MCAD Maritime Cyber Attack Database
Year2014 |
Month |
Reference number20140001 |
Impact areaShore |
Incident location |
Incident country |
Victim countryUSA |
Victim identityU.S. Engineering & Maritime industry |
Victim TypeVarious |
MethodMalware |
Attacker countryChina |
From the year 2014 to 2018, the U.S. Engineering & Maritime industry got hit by malware attack orchestrated by Leviathan, TEMP.Periscope (China) in order to steal data for strategic use. The attackers used tools like backdoors, reconnaissance tools, file stealers, and web shells. The first of the backdoors is Airbreak, a JavaScript-based tool that retrieves commands from hidden strings in compromised webpages and actor controlled profiles on legitimate services. A second backdoor is Badflick, which can modify the file system, generate a reverse shell, and modify its command and control (C&C) configuration. Another similar piece of malware is Photo, a DLL backdoor that gets directory, file, and drive listing; creates a reverse shell; records the screen, video, and audio; lists, terminates, and creates processes; creates and modifies registry keys and values; logs keystrokes, returns usernames and passwords from protected storage; and can read, create, and modify files. The group also used Homefry, a 64-bit Windows password dumper/cracker previously used along with the first two backdoors. Based on received commands, it can either display cleartext credentials for each login session, or can display cleartext credentials, NTLM hashes, and malware version for each login session. Other tools employed by the hackers include Lunchmoney (which can exfiltrate files to Dropbox) and Murkytop, a command-line reconnaissance tool (which can execute files; move and delete files; schedule remote AT jobs; perform host discovery; scan for open ports in a connected network; and retrieve information about the operating system, users, groups, and shares on remote hosts). In recent attacks, the group was also observed employing the China Chopper code injection web shell capable of executing Microsoft .NET code within HTTP POST commands (thus, it can upload and download files, execute applications, list directory contents, access Active Directory, access databases, and more). Previously, the group used the Beacon backdoor (commercially available as part of the Cobalt Strike software platform), and the Blackcoffee backdoor that hides C&C communication as traffic to legitimate websites such as GitHub and Microsoft's TechNet portal. The group has been also observed using spear phishing emails; lure documents attempting to exploit CVE-2017-11882 to drop malware; stolen code signing certificates to sign their malware; bitsadmin.exe and PowerShell to download additional tools; and Windows Management Instrumentation (WMI) and Windows Shortcut files (.lnk) for persistence. The actor sometimes utilizes access at one compromised organization to attack the next. For example, compromised email accounts at one organization were used to send the next wave of malicious attachments to potential victims in the same industry. Similarly the actor attempts to compromise servers within victim organizations and use them for command and control (C&C) for their malware.
