Intelligence Insights: January 2025

DarkGate returns and Tangerine Turkey peels off of USBs in this month’s edition of Intelligence Insights

Highlights from December

Paste and run remains an extremely popular initial access technique—if we tracked paste and run as a threat instead of a technique, it would be number 1 on our top 10 most prevalent threat list for the third month running. In December we observed multiple adversaries using it to deliver several different payloads including Vidar, LummaC2, and NetSupport Manager. Most of the activity we saw from LummaC2 and Vidar occurred prior to payload execution, what we consider precursor activity. Had the payloads not been detected and remediated, then LummaC2 would have toppled ChromeLoader from 1st place and Vidar would be in the top 10 for the month.

That said, ChromeLoader did maintain first place, making this its 7th consecutive month in the top spot. Following a trend we noted last month, the overall volume of ChromeLoader we observe continues to decline. In 2nd we have Amber Albatross, which made a big jump from tying for 6th place in November.

DarkGate returned to the list for the first time since October 2023. In December, DarkGate emerged as a follow-on payload for adversaries leveraging remote monitoring and management (RMM) tools like AnyDesk, TeamViewer, and ConnectWise following successful social engineering tactics used to gain initial access. This kind of activity was also observed outside of Red Canary.

Making its debut is Tangerine Turkey, sharing in a tie for 8th. Tangerine Turkey is Red Canary’s name for a VBS worm delivering a cryptomining payload that we started observing in November 2024. You can read more about Tangerine Turkey below and in this blog.

This month’s top 10 threats

To track pervasiveness over time, we identify the number of unique customer environments in which we observed a given threat and compare it to what we’ve seen in previous months.

Here’s how the numbers shook out for December 2024:

⬆ = trending up from previous month ⬇= trending down from previous month ➡ = no change in rank from previous month

*Denotes a tie

Meet Tangerine Turkey

Tangerine Turkey is a newcomer to our top 10 list. We first observed it and started tracking it in November 2024, with enough activity in December for it to make the list and this month’s Intelligence Insights. Tangerine Turkey is Red Canary’s name for a visual basic script (VBS) worm that delivers a cryptomining payload.

Here is a quick rundown of some of Tangerine Turkey’s behaviors after it starts executing on a system:

• A VBS file executed from a folder named rootdir on a USB; the filename begins with an x followed by six random digits, for example: WScript.exe 'D:\rootdir\x644291.vbs'
• A BAT file with similar naming convention to the VBS file, executed via a CMD child process from wscript, for example: cmd.exe /c 'D:\rootdir\x138621.bat'
• Creation of a folder named C:\Windows \System32 (note the trailing space after \Windows \)
• Use of xcopy to move a copy of the legitimate printui.exe binary from the legitimate C:\Windows\System32 to the newly created malicious C:\Windows \System32 directory
• DAT and printui.dll files created in C:\Windows \System32 to be used for DLL side-loading

That is as far in the execution chain as we have directly observed, but see our blog for more details on this activity cluster and its TTPs.

We were first alerted to Tangerine Turkey’s activity due to their use of printui.exe in a suspicious location, which gives us a detection opportunity.

Detection opportunity: printui.exe relocated to a suspicious location

This pseudo detection analytic identifies instances of printui.exe relocated outside of Windows\System32. Relocation of this binary outside of System32 will be highly unusual, although third-party system administrative binaries may occasionally utilize a relocated and/or renamed version of the binary. Vulnerable DLLs like printui.dll can be abused by threats like Tangerine Turkey for DLL search order hijacking and side-loading. Here at Red Canary we have profiled System32 binaries, collected and stored their expected metadata, and used the information to build detection analytics. We published a blog sharing how you can do the same.

process_path_is_unexpected == (printui)

* See this blog for more details on how to create these types of detection analytics

Threat Detection Report midyear update

You've read about the top threats of the last month, how about for the last six months? Our midyear update to the Threat Detection Report provides in-depth analysis and actionable guidance.