Microsoft released a blog post late on Thursday May 27, 2021 about a new sophisticated email-based attack from NOBELIUM, the SolarWinds threat actor, where they compromised Constant Contact to send malicious emails with a weaponized ISO file. We had not considered nor documented using an ISO file as a defense evasion method so we started looking into it after this report was published. Matt Graber was quick in putting together a PowerShell script that highlights why attackers likely choose ISO/IMG as a delivery mechanism: it evades SmartScreen because Mark-of-the-Web (MOTW) cannot be applied to non NTFS volumes. For this post, we look at the recent attack from NOBELIUM and show how to emulate these techniques with SCYTHE. We also committed an atomic test to the Atomic Red Team project.
Microsoft was quick to release an alert and then a number of follow up posts when it realized that NOBELIUM, the same threat actor behind the attacks against SolarWinds, SUNBURST, TEARDROP, and GoldMax, compromised Constant Contact:
Cyber Threat Intelligence reports can be dense and long, so here is a quick summary:
Command and Control is established via HTTPS: T1071.001&T1573
After analyzing the provided CTI from Microsoft, we organize this into a plan:
Packaging a payload in an ISO image file is interesting because when downloaded from the internet, it will bypass the Mark-of-the-Web security controls. As we like to map to MITRE ATT&CK, this technique most closely resembles T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass. We went ahead and documented this in our Community Threats GitHub under the Compound Actions folder and also committed the test to the Atomic Red Team project as it did not have any tests for T1553.005.
While compromising a third-party web service and sending email through that service will be out of scope for most Red and Purple Team engagements, we can emulate the other adversary behaviors to test attack, detect, and respond.
If you would like to test this from an automated perspective, you can download the ISO file from the VFS directory to your VFS:/shared/ISO directory and run the compound action from our Community Threats Compound Actions GitHub.
This technique and procedure brings many test cases to mind that you can easily test with the procedure we have documented in this post. For detection engineering, we have a number of hypothesis that come to mind:
After emulating the attack, you now know where you stand. For each control, determine if the adversary behavior was:
If not, the recommendations are:
Depending on your defensive stack, here are some great resources for detecting these behaviors:
Understanding adversary behaviors and recent attacks provide numerous test cases that may have not been tested in your environment. As attackers show these new behaviors, it is important to attack, detect, and respond to them. This involves testing, measuring, and training your people, process, and technology on a cyclical basis.
This Threat Thursday post discusses active research by SCYTHE and other cited third parties into an ongoing threat. The information in this post should be considered preliminary and may be updated as research continues. This information is provided “as-is” without any warranty or condition of any kind, either express or implied.
SCYTHE provides an advanced attack emulation platform for the enterprise and cybersecurity consulting market. The SCYTHE platform enables Red, Blue, and Purple teams to build and emulate real-world adversarial campaigns in a matter of minutes. Customers are in turn enabled to validate the risk posture and exposure of their business and employees and the performance of enterprise security teams and existing security solutions. Based in Arlington, VA, the company is privately held and is funded by Gula Tech Adventures, Paladin Capital, Evolution Equity, and private industry investors.