Huntress Details Attempted Data Exfiltration Using Restic Backup Utility
Summary
Huntress traced an actor’s access to two Windows servers using compromised credentials and attempts to exfiltrate file shares with restic and cloud storage. The investigation found no clear evidence the second server’s data was successfully backed up.
Key points
- The actor accessed the first Windows Server 2019 endpoint over RDP using previously compromised credentials; the initial access method to the infrastructure was not observed.
- After limited file viewing and a network scan, the actor ran restic—renamed dns.exe on the first server—to back up a file share to Backblaze B2 storage.
- The actor accessed a second server, enabled RDP through a registry change, and set AWS credentials and a RESTIC_PASSWORD before attempting to run restic.
- Repeated attempts to run restic on the second server continued for about 17 minutes, with credential changes; Huntress found no clear indication the backup succeeded before the endpoint was isolated.
- Huntress observed use of Wasabi and Backblaze S3 endpoints, but the article does not establish that data was successfully exfiltrated.
- The investigation found no evidence of additional persistence, and assessed that the actor may have had prior knowledge of the infrastructure, credentials, and data locations.
Article Details
- Attack Vectors
- The initial Windows 2019 server was accessed over RDP using previously compromised credentials.
- The second server was accessed from the first server and another endpoint using network logins; the actor modified the Windows Registry to enable RDP.
- The actor used restic to attempt backups of file shares to S3-compatible cloud storage, setting AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and RESTIC_PASSWORD environment variables.
- Defensive Notes
- Isolate affected endpoints promptly when suspicious use of backup utilities or repeated backup attempts are detected.
- Monitor for restic execution, including renamed copies such as dns.exe, and commands backing up file shares to external S3-compatible destinations.
- Investigate unusual RDP access, use of compromised credentials, remote network logins, and registry changes to fDenyTSConnections.
- Review endpoint telemetry for network scanning, access to file shares, and environment-variable changes involving AWS credentials or RESTIC_PASSWORD.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | s3[.]us-central-1[.]wasabisys[.]com | S3-compatible destination the actor pinged and attempted to initialize as a restic backup target. |
| DOMAIN | s3[.]us-east-005[.]backblazeb2[.]com | S3-compatible destination the actor pinged during the observed activity. |
| DOMAIN | s3[.]us-west-002[.]backblazeb2[.]com | S3-compatible destination specified in restic commands attempting to back up file shares. |
| SHA256 | 6c176e9c2a7eaf4eb26ee08deadba88ba39a14cba064f946d2722718ac1b57f8 | SHA-256 of the downloaded utility named system.exe, observed during the incident. |
| SHA256 | 75d4148ecdb76518b04f612a90c804df99c115beb843c06835fd8c1edbc35cac | SHA-256 of restic.exe observed in attempted file-share backups. |
| SHA256 | 98394683d8f30ce9fb313100f593dc16e97a52723b18d534cf586391a97cdc1d | SHA-256 of the restic application renamed to dns.exe and used in attempted backups. |
MITRE ATT&CK
T1039 · Data from Network Shared DriveThe actor attempted to back up contents of file shares from the endpoints.T1059.003 · Windows Command ShellThe actor used Windows command-shell commands to modify the Registry and launch utilities.T1078.002 · Domain AccountsThe actor used previously compromised credentials to access the first endpoint.T1133 · External Remote ServicesThe first endpoint was accessed remotely over RDP.T1560.001 · Archive via UtilityThe actor extracted the restic application from a downloaded archive.T1567 · Exfiltration Over Web ServiceThe actor attempted to send file-share backups to Wasabi and Backblaze S3-compatible storage.
People
Threat Actors
Products
MEGASyncIn August 2023, Huntress analysts observed INC ransomware threat actors employing MegaSync for data exfiltration. Recently, GBHackers published an article outlining data exfiltration tools used by ransomware threatRestican article outlining data exfiltration tools used by ransomware threat actors, one of which was the restic backup application. A Huntress Security Operations Center (SOC) analyst investigated and reported alerts