Huntress Traces Threat Actor’s Use of Elastic Cloud to Exfiltrate and Triage Victim Data
Summary
Huntress traced a threat actor’s use of a free Elastic Cloud SIEM trial to receive and triage host data from about 216 victim systems, linking disposable emails and infrastructure telemetry to opportunistic exploitation. Elastic later took the instance down.
Key points
- An encoded PowerShell command collected host and Active Directory details and sent them to an attacker-controlled Elastic Cloud Elasticsearch index.
- The exposed index held about 216 host records; Huntress identified 34 distinct Active Directory domains among 47 domain-joined machines.
- Kibana telemetry showed the operator repeatedly searching and filtering victim data over seven days, including targeting servers in one organization.
- The Elastic trial used an address at quieresmail[.]com; Huntress linked email prefixes to Cloudflare Worker subdomains and assessed the email service as part of the firstmail[.]ltd network.
- The activity included suspected intrusions involving SolarWinds Web Help Desk, Gladinet CentreStack, SmarterMail or SmarterTools, and Microsoft SharePoint.
- Huntress reported that two IP addresses were associated by security teams and law enforcement with a SAFING_VPN tunnel; one had also been observed in a SharePoint exploitation case.
- Huntress notified affected organizations and coordinated with Elastic, which confirmed the instance had been taken down.
Article Details
- Attack Vectors
- The actor exploited vulnerabilities in internet-facing software, including SolarWinds Web Help Desk; victim data also suggested intrusions involving Gladinet CentreStack, SmarterMail or SmarterTools, and Microsoft SharePoint.
- An encoded PowerShell command ran Get-ComputerInfo on a victim computer and sent collected system and Active Directory metadata to an attacker-controlled Elastic Cloud instance.
- The actor used Cloudflare Worker Pages subdomains to host Velociraptor callbacks.
- Defensive Notes
- Huntress notified Elastic and coordinated with relevant parties, law enforcement, and other security teams; Elastic confirmed the instance was taken down.
- Huntress conducted outreach and victim notification to organizations indicated in the exposed data.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | qgtxtebl[.]workers[.]dev | Cloudflare Worker Pages subdomain reported as hosting the actor's Velociraptor callbacks. |
MITRE ATT&CK
T1059.001 · PowerShellThe actor executed an encoded PowerShell command that ran Get-ComputerInfo on a victim computer.T1082 · System Information DiscoveryThe actor used Get-ComputerInfo to collect operating system, hardware, and other system information from victim hosts.T1567 · Exfiltration Over Web ServiceThe actor exfiltrated victim system information to an attacker-controlled Elastic Cloud instance.
People
Vendors
Products
Elastic CloudTL; DR Huntress discovered a threat actor was exploiting vulnerabilities (like SolarWinds Web Help Desk) and exfiltrating victim data to a free trial instance of Elastic Cloud SIEM.ElasticsearchThis ran the Get-ComputerInfo cmdlet to uncover detailed system information and then pushes that to an attacker-controlled ElasticSearch index with a hardcoded API key.Gladinet CentreStackNamely, there were multiple instances of suggested Gladinet CentreStack, SmarterMail or SmarterTools, Solarwinds Web Help Desk, and ToolShell intrusions against Microsoft SharePoint.KibanaKibana usage telemetry revealed the operator spent significant time triaging victim data through the Discover interface across seven days.Microsoft SharePointuse of a SAFING_VPN tunnel, and a possible connection to other opportunistic attacks against Microsoft SharePoint and other software.SmarterMailNamely, there were multiple instances of suggested Gladinet CentreStack, SmarterMail or SmarterTools, Solarwinds Web Help Desk, and ToolShell intrusions against Microsoft SharePoint.SmarterToolsNamely, there were multiple instances of suggested Gladinet CentreStack, SmarterMail or SmarterTools, Solarwinds Web Help Desk, and ToolShell intrusions against Microsoft SharePoint.SolarWinds Web Help DeskTL; DR Huntress discovered a threat actor was exploiting vulnerabilities (like SolarWinds Web Help Desk) and exfiltrating victim data to a free trial instance of Elastic Cloud SIEM.
Tools
PowerShellWe will continue onwards from this starting point: a threat actor ran an encoded PowerShell command with a hardcoded API key and credentials to exfiltrate data into a free instance of Elastic Cloud SIEM.VelociraptorWhile we have previously seen threat actors leveraging Velociraptor and other DFIR-focused tools for command and control, this was the first time we observed an adversary use Elastic Cloud for exfiltration.
Industries
Automotiveinstitutions, financial services, religious and nonprofit organizations, global manufacturing and automotive companies, IT service providers, retail, and construction.Constructionorganizations, global manufacturing and automotive companies, IT service providers, retail, and construction.Financial ServicesThe affected sectors included government agencies, higher education institutions, financial services, religious and nonprofit organizations, global manufacturing and automotive companies, IT service providers, retail,GovernmentThe affected sectors included government agencies, higher education institutions, financial services, religious and nonprofit organizations, global manufacturing and automotive companies, IT service providers, retail,Higher EducationThe affected sectors included government agencies, higher education institutions, financial services, religious and nonprofit organizations, global manufacturing and automotive companies, IT service providers, retail,Manufacturinghigher education institutions, financial services, religious and nonprofit organizations, global manufacturing and automotive companies, IT service providers, retail, and construction.Religious and nonprofit organizationssectors included government agencies, higher education institutions, financial services, religious and nonprofit organizations, global manufacturing and automotive companies, IT service providers, retail, andRetailand nonprofit organizations, global manufacturing and automotive companies, IT service providers, retail, and construction.