Faux Palo Alto GlobalProtect used as lure to backdoor enterprises

Risk actors goal Center Jap organizations with malware disguised because the authentic Palo Alto GlobalProtect Software that may steal information and execute distant PowerShell instructions to infiltrate inner networks additional.

Palo Alto GlobalProtect is a authentic safety resolution supplied by Palo Alto Networks that gives safe VPN entry with multi-factor authentication help. Organizations broadly use the product to make sure distant staff, contractors, and companions can securely entry personal community sources.

Utilizing Palo Alto GlobalProtect as bait reveals the attackers’ focusing on focuses on high-value company entities utilizing enterprise software program somewhat than random customers.

Enterprise VPN software program as a lure

Researchers at Pattern Micro who found this marketing campaign haven’t any perception into how the malware is delivered, however based mostly on the lure used, they imagine the assault begins with a phishing e-mail.

The sufferer executes a file named ‘setup.exe’ on their system, which deploys a file referred to as ‘GlobalProtect.exe’ together with configuration recordsdata.

At this stage, a window resembling a traditional GlobalProtect set up course of seems, however the malware quietly hundreds on the system within the background.

Upon execution, it checks for indicators of working on a sandbox earlier than executing its main code. Then, it transmits profiling details about the breached machine onto the command and management (C2) server.

As an extra evasion layer, the malware makes use of AES encryption on its strings and information packets to be exfiltrated to the C2.

The C2 handle seen by Pattern Micro used a newly registered URL containing the “sharjahconnect” string, making it seem like a authentic VPN connection portal for Sharjah-based workplaces within the United Arab Emirates.

Contemplating the marketing campaign’s focusing on scope, this selection helps the risk actors mix with regular operations and cut back crimson flags that might increase the sufferer’s suspicion.

Beacons despatched out at periodic intervals are employed to speak the malware standing with the risk actors within the post-infection section utilizing the Interactsh open-source device.

Whereas Interactsh is a authentic open-source device generally utilized by pentesters, its associated area, oast.enjoyable, has additionally been noticed in APT-level operations up to now, like in APT28 campaigns. Nevertheless, no attribution was given on this operation utilizing the Palo Alto product lure.

The instructions obtained from the command and management server are:

• time to reset: Pauses malware operations for a specified length.
• pw: Executes a PowerShell script and sends the outcome to the attacker’s server.
• pr wtime: Reads or writes a wait time to a file.
• pr create-process: Begins a brand new course of and returns the output.
• pr dnld: Downloads a file from a specified URL.
• pr upl: Uploads a file to a distant server.
• invalid command kind: Returns this message if an unrecognized or inaccurate command is encountered.

Pattern Micro notes that, whereas the attackers stay unknown, the operation seems extremely focused, utilizing customized URLs for the focused entities and freshly registered C2 domains to evade blocklists.