Huntress Links Two RDP-Brute-Force Intrusions to Renamed MeshAgent Persistence
Summary
Huntress traced two intrusions to RDP brute force, documenting PsExec-based lateral movement, a renamed MeshAgent, WDigest credential exposure and a retroactive hunt linking the same tradecraft across environments.
Key points
- Huntress said attackers gained access through a public-facing RD-Web instance after brute-forcing authentication between October 28 and November 12, 2024.
- The compromised user used PsExec to run batch files across multiple machines, enabling RDP access and installing malicious components.
- A batch file enabled WDigest to store credentials in plaintext and removed LSA protection, according to Huntress’s analysis.
- The attackers installed MeshAgent under the name nvspbind.exe and disguised its server-side login as a Windows Network Virtual Adapter.
- A retrospective Huntress hunt found similar MeshAgent/Nvspbind activity in another environment; Huntress also reported RDP brute force and WDigest use there.
- Huntress said the intrusions were concluded and its partner was informed. Its recommendations include limiting public exposure of RDP, enforcing MFA and using software allow-lists.
Article Details
- Attack Vectors
- The adversary gained initial access by brute-forcing a public-facing RD-Web instance that did not have MFA.
- The compromised user used PsExec to run commands and batch files across multiple machines.
- The batch files enabled RDP connections by modifying registry settings and firewall rules, installed a renamed MeshAgent, removed LSA protection, and enabled WDigest credential storage in plaintext.
- Defensive Notes
- Review and harden the external perimeter; remove authentication services such as RDP from the public internet where possible.
- Enforce MFA for exposed external services and verify that MFA is correctly configured and working.
- Use software allow-lists to restrict execution of unauthorized tools.
- Hunt for the MeshAgent/Nvspbind tradecraft and unexpected workstation names, which Huntress says can provide high-fidelity detection opportunities.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 147[.]135[.]112[.]230 | Public IPv4 reported as used to brute-force the RD-Web instance. |
| IPV4 | 147[.]45[.]79[.]193 | Public IPv4 reported as used to brute-force the RD-Web instance. |
| IPV4 | 193[.]46[.]255[.]73 | MeshAgent server address used for the adversary's remote connection. |
| IPV4 | 217[.]138[.]216[.]60 | Public IPv4 reported as used to brute-force the RD-Web instance. |
| IPV4 | 23[.]158[.]40[.]185 | Public IPv4 reported as used to brute-force the RD-Web instance. |
| IPV4 | 31[.]220[.]5[.]23 | Public IPv4 reported as used to brute-force the RD-Web instance. |
| IPV4 | 78[.]141[.]202[.]136 | Public IPv4 reported as used to brute-force the RD-Web instance. |
| SHA256 | b629fe2363a23f7c0a6f40235ca25098321ba49bc397b36e2856a1ae76055c56 | SHA-256 hash listed for ARest1.exe, a binary blocked during the related credential-dumping alert and identified as part of a brute-force and lateral-movement toolkit. |
| SHA256 | fcea81909388611359bbaf41871300075e192a3246b9e1bebc5f3f0aaa2b2c9a | SHA-256 hash listed for ARestore.exe, a binary blocked during the related credential-dumping alert and identified as part of a brute-force and lateral-movement toolkit. |
| SHA256 | fdf51eba1b48ed4180dfbb66d8e299794998252517597aff4a44162183f7dcd9 | SHA-256 hash of the renamed nvspbind.exe binary used to install the MeshAgent. |
MITRE ATT&CK
T1003.001 · LSASS MemoryThe adversary enabled WDigest to store credentials in plaintext.T1036.005 · Match Legitimate Resource Name or LocationThe MeshAgent binary was renamed nvspbind.exe and its server-side login masqueraded as a Windows Network Virtual Adapter.T1059.003 · Windows Command ShellThe adversary ran batch files that modified registry settings and firewall rules and enabled plaintext credential storage.T1110 · Brute ForceMultiple public IPv4 addresses were used to brute-force the RD-Web instance.T1219 · Remote Access ToolsThe adversary deployed MeshAgent for remote access and configured it to communicate with the reported server address.T1569.002 · Service ExecutionThe compromised user used PsExec to execute batch files across multiple machines.
People
Anton OvrutskyCredited with additional findings and editing the article.Austin WorlineCredited for the initial intrusion investigation.Faith StrattonCredited with the root-cause investigation and related findings from threat hunting.Jamie DumasCredited for the initial intrusion investigation.Josh AllmanCredited with the root-cause investigation and related findings from threat hunting.
Vendors
Products
DefenderThe Huntress SOC had responded to a Defender alert for credential dumping, which blocked “avrestore.exe” and “ARest1.exe.” These binaries were determined not to be mimikatz but, in fact, part of a previously documentedMicrosoft Active DirectoryNot only did this machine hostname not match the naming convention of the legitimate machines in the Active Directory, but it's a telling static indicator that can be tracked—Huntress has found that threat actorsMicrosoft Windowsthey proceeded to push the installation of a renamed malicious MeshAgent instance: "C:\Program Files\Windows NT\nvspbind\nvspbind.exe"—the name of a virtualization binary (but more on this shortly).
Tools
ARest1.exeSOC had responded to a Defender alert for credential dumping, which blocked “avrestore.exe” and “ARest1.exe.” These binaries were determined not to be mimikatz but, in fact, part of a previously documented toolARestore.exeARestore.exe SHA256 hash:MeshAgentmimon.bat worked to ensure the successful installation of the MeshAgent, remove LSA protection, and enable WDigest to facilitate the storage of credentials in plaintext. The contents of this file are:PsExecnew terrain and pivot across it to higher-tiered machines. The threat actor leveraged the legitimate tool PsExec to begin to not just move laterally but also execute commands across multiple machines at one time.