Huntress Details Attacker Workflows Revealed by a Security-Agent Trial
Summary
Huntress used browser history and EDR telemetry to investigate an attacker who installed its agent, documenting reconnaissance, automated workflows, and identity-related activity. The company later clarified its analysts removed the agent after 84 minutes.
Key points
- Huntress said a machine name matched one it had tracked in prior incidents; browser history also showed activity consistent with targeting organizations and crafting phishing messages.
- The company reported finding 20 additional compromised identities in a retrospective hunt, with activity including session-token refreshes. It also observed access patterns involving more than 2,471 unique identities over two weeks; many were caught by other detections.
- Browser history showed the actor exploring Make.com and Telegram Bot integrations to automate parts of their workflow, and using AI tools for writing and data generation.
- The actor searched for running Evilginx instances, researched residential proxy services, and used reconnaissance and data-scraping tools.
- Huntress observed cookie files associated with two individuals and attempts to use ROADtools and a script related to Entra ID primary refresh tokens.
- Huntress corrected an earlier account: its analysts—not the actor—forcibly uninstalled the agent 84 minutes after installation, once they determined the host was being used by a threat actor.
Article Details
- Attack Vectors
- The actor accessed cookie data for two individuals and ran a Python script associated with phishing for Microsoft Entra primary refresh tokens.
- Compromised identities were accessed using session tokens to maintain access; malicious mail-rule creation was also detected.
- The actor researched organizations, personnel, and customers, and appeared to craft phishing-related messages using translation and automated workflows.
- Defensive Notes
- Huntress analysts investigated endpoint telemetry and malicious indicators, then forcibly uninstalled the agent after determining the host was being used by a threat actor.
- Retroactive hunts identified 20 additional compromised identities; the article says some activity was detected through malicious mail-rule creation and session-token theft.
MITRE ATT&CK
T1059.006 · PythonThe actor ran a Python script named main.py with arguments including --wfb and a victim username.T1114.003 · Email Forwarding RuleHuntress reported detecting malicious mail-rule creation associated with affected identities.T1528 · Steal Application Access TokenThe actor attempted to use ROADtools Token eXchange and a downloaded script in activity described as phishing for Microsoft Entra primary refresh tokens.T1539 · Steal Web Session CookieThe actor opened files containing cookie data for two individuals and attempted to run a script against a victim account.T1550.004 · Web Session CookieThe article reports compromised identities being accessed through refreshed session tokens to maintain access.T1591.002 · Business RelationshipsThe actor researched organizations’ customers, third-party companies, and supply-chain relationships.T1593.002 · Search EnginesThe actor used Google searches to research organizations, banks, and personnel.T1596.005 · Scan DatabasesThe actor searched Censys for running Evilginx instances and attempted to access them.
People
Vendors
Googleas well. Such is the setting for the beginning of this adventure: it all started with a nicely placed Google ad.HuntressOn the heels of questions around how and why Huntress released this information, we wanted to clarify several important aspects of our investigation. We have an obligation to 1) research and respond to security threats
Products
BitdefenderFigure 1: Google search for Bitdefender, leading to a Huntress adGoogle Translateidentify the organization of interest (typically after receiving a “tip” from Telegram) before using Google Translate to translate or craft messages related to these organizations. While we don’t have detailed insightLunaProxyhistory also revealed visits by the threat actor to multiple residential proxy webpages, including LunaProxy and Nstbrowser (which bills itself as an anti-detect browser and supports the use of residentialMake.comOn May 25, the threat actor signed up for Make.com, which is legitimate workflow automation software, before researching the platform’s Telegram Bot integration feature as a way to launch automated processes (as seen inMalwarebytesWe found evidence that they had bought a Malwarebytes subscription (including the Malwarebytes browser guard extension).Nstbrowserrevealed visits by the threat actor to multiple residential proxy webpages, including LunaProxy and Nstbrowser (which bills itself as an anti-detect browser and supports the use of residential proxies). The threat
Tools
ApifyThe threat actor conducted a fair amount of research into tools used to scrape Telegram group data, including looking at scraper tools like Apify, the Axiom Chrome extension, and the RapidAPI platform (Figure 13).AutorunsFor instance, after installing the Huntress agent, the threat actor took steps to better understand Autoruns.AxiomThe threat actor conducted a fair amount of research into tools used to scrape Telegram group data, including looking at scraper tools like Apify, the Axiom Chrome extension, and the RapidAPI platform (Figure 13).BloodHoundThese tools included recon and attack tool GraphSpy, open source tool Bloodhound, the TeamFiltration framework used for enumeration and exfiltration, and more.CensysWe saw evidence of the threat actor searching for running instances of the Evilginx man-in-the-middle attack framework using Censys, and then attempting to access those instances.Evilginxgiving us a sprawling inside look at how they’re using AI to build workflows, searching for tools like Evilginx, and more.GraphSpyThese tools included recon and attack tool GraphSpy, open source tool Bloodhound, the TeamFiltration framework used for enumeration and exfiltration, and more.roadtxThey then tried to use a tool called ROADtools Token eXchange (roadtx):TeamFiltrationThese tools included recon and attack tool GraphSpy, open source tool Bloodhound, the TeamFiltration framework used for enumeration and exfiltration, and more.urlscan.ioThe attacker often used urlscan to get information about various websites.
Countries
Braziluse of Google Translate to translate messages from Portuguese to English alongside browsing banks in Brazil, then evidence of crafting messages later on in their history.NigeriaThe other interesting thing was that the attacker was mostly focused on banks and sites that were in Nigeria during this time period, even looking for things like:United StatesWhile we don’t know where the attacker is based, the machine they had installed our agent upon appeared to be based in the United States, on the West Coast, based on the machine’s internal time zone and IP address.
Industries
BankingWe can see a few trends. During these days, the attacker spent a lot of time researching various banking entities and bank personnel. To further expand on some of the graph labels:CryptocurrencyCrypto: Various cryptocurrency and blockchain websites.real estateactor spent a lot of time researching companies across different sectors, from specific banks to “top real estate companies in the US” (also looking up “real estate agents in California”).Softwareas to how they decided to target a particular technology, or the actions taken while trying out such software. We recently had the pleasure of getting a front seat view into what one attacker did, simply because