Intelligence Insights: April 2024

SocGholish soars and we greet Grandoreiro in this month’s edition of Intelligence Insights.

Each month, the Intel team provides Red Canary customers with an analysis of trending, emerging, or otherwise important threats that we’ve encountered in confirmed threat detections, intelligence reporting, and elsewhere over the preceding month. We call this report our “Intelligence Insights” and share a public version of it with the broader infosec community.

Highlights

To track pervasiveness over time, we identify the number of unique customer environments in which we observed a given threat and compare it to what we’ve seen in previous months. 

Here’s how the numbers shook out for March 2024:

⬆ = trending up from previous month ⬇= trending down from previous month ➡ = no change in rank from previous month

*Denotes a tie

Observations on trending threats

SocGholish moved to the top spot on this month’s most prevalent threat list, the first time it’s reached number 1 since February 2023. Many of the top threats were present on last month’s list, but not all of this month’s threats are carryovers. For instance, Danabot saw a wave of activity that landed it in a three way tie for 4th, the first time the trojan has made the list since September 2023. AsyncRAT, Atomic Stealer, and PlugX all dropped to share a tie for 10th alongside More_eggs, which hasn’t appeared in the top 10 since its debut in August 2023. Also in a tie for 10th is the Grandoreiro banking trojan, another newcomer to the list that you can read more about below.

Hola, Grandoreiro

Grandoreiro is part of a family of banking trojans that primarily targets users in Latin America and Spanish-speaking countries. Grandoreiro malware has been active since at least 2016, and we’ve been tracking it since we first saw it in customer environments in November 2022. Like the other trojans in this malware family, it is written in Delphi and utilizes techniques to evade sandbox analysis.

Grandoreiro is typically distributed via phishing emails containing links that download malicious ZIP files, often with government or financial themes. In one example we observed, the malicious ZIP file presented itself as INFONAVIT-related legal action—INFONAVIT, the Instituto del Fondo Nacional de la Vivienda para los Trabajadores, is the largest mortgage lender in Latin America.

The ZIP contained a malicious binary that initiated outbound network communications and installed follow-on executables. One of those executables, installed in C:\ProgramData, frequently had a filename like ypkwfDriverDetectMastertvDriverRepairPro.exe as seen in this similar sample. The driver-themed executable proceeded to make external network connections, write additional files to disk, and leverage PowerShell to establish persistence via registry run keys.

Interpol recently announced a successful takedown initiative against Grandoreiro operators in early 2024, but given the many variants in the malware family, activity will likely continue.

Holding down the Fortinet vulnerability

On April 8, Red Canary published a blog post sharing details of Fortinet FortiClient EMS vulnerability exploitation that we observed in late March 2024. We detected adversaries exploiting CVE-2023-48788 in order to install unauthorized remote monitoring and management (RMM) tools and PowerShell backdoors on target systems. This activity followed a pattern, beginning with inbound external network connections to the FCMdaemon process and ending with attempts to download and execute RMM tools or PowerShell-based backdoors.

Adversaries like to abuse RMM tools to remotely execute a wide variety of actions on a victim’s endpoint. Since organizations use RMM tools in regular business operations, adversaries can attempt to evade detection for as long as possible by maintaining a veneer of legitimacy.

Updating vulnerable Forticlient EMS installations is the most expedient way to remediate exploitation risk. For organizations that are unable to immediately patch CVE-2023-48788, the post-exploitation activity we’ve observed is detectable via process lineage, network connections, and the presence of unauthorized RMM tools. One example of detectable post-exploitation activity we saw involved PowerShell processes spawning via cmd.exe with sqlservr.exe as a parent process. These PowerShell processes made outbound network connections to unknown IP addresses or domains to download additional tools, which gives us a detection opportunity.

Detection opportunity: PowerShell spawned by suspicious parent processes and making outbound network communications

This pseudo detection analytic identifies PowerShell processes with suspicious process lineage, similar to activity observed following CVE-2023-48788 exploitation. This logic would detect cmd.exe spawning with sqlservr.exe as the parent process and PowerShell as the child process, an atypical combination.

parent_process == (sqlservr.exe)

&&

process == (cmd.exe)

&&

child_process == (powershell.exe)

&&

has_network_connection

Note: This detector may require tuning depending on your environment.

Additionally, organizations should consider how they can mitigate and detect the use of unauthorized RMM tools and backdoors. Application controls like allowlisting and blocklisting are the best way to ensure that adversaries aren’t able to use unauthorized RMM tools in your environment. To learn more about the CVE-2023-48788 exploitation we observed, and for additional detection and mitigation opportunities, see our blog post.

The 2024 Threat Detection Report is here!

You've read about the top threats of the last month, how about for the entire year? The 2024 Threat Detection Report provides in-depth analysis and actionable guidance.