ShroudedSnooper Targets Middle East Telecoms with HTTPSnoop and PipeSnoop Backdoors
Summary
Cisco Talos attributes HTTPSnoop and PipeSnoop backdoors to a new intrusion set targeting Middle East telecoms. The implants masquerade as security software and use HTTP(S) requests or named pipes to deliver and execute shellcode.
Key points
- Talos identified ShroudedSnooper as a distinct intrusion set targeting telecommunications providers in the Middle East.
- HTTPSnoop listens for configured HTTP(S) URLs through Windows HTTP kernel components and executes shellcode delivered in incoming requests.
- Its URL patterns imitate Microsoft Exchange Web Services, OfficeCore applications, and telecommunications provisioning services.
- PipeSnoop reads shellcode from an existing Windows named pipe and likely operates alongside another component within compromised networks.
- Both implants have DLL- and EXE-based variants that masquerade as Palo Alto Networks Cortex XDR components.
- Talos assesses that HTTPSnoop may be deployed on internet-facing servers for initial access; PipeSnoop may be intended for higher-priority internal endpoints.
- Talos shared its findings with Microsoft and Palo Alto Networks and listed a ClamAV detection.
Article Details
- Attack Vectors
- HTTPSnoop likely gains initial access by exploiting internet-facing servers; this is an assessment based on URL patterns that mimic Exchange Web Services.
- HTTPSnoop binds to configured HTTP(S) URL patterns on infected endpoints, receives encoded shellcode in HTTP request bodies, and executes it.
- HTTPSnoop DLL variants can rely on DLL hijacking in benign applications and services for activation.
- PipeSnoop connects to a pre-existing Windows named pipe and executes shellcode supplied through it; it likely requires a separate component to provide that shellcode.
- Both implants were found masquerading as components of Palo Alto Networks Cortex XDR.
- Defensive Notes
- The article lists Cisco Secure Endpoint, Cisco Secure Web Appliance, Cisco Secure Email, Cisco Secure Firewall, Cisco Secure Malware Analytics, Umbrella, Firewall Management Center, and Cisco Duo as detection or prevention measures.
- ClamAV detections are available under Win.Trojan.WCFBackdoor.
- The article says findings were shared with Microsoft and Palo Alto Networks.
MITRE ATT&CK
T1036 · MasqueradingHTTPSnoop and PipeSnoop masquerade as Palo Alto Networks Cortex XDR components, including using the filename CyveraConsole.exe.T1059 · Command and Scripting InterpreterHTTPSnoop and PipeSnoop execute arbitrary shellcode received through HTTP requests or a named pipe; the article does not specify a command interpreter.T1095 · Non-Application Layer ProtocolPipeSnoop uses a pre-existing Windows named pipe for input and output of shellcode.T1574.001 · DLLHTTPSnoop DLL variants may use DLL hijacking in benign applications and services to activate on infected systems.
People
Threat Actors
Malware
Explosiveprevalent. In January 2021, Clearsky disclosed the “Lebanese Cedar” APT leveraging web shells and the “Explosive” RAT malware family to target telecommunication firms in the U.S., U.K. and middle-east Asia. In aHTTPSnoopCisco Talos recently discovered a new malware family we’re calling “HTTPSnoop” being deployed against telecommunications providers in the Middle East.PipeSnoopWe also discovered a sister implant to “HTTPSnoop” we’re naming “PipeSnoop,” which can accept arbitrary shellcode from a named pipe and execute it on the infected endpoint.PlugXDiànxùn” linked to the Chinese APT group MustangPanada (RedDelta). This campaign heavily relied on the PlugX malware implant. Also in 2021, Recorded Future reported that four distinct Chinese state-sponsored APT
Vendors
CiscoCisco Talos recently discovered a new malware family we’re calling “HTTPSnoop” being deployed against telecommunications providers in the Middle East.ClearskyThe targeting of telecommunications firms in middle-east Asia is also quite prevalent. In January 2021, Clearsky disclosed the “Lebanese Cedar” APT leveraging web shells and the “Explosive” RAT malware family to targetCrowdStrikefirms outlining various attack campaigns targeting telecommunications companies globally. In 2021, CrowdStrike disclosed a years-long campaign by the LightBasin (UNC1945) advanced persistent threat (APT) targetingMcAfeeglobally using Linux-based implants to maintain long-term access in compromised networks. That same year, McAfee discovered activity targeting telecommunication firms in Europe, the U.S. and Asia dubbed “OperationMicrosoftcalling “ShroudedSnooper.” Based on the HTTP URL patterns used in the implants, such as those mimicking Microsoft’s Exchange Web Services (EWS) platform, we assess that this threat actor likely exploits internet-facingPalo Alto NetworksWe also discovered both HTTPSnoop and PipeSnoop masquerading as components of Palo Alto Networks’ Cortex XDR application. The malware executable is named “CyveraConsole.exe,” which is the application that contains theRecorded FutureMustangPanada (RedDelta). This campaign heavily relied on the PlugX malware implant. Also in 2021, Recorded Future reported that four distinct Chinese state-sponsored APT groups were targeting the email servers of aSymantecfamily to target telecommunication firms in the U.S., U.K. and middle-east Asia. In a separate campaign, Symantec noted the MuddyWater APT targeting telecommunication organizations in the Middle East, deploying web
Products
Cisco DuoCisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network.Cisco Secure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here.Cisco Secure EndpointCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.Cisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Cisco Secure Malware AnalyticsCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.Cisco Secure Web ApplianceCisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks.ClamAVClamAV detections are available for this threat:Cortex XDRWe also discovered both HTTPSnoop and PipeSnoop masquerading as components of Palo Alto Networks’ Cortex XDR application. The malware executable is named “CyveraConsole.exe,” which is the application that contains theFirewall Management CenterAdditional protections with context to your specific environment and threat data are available from the Firewall Management Center.Microsoft Exchange Web ServicesOfficeTrackOfficeCore’s Location Based Services (LBS)-related URL listener: Listens for URLs that mimic OfficeCore’s LBS/OfficeTrack and telephony applications.UmbrellaUmbrella, Cisco's secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here.