Huntress Details Intrusion Targeting Executive at Market Research Company
Summary
Huntress describes a 2025 intrusion at a market research company, with reconnaissance and credential-related registry changes on a server followed by a Mesh Agent loader on an executive’s workstation. Huntress suspects state-aligned espionage actors.
Key points
- Huntress says the intrusion began with unusual server access and rapid enumeration of users, DNS records, and mail-exchange records; the server was isolated within minutes of the first observed execution.
- The actor later created a service that ran a batch file. Huntress could not retrieve the file but observed registry changes enabling restricted admin mode and plaintext credential storage.
- An executive’s workstation was found with a modified service running an executable from the Default user’s temporary directory; it had an expired Webroot signature.
- The executable was a Go-based loader for Mesh Agent, a remote access tool. The Mesh Agent connected to an IP associated with Kaopu Cloud HK Limited in the United States.
- Huntress could not establish whether the workstation service modification was the intrusion vector or fully determine why the executable was named as it was.
- Huntress suspects a connection to state-aligned espionage actors, but the article does not establish attribution.
- Huntress provided Sigma detection rules and additional hunting guidance for Mesh Agent execution, mail-server enumeration, and reconnaissance activity.
Article Details
- Attack Vectors
- The threat actor logged in to a server from a hostname uncommon for the environment and ran commands to enumerate logged-on users, DNS zone records, and mail exchange records.
- The actor created a service that ran cmd.exe /c c:\temp\1.bat and appears to have executed the batch file via WMIExec.
- The batch-file execution changed registry settings to enable restricted admin mode and force credentials to be stored in plaintext.
- On an executive's workstation, a modified service ran a Golang loader from the Default user's temporary AppData directory; the loader launched a Mesh Agent executable.
- Defensive Notes
- The article provides Sigma detections for Mesh Agent execution and mail exchanger enumeration via Nslookup.
- Additional suggested hunting detections cover Dnscmd.exe, EventLog reconnaissance, Net.exe group and account reconnaissance, Nltest.exe, and process execution from an unusual directory.
- The server was isolated within minutes of the first execution to prevent further activity.
- The article recommends routine asset inventories and cites Mandiant guidance on hunting for rented virtual private infrastructure.
MITRE ATT&CK
T1003 · OS Credential DumpingThe registry changes were described as enabling easier dumping of hashed user passwords from memory.T1016 · System Network Configuration DiscoveryThe actor enumerated DNS zone records and mail exchange records.T1036 · MasqueradingThe loader and service used Webroot-like naming, including WebrootCheck and service.exe with an expired Webroot signature, in an apparent attempt to masquerade as Webroot.T1047 · Windows Management InstrumentationThe batch script was likely executed via WMIExec, according to the article.T1059.003 · Windows Command ShellThe actor executed commands and a batch script through cmd.exe.T1071 · Application Layer ProtocolThe Mesh Agent executable connected to an IP associated with Kaopu Cloud HK Limited.T1087 · Account DiscoveryThe actor ran enumeration commands to gather information about organizational users.T1112 · Modify RegistryThe actor modified registry values for DisableRestrictedAdmin and UseLogonCredential.T1543.003 · Windows ServiceThe actor created a Windows service named WebrootCheck to run the batch script.T1552.002 · Credentials in RegistryThe UseLogonCredential registry change was used to force credentials to be stored in plaintext.
People
Vendors
Products
Tools
Dnscmd.EXEPotential Discovery Activity Via Dnscmd.EXE (Sigma HQ)net.exeSuspicious Group And Account Reconnaissance Activity Using Net.EXE (Sigma HQ)Nltest.EXEPotential Recon Activity Via Nltest.EXE (Sigma HQ)NslookupThe first one detects the client software used to connect to a Mesh Central Server, while the other one detects the use of Nslookup to enumerate mail servers:wmiexecThey then executed a dir command followed by the aforementioned bat script (likely via WMIExec) within minutes of the previous service creation: