Huntress Investigates GoAnywhere MFT Intrusion and Finds Likely Truebot Malware
Summary
Huntress traced activity on two GoAnywhere MFT servers to likely exploitation of a zero-day vulnerability and a DLL resembling Truebot. The intrusion was contained before further activity, with a likely ransomware attempt assessed but not confirmed.
Key points
- On February 2, 2023, Huntress detected activity on two GoAnywhere MFT servers: certutil retrieved a remote file, rundll32 attempted to run gamft.dll, and scheduled tasks were created for persistence.
- The commands ran under the GoAnywhere service account, with Apache Tomcat as the parent process; the task names imitated NVIDIA crash-report tasks.
- Huntress assessed that an exposed GoAnywhere management interface was likely exploited, while noting the precise access route was initially unknown. Fortra released a patch on February 7, 2023.
- After recovering gamft.dll, Huntress found evidence including command strings and C2 behavior that it said aligned with an updated Truebot sample. Attribution to Silence and links to TA505-related activity remained qualified.
- The article identifies qweastradoc[.]com as the DLL’s C2 domain and describes HTTP activity over TCP port 8000; these findings are specific to the analyzed sample and incident.
- Huntress said it contained the intrusion before further attacker activity. It assessed ransomware deployment as a likely intent, not a confirmed outcome.
- Recommended defenses include limiting exposed services and monitoring for Tomcat spawning utilities, certutil downloads, unusual rundll32 execution, and new scheduled tasks.
Article Details
- Attack Vectors
- A GoAnywhere MFT management interface was plausibly exposed externally and exploited for remote code execution; Huntress identified this as the likely initial-access route, but described the cause as a plausible explanation.
- After the suspected exploitation, Apache Tomcat spawned certutil and rundll32 under the GoAnywhereSvcAcct service account. certutil attempted to retrieve a remote payload, which was run from C:\Users\Public\gamft.dll.
- Scheduled tasks with names resembling legitimate NVIDIA crash-report tasks were created to persistently execute the DLL.
- The recovered Truebot sample contained references to follow-on PowerShell and WMI functionality and POST activity to C2 infrastructure; the article does not report these actions as observed on the impacted hosts.
- Defensive Notes
- Limit externally exposed services to those necessary for business operations, and secure and monitor any that remain exposed.
- Monitor for unusual applications such as Apache Tomcat spawning native utilities such as certutil, as well as certutil retrieving or decoding remote content.
- Investigate rundll32 execution of binaries from atypical locations and creation of new scheduled tasks, including tasks that imitate legitimate software.
- Extend monitoring beyond the perimeter to detect post-exploitation activity early, even when initial access cannot be prevented.
- For this incident, Fortra released a GoAnywhere MFT patch on 07 February 2023; test and deploy available fixes promptly.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | qweastradoc[.]com | C2 domain for Truebot, as identified in the article's network indicators. |
| IPV4 | 5[.]188[.]206[.]76 | Host used to serve the attempted Truebot payload download; identified as hosting location for Truebot. |
| IPV4 | 92[.]118[.]36[.]213 | Hosting IP identified for the Truebot C2 domain. |
| MD5 | 82d4025b84cf569ec82d21918d641540 | Hash of the gamft.dll Truebot payload recovered by Huntress and identified as part of the incident. |
| SHA1 | 62f5a16d1ef20064dd78f5d934c84d474aca8bbe | Hash of the gamft.dll Truebot payload recovered by Huntress and identified as part of the incident. |
| SHA256 | 0e3a14638456f4451fe8d76fdc04e591fba942c2f16da31857ca66293a58a4c3 | Hash of a related Truebot sample, identified in the article's intrusion indicators. |
| SHA256 | c042ad2947caf4449295a51f9d640d722b5a6ec6957523ebf68cddb87ef3545c | Hash of the gamft.dll Truebot payload recovered by Huntress and identified as part of the incident. |
| SHA256 | c9b874d54c18e895face055eeb6faa2da7965a336d70303d0bd6047bec27a29d | Hash of a related Truebot sample, identified in the article's intrusion indicators. |
| URL | hxxp[:]//qweastradoc[.]com/gate[.]php | HTTP C2 URL identified by Huntress during analysis of the Truebot sample. |
MITRE ATT&CK
T1036.004 · Masquerade Task or ServiceThe malicious scheduled-task names imitated legitimate NVIDIA crash-report tasks.T1053.005 · Scheduled TaskScheduled tasks were created to persistently execute the malicious DLL.T1071.001 · Web ProtocolsThe Truebot sample's C2 activity used HTTP.T1078.003 · Local AccountsThe commands ran under the GoAnywhereSvcAcct account associated with the compromised service.T1105 · Ingress Tool Transfercertutil attempted to retrieve the Truebot payload from a remote host.T1132.001 · Standard EncodingThe article's ATT&CK mapping states that the Truebot payload was encoded for standard decoding via certutil.T1140 · Deobfuscate/Decode Files or InformationThe article's ATT&CK mapping states that certutil was used to decode an encoded Truebot payload.T1190 · Exploit Public-Facing ApplicationHuntress assessed exploitation of the GoAnywhere MFT service as the likely initial access route.T1218.011 · Rundll32rundll32.exe was used to attempt execution of C:\Users\Public\gamft.dll via its ChkdskExs export.T1553.002 · Code SigningThe Truebot payload was signed with a valid code-signing certificate.T1571 · Non-Standard PortThe remote host served HTTP over TCP port 8000, which the article identifies as a nonstandard port for the service.
People
Threat Actors
Malware
Clopindicate links to a group referred to as TA505. Distributors of a ransomware family referred to as Clop, reporting from various entities links Silence/Truebot activity to TA505 operations. Based on observedTruebotin the second alert for this host. Huntress has previously observed this activity from malware named Truebot, which references the same export. This can be seen in the strings of a different known Truebot DLL:
Vendors
Products
Apache Tomcatexecuting from a subdirectory inside the C:\Program Files\Linoma Software\GoAnywhere directory. Apache Tomcat is an open-source Java Web Application Server, and is typically accessed from the internet as a webFortra GoAnywhere MFTdescribed above, security reporter Brian Krebs posted on Mastodon regarding a RCE vulnerability in GoAnywhere MFT software. The security advisory, which was not made public and as of this writing has no CVE