Intelligence Insights: December 2023

SocGholish, XMRig, and Cobalt Strike make their way up the chimney in this month’s edition of Intelligence Insights

Each month, the Intel team provides Red Canary customers with an analysis of trending, emerging, or otherwise important threats that we’ve encountered in confirmed threat detections, intelligence reporting, and elsewhere over the preceding month. We call this report our “Intelligence Insights” and share a public version of it with the broader infosec community.

Highlights

To track pervasiveness over time, we identify the number of unique customer environments in which we observed a given threat and compare it to what we’ve seen in previous months. 

Here’s how the numbers shook out for November 2023:

⬆ = trending up from previous month ⬇= trending down from previous month ➡ = no change in rank from previous month

*Denotes a tie

Observations on trending threats

Our top 10 threats this month ended up being a top 16, with an atypical 7-way tie for 9th place. SocGholish was more active this month, moving up to 3rd after placing just off the list at no. 11 last month. This is the highest SocGholish has been in the top 10 since April 2023. Cobalt Strike also saw an increase in activity that landed it in a 4-way tie for the 5th spot. Major U.S. holidays are often an active time for adversaries, and we saw a jump in both attempted Cobalt Strike use and BloodHound use during the week of Thanksgiving this year.

The reindeer games are XMRigged

One of our 9th place ties is XMRig, a Monero cryptocurrency miner, making its first appearance in our top 10. We typically see a few instances of XMRig every month, and saw enough in November for it to squeak into the top 10 list. XMRig by itself is a fairly benign open source miner available on GitHub. While, like all cryptominers, it uses system resources for its mining activity, it does not contain any additional malicious code.

Sometimes deploying XMRig is the adversary’s primary goal, but frequently XMRig is deployed as a secondary payload in an attempt to monetize threat actors’ access to victim systems. In November 2023 alone, researchers reported campaigns deploying XMRig alongside other malware families like Rhadamanthys and Cobalt Strike.

Here at Red Canary we saw XMRig delivered multiple ways last month. One example was very similar to activity reported by the DFIR Report in 2022. We assess the adversary likely brute forced access to a public-facing MySQL server then uploaded malicious DLLs and a custom loadable function to execute the DLLs. The adversary wrote a number of additional files to disk, including a renamed instance of cscript.exe, the XMRig binary, and additional scripts used to install and execute XMRig. They also created a scheduled task for persistence.

Detecting XMRig depends on how it is delivered. In the above example we saw at Red Canary, unusual cscript.exe activity gives us a detection opportunity.

Detection opportunity: Windows Script Host wscript.exe or cscript.exe making network connections to a suspicious top-level domain (TLD)

The following pseudo-detection analytic identifies wscript.exe or cscript.exe making network connections to a suspicious top-level domain (TLD). Malicious scripts, like those used in the example above to install XMRig, may connect to infrastructure hosted on unusual TLDs. This is atypical behavior, although custom admin scripts may reach out to personal domains. The analytic below leverages a custom-made suspicious domain list, based on observations and research on abused TLDs shared by teams like Unit 42.

process == (wscript, cscript)

&&

has_netconn

&&

command_includes (domain strings matching *suspicious_tlds)

Note: You can create a list of suspicious TLDs to reference in *suspicious_tlds based on in-house observations and industry research. The Red Canary list includes: .date, .cf, .ga, .casa, .cyou, among others.

The 2023 Threat Detection Report

You've read the insights for the month, now read them for the entire year! Check out the top 10 threats of 2022 and more.