.

Key points

  • Microsoft reports that search results led users to spoofed VPN download sites, which redirected them to a GitHub-hosted ZIP containing a malicious MSI installer.
  • The installer placed Pulse.exe and malicious DLLs in a Pulse Secure-like directory; dwmapi.dll loaded shellcode that launched inspector.dll, a Hyrax infostealer variant.
  • The fake VPN client captured credentials entered into its sign-in interface and accessed stored VPN configuration data before sending stolen information to attacker-controlled infrastructure.
  • The MSI and malicious DLLs used a digital certificate issued to Taiyuan Lihua Near Information Technology Co., Ltd.; Microsoft says the certificate has since been revoked.
  • A RunOnce registry entry enabled Pulse.exe to run after reboot. After collecting credentials, the fake client displayed an error and directed users to legitimate VPN downloads, potentially concealing the theft.
  • Microsoft recommends protections including web and network protection, EDR in block mode, MFA, and hunting for files signed by the certificate and suspicious DLL loads in Pulse Secure folders.

Article Details

Attack Vectors
  • SEO-poisoned search results redirected users searching for VPN software to spoofed download sites and a GitHub-hosted ZIP containing a malicious MSI.
  • The MSI masqueraded as a legitimate Pulse Secure installer and installed Pulse.exe alongside malicious DLLs, including dwmapi.dll and inspector.dll.
  • A fake VPN sign-in interface captured credentials; inspector.dll also accessed stored VPN configuration data.
  • The MSI and malicious DLLs were signed with a certificate from Taiyuan Lihua Near Information Technology Co., Ltd., which the article says was later revoked.
  • A RunOnce registry entry configured Pulse.exe to run after reboot.
Defensive Notes
  • Enable cloud-delivered protection, EDR block mode, network protection, and web protection in Microsoft Defender or equivalent security products.
  • Use browsers with SmartScreen support and require multifactor authentication on all accounts and devices.
  • Advise employees not to store workplace credentials in browsers or password vaults secured with personal credentials; organizations can disable browser password syncing through Group Policy.
  • Hunt for files signed by Taiyuan Lihua Near Information Technology Co., Ltd. and for inspector.dll or dwmapi.dll loading from folders masquerading as Pulse Secure directories.

Indicators of compromise

TypeIndicatorContext
DOMAINcheckpoint-vpn[.]comDomain listed as a suspect spoofed VPN initial-access site.
DOMAINcisco-secure-client[.]esDomain listed as a suspect spoofed VPN initial-access site.
DOMAINforticlient-for-mac[.]comDomain listed as a suspect spoofed VPN initial-access site.
DOMAINforticlient-vpn[.]deDomain listed as a suspect spoofed VPN initial-access site.
DOMAINforticlient-vpn[.]frDomain listed as a suspect spoofed VPN initial-access site.
DOMAINforticlient-vpn[.]itDomain listed as a suspect spoofed VPN initial-access site.
DOMAINforticlient[.]co[.]ukDomain listed as a suspect spoofed VPN initial-access site.
DOMAINfortinet-vpn[.]comDomain listed as a suspect spoofed VPN initial-access site.
DOMAINivanti-pulsesecure[.]comDomain listed as a suspect spoofed VPN initial-access site.
DOMAINivanti-secure-access[.]deDomain listed as a suspect spoofed VPN initial-access site.
DOMAINivanti-vpn[.]orgSpoofed initial-access domain observed linking to the malicious GitHub ZIP.
DOMAINmyconnection[.]proDomain identified as C2 infrastructure receiving stolen credentials.
DOMAINsonicwall-netextender[.]nlDomain listed as a suspect spoofed VPN initial-access site.
DOMAINsophos-connect[.]orgDomain listed as a suspect spoofed VPN initial-access site.
DOMAINvpn-connection[.]proDomain identified as C2 infrastructure receiving stolen credentials.
DOMAINvpn-fortinet[.]comActor-controlled spoofed VPN download site that redirected users to the malicious ZIP.
DOMAINwatchguard-vpn[.]comDomain listed as a suspect spoofed VPN initial-access site.
IPV4194[.]76[.]226[.]93Attacker-controlled C2 address used to receive stolen credentials and VPN data.
SHA25626db3fd959f12a61d19d102c1a0fb5ee7ae3661fa2b301135cdb686298989179Hash of malware signed by Taiyuan Lihua Near Information Technology Co., Ltd., identified as vpn.exe.
SHA25644906752f500b61d436411a121cab8d88edf614e1140a2d01474bd587a8d7ba8Hash of the malicious Pulse.exe executable signed by Taiyuan Lihua Near Information Technology Co., Ltd.
SHA25657a50a1c04254df3db638e75a64d5dd3b0d6a460829192277e252dc0c157a62fHash of the malicious VPN-CLIENT.zip distributed from GitHub.
SHA2566129d717e4e3a6fb4681463e421a5603b640bc6173fb7ba45a41a881c79415caHash of inspector.dll, identified as the data-stealing Hyrax variant.
SHA2566c9ab17a4aff2cdf408815ec120718f19f1a31c13fc5889167065d448a40dfe6Hash of the malicious dwmapi.dll loader.
SHA25685c4837e3337165d24c6690ca63a3274dfaaa03b2ddaca7f1d18b3b169c6aac1Hash of malware signed by Taiyuan Lihua Near Information Technology Co., Ltd., identified as Sophos-Connect-Client.exe.
SHA256862f004679d3b142d9d2c729e78df716aeeda0c7a87a11324742a5a8eda9b557Hash of a suspicious MSI downloaded from a spoofed Ivanti Pulse VPN domain.
SHA2568ebe082a4b52ad737f7ed33ccc61024c9f020fd085c7985e9c90dc2008a15adcHash of malware signed by Taiyuan Lihua Near Information Technology Co., Ltd., identified as PulseSecureService.exe.
SHA25698f21b8fa426fc79aa82e28669faac9a9c7fce9b49d75bbec7b60167e21963c9Hash of malware signed by Taiyuan Lihua Near Information Technology Co., Ltd., identified as GlobalProtect-VPN.exe.
SHA256cfa4781ebfa5a8d68b233efb723dbde434ca70b2f76ff28127ecf13753bfe011Hash of malware signed by Taiyuan Lihua Near Information Technology Co., Ltd., identified as VPN-Client.exe.
SHA256eb8b81277c80eeb3c094d0a168533b07366e759a8671af8bfbe12d8bc87650c9Hash of malware signed by Taiyuan Lihua Near Information Technology Co., Ltd., identified as WiredAccessMethod.dll.
URLhxxps[:]//github[.]com/latestver/vpn/releases/download/vpn-client2/VPN-CLIENT.zipSpecific GitHub-hosted URL identified as distributing the malicious VPN-CLIENT.zip payload.

