BHIS Details Aur0ra-Attributed Intrusion Using Disguised Xray-Core C2
Summary
BHIS ActiveSOC describes an Aur0ra-attributed intrusion involving vishing after email bombing, disguised Xray-core C2, noisy lateral movement, log clearing and in-place encryption. The report includes Sigma detections and remediation steps.
Key points
- BHIS attributed the intrusion to Aur0ra based on a matching ransom-note template and locker behavior; the team said this was the first Aur0ra use of Xray-core it had found documented.
- Initial access followed aggressive email bombing, with users then receiving calls from someone posing as IT helpdesk staff.
- Xray-core was disguised as ChromeUpdate.exe and ConnectivityHost.exe. Its VLESS/REALITY configuration used a Chrome TLS fingerprint and dl[.]google[.]com as the TLS server name.
- Scheduled tasks and a registry Run value launching updater.ps1 maintained the tunnel; BHIS said remediation required removing the tunnels, persistence mechanisms, and abused files.
- Affected workstations made roughly 10,000 outbound connections each over SMB, LDAP, WinRM, RDP, and RPC. The attackers eventually gained control of a high-privilege administrator account.
- The attackers cleared hundreds of log channels, disabled Windows Defender protections, and changed the tunnel binaries’ timestamps.
- The locker encrypted files in place and deleted shadow copies. BHIS identified a file footer as evidence of encryption and provided two Sigma rules for detecting Xray-family execution.
Article Details
- Attack Vectors
- Initial access followed aggressive email bombing and vishing in which callers posing as the IT Helpdesk offered assistance.
- Aur0ra used renamed Xray-core binaries as a reverse-tunnel command-and-control channel.
- Lateral movement included traffic over SMB, WinRM, and RDP; the tunnel also carried WinRM sessions.
- The locker encrypted files in place and the attacker issued commands to delete and resize Volume Shadow Copies.
- Defensive Notes
- Remediation of the tunnel required disrupting active tunnels, removing associated Run values and scheduled tasks, and deleting maliciously abused binaries and scripts.
- The article provides Sigma detections for Xray-core or V2Ray execution patterns, including renamed binaries running from user-writable paths.
- Filenames such as ChromeUpdate.exe, ConnectivityHost.exe, and config.json are not reliable indicators on their own; assess them alongside execution behavior and location.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 151[.]244[.]30[.]43 | Listed as a C2 backend for the Xray tunnel. |
| IPV4 | 172[.]86[.]116[.]200 | Listed as a C2 backend for the Xray tunnel. |
| SHA256 | 05679c26f3c993270e23874442a45af486af542f3c82fd7b001c56714e89de66 | Hash of updater.ps1, which carried a copy of the beacon configuration and relaunched the tunnel. |
| SHA256 | 15c2d007954ac53ba69b80ec91242786b3c0b71d52649165b4ca1d5cc96ef8f1 | Hash of the Xray-core binary renamed and used as the malicious tunnel. |
| SHA256 | 42a9da894a51ce0cce4aac2925e73097989fa02d5af1ea428fc61aa45f6e0088 | Hash of dist.exe, identified as the SMB distributor used in the ransomware impact stage. |
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe article reports RDP among the protocols used for noisy lateral movement.T1021.002 · SMB/Windows Admin SharesAffected workstations made roughly 10,000 outbound connections each via SMB during lateral movement.T1021.006 · Windows Remote ManagementThe C2 tunnel carried WinRM sessions during lateral movement.T1036.005 · Match Legitimate Resource Name or LocationThe attacker renamed Xray-core binaries ChromeUpdate.exe and ConnectivityHost.exe to resemble legitimate software.T1053.005 · Scheduled TaskScheduled Tasks launched the Xray binaries directly and were also added through a modified drive-mapping GPO.T1059.001 · PowerShellThe Run value executed updater.ps1, a PowerShell script used to relaunch the tunnel.T1070.001 · Clear Windows Event LogsThe attacker cleared hundreds of log channels across multiple systems and checked the results with wevtutil qe.T1070.006 · TimestompThe attacker set the created, modified, and accessed timestamps of the tunnel binaries to the same value.T1098 · Account ManipulationThe attacker attempted to add an account to Domain Admins and to reset a high-value account password; the reported attempts were unsuccessful.T1486 · Data Encrypted for ImpactThe locker encrypted files in place without appending a file extension.T1490 · Inhibit System RecoveryBefore encryption, the attacker ran vssadmin commands to delete shadow copies and resize shadow storage.T1547.001 · Registry Run Keys / Startup FolderA Run value launched updater.ps1 to relaunch the tunnel.T1562.001 · Disable or Modify ToolsBefore ransomware execution, the attacker disabled Windows Defender tamper protection, real-time monitoring, script scanning, cloud sample submission, and block-at-first-seen.T1566.004 · Spearphishing VoiceInitial access followed email bombing with a phone call from someone posing as the IT Helpdesk.T1572 · Protocol TunnelingAur0ra used Xray-core as a reverse tunnel for C2 and carried WinRM sessions through the tunnel.