Huntress Links NetScaler Exploitation and Social Engineering to Shared Intrusion Tradecraft

Sep 26, 2023 · Original article ↗

Summary

Huntress analyzed intrusions across multiple organizations involving possible NetScaler exploitation, phishing, and social engineering. It detailed shared post-compromise techniques but could not determine the attackers’ goals or conclusively link the activity to a past

Key points

Huntress identified and mitigated intrusions across monitored organizations in September 2023, before the attackers’ ultimate objectives were known.
Several victims had vulnerable NetScaler appliances; Huntress found web shells, including a script that captured login credentials. CVE-2023-3519 exploitation was a possible initial access route.
In one intrusion, a password-protected ZIP delivered through a redirect contained an LNK and other files; telemetry suggested DLL sideloading through a malicious version.dll alongside ADExplorer64.
Huntress described another initial access case in which an IT staff member was contacted by an attacker and socially engineered into accessing and executing a payload.
Post-compromise activity included reconnaissance commands launched through anomalous wuauclt.exe activity, obfuscated PowerShell, privileged account creation, and scheduled-task persistence.
The activity shared similarities with previously discussed tradecraft, but Huntress could not conclusively link the September intrusions to the August activity or attribute them to one actor.
Huntress noted that unusual parent processes and staging locations can help distinguish malicious use of legitimate system tools from routine activity.

Article Details

Attack Vectors: Huntress reported that multiple victims were running vulnerable Citrix NetScaler equipment during initial access; the activity was associated with exploitation of CVE-2023-3519 and web shells placed under /vpn/themes/imgs/.
One intrusion began when a user visited or was directed to a link that redirected to a password-protected ZIP containing an LNK and other files; Huntress assessed this as likely Citrix patch-themed phishing.
In another intrusion, a victim organization’s IT staff member was contacted directly and socially engineered into accessing and executing a payload.
Observed follow-on activity included obfuscated PowerShell, DLL sideloading alongside ADExplorer64.exe, use of wuauclt.exe for anomalous process execution, creation of a privileged local account, and scheduled-task persistence.
Defensive Notes: Investigate unusual process relationships, especially reconnaissance commands launched by wuauclt.exe or other anomalous parent processes.
Review PowerShell execution for obfuscation, bypass flags, distinctive arguments, and unusual staging locations.
Monitor for unexpected local account creation and scheduled tasks, including tasks configured to run at startup as SYSTEM.
Inspect archives and LNK-launched binaries for DLL sideloading, particularly when a DLL is placed alongside a legitimate executable.
Hunt for the reported NetScaler web-shell paths and assess whether the affected appliances were vulnerable to CVE-2023-3519.
Use process context and knowledge of legitimate tool use to distinguish malicious activity from ordinary administrative commands.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`z9x[.]org`	Domain reported as redirecting users to malicious file storage used in the phishing-related intrusion.
IPV4	`91[.]236[.]230[.]111`	IP address hosting remote next-stage content, according to the article.
SHA256	`06de42d666b3ae548719778445162ddebaa5267b96ceaf5b8c38ed78ead8a148`	Hash of version.dll, identified as a malicious DLL sideloaded by a legitimate binary.
SHA256	`3742b9cb7a7e664dbeb4f3b7d350a22bbd008f7698db8679a0764b7bab983025`	Hash of an embedded DLL in the malicious shr.ps1 script.
SHA256	`3ac2d170eeefd5d866ca2285da2a7387c544250d6978bab621c2a80b95946712`	Hash of citfix29.zip, a password-protected archive containing an LNK and other objects used in the reported intrusion.
SHA256	`3c1829079eecd453e28ec3f111a4f98aa05d338787955b33b0c9932aada2c370`	Hash of an embedded DLL in the malicious shr.ps1 script.
SHA256	`5ee3e274a79f6ad79bb43ff193c03fb38f82396dd0a70fb2597ab78497b1a5c2`	Hash of shr.ps1, an obfuscated PowerShell script described as likely used for process injection.
SHA256	`886f3add934cb8e348dcfac78d9e0e50d6d760d065352bc8026529a6bb233279`	Hash of netscaler.php, identified as a credential-harvesting web-shell component.
SHA256	`baf385c3f35a48509114cc39623da8834d37b7afd12ab00b1c3c9d695effca6f`	Hash of dllhost.exe, described as a renamed Sysinternals Contig.exe tool used in the activity.
SHA256	`bbdd3620a67aedec4b9a68b2c9cc880b6631215e129816aea19902a6f4bc6f41`	Hash of sh1.exe, identified in the article as a Sharpshares variant.
SHA256	`cbd2567b61c7be8b92dcd1c5970d7a0a74c59b5d75be889c0a58e18746e7dff6`	Hash of sqlsrvwr.exe, described as a loader DLL for the Space Agent persistence mechanism.
SHA256	`edd464cd0069324d9b3437126e2c95b903c274ecbb5068b9058d07f0d946ed2c`	Hash of ch.dll, described as a loader DLL used to achieve persistence.
SHA256	`f4dbed01049e169189867713d33c24a4f07954f1c1fdd3bce08afb5aeed38804`	Hash associated with the SpaceAgentTaskMgrLLD persistence item created as a scheduled task.
SHA256	`faf37bcbbcaff2de3e4b794bb9eed9e47505cdbed3a35b83ce9a216298779c62`	Hash of ctxheaderlogin.php, identified as a web-shell component.
URL	`hxxps[:]//91[.]236[.]230[.]111/1/18150e98`	Remote URL identified as hosting next-stage content for the compromise activity.