MITRE ATT&CK

T1005 · Data from Local Systeminspector.dll accessed stored VPN configuration data in the Pulse Secure ConnectionStore directory.T1036 · MasqueradingThe malicious application and installation path were made to resemble legitimate VPN software and a Pulse Secure installation.T1041 · Exfiltration Over C2 ChannelStolen credentials and VPN configuration data were sent to attacker-controlled C2 infrastructure.T1105 · Ingress Tool TransferThe malicious ZIP containing the installer was downloaded from a GitHub-hosted release URL.T1204.002 · Malicious FileUsers were induced to launch the malicious MSI masquerading as a legitimate VPN installer.T1547.001 · Registry Run Keys / Startup FolderThe malware created a RunOnce registry entry to run Pulse.exe after reboot.T1553.002 · Code SigningThe malicious MSI and DLLs used a valid digital certificate from Taiyuan Lihua Near Information Technology Co., Ltd.; the certificate was later revoked.T1574.002 · DLL Side-LoadingThe installer placed malicious dwmapi.dll and inspector.dll alongside Pulse.exe in a Pulse Secure-like directory for DLL side-loading.T1608.006 · SEO PoisoningStorm-2561 used SEO poisoning to place spoofed VPN download pages prominently in search results.

Threat Actors

Storm-2561Microsoft attributes the SEO-poisoning campaign, spoofed VPN download sites, credential theft, and data exfiltration to Storm-2561; the article describes the operation as consistent with financially motivated cybercrime.

Malware

HyraxThe dropped components (dwmapi.dll and inspector.dll, a Hyrax infostealer variant) captured VPN credentials and connection data from Pulse Secure directories and exfiltrated them to attacker-controlled infrastructure

Vendors

MicrosoftMicrosoft Defender detection and hunting guidance.

Products

Microsoft Defender AntivirusTurn on cloud-delivered protection in Microsoft Defender Antivirus or the equivalent for your antivirus product to cover rapidly evolving attacker tools and techniques.Microsoft Defender for EndpointRun endpoint detection and response (EDR) in block mode so that Microsoft Defender for Endpoint can block malicious artifacts, even when your non-Microsoft antivirus does not detect the threat or when Microsoft DefenderMicrosoft Security CopilotMicrosoft Security Copilot is embedded in Microsoft Defender and provides security teams with AI-powered capabilities to summarize incidents, analyze files and scripts, summarize identities, use guided responses, andPulse Secureand inspector.dll, a Hyrax infostealer variant) captured VPN credentials and connection data from Pulse Secure directories and exfiltrated them to attacker-controlled infrastructure (194.76.226[.]93:8080).

Related Articles