On July 25, 2024, the United States Division of Justice (DOJ) indicted a person linked to the North Korean menace actor that Microsoft tracks as Onyx Sleet. Microsoft Menace Intelligence collaborated with the Federal Bureau of Investigation (FBI) in monitoring exercise related to Onyx Sleet. We are going to proceed to intently monitor Onyx Sleet’s exercise to evaluate adjustments following the indictment.
First noticed by Microsoft in 2014, Onyx Sleet has carried out cyber espionage by quite a few campaigns aimed toward international targets with the objective of intelligence gathering. Extra not too long ago, it has expanded its targets to incorporate monetary acquire. This menace actor operates with an intensive set of customized instruments and malware, and often evolves its toolset so as to add new performance and to evade detection, whereas maintaining a reasonably uniform assault sample. Onyx Sleet’s capacity to develop a spectrum of instruments to launch its tried-and-true assault chain makes it a persistent menace, significantly to targets of curiosity to North Korean intelligence, like organizations within the protection, engineering, and vitality sectors.
Microsoft tracks campaigns associated to Onyx Sleet and straight notifies clients who’ve been focused or compromised, offering them with the required data to assist safe their environments. On this weblog, we’ll share intelligence about Onyx Sleet and its historic tradecraft and targets, in addition to our evaluation of latest malware campaigns, with the objective of enabling the broader neighborhood to determine and reply to comparable campaigns. We additionally present safety, detection, and searching steerage to assist enhance defenses towards these assaults.
Who’s Onyx Sleet?
Onyx Sleet conducts cyber espionage primarily focusing on navy, protection, and expertise industries, predominately in India, South Korea, and america. This menace actor has traditionally leveraged spear-phishing as a way of compromising goal environments; nevertheless, in latest campaigns, they’ve principally exploited N-day vulnerabilities, leveraging publicly out there and customized exploits to realize preliminary entry. In October 2023, Onyx Sleet exploited the TeamCity CVE-2023-42793 vulnerability as part of a focused assault. Exploiting this vulnerability enabled the menace actor to carry out a distant code execution assault and acquire administrative management of the server.
Onyx Sleet develops and makes use of a spectrum of instruments that vary from customized to open supply. They’ve constructed an intensive set of customized distant entry trojans (RATs) that they use in campaigns, and routinely developed new variants of those RATs so as to add new performance and implement new methods of evading detection. Onyx Sleet typically makes use of leased digital personal servers (VPS) and compromised cloud infrastructure for command-and-control (C2).
Onyx Sleet is tracked by different safety firms as SILENT CHOLLIMA, Andariel, DarkSeoul, Stonefly, and TDrop2.
Affiliations with different menace actors originating from North Korea
Onyx Sleet has demonstrated affiliations with different North Korean actors, indicating its integration with a broader community of North Korean cyber operations. Microsoft has noticed an overlap between Onyx Sleet and Storm-0530. Each teams have been noticed working inside the similar infrastructure and have been concerned within the improvement and use of ransomware in assaults in late 2021 and 2022.
Onyx Sleet targets
In pursuit of its main objective of intelligence assortment, Onyx Sleet has targeted on focusing on entities within the protection and vitality industries, predominately in India, South Korea, and america. Current assaults embody the focusing on of South Korean academic establishments, building firms, and manufacturing organizations in Could 2024. Onyx Sleet has additionally proven curiosity in making the most of on-line playing web sites, probably for monetary acquire both on behalf of North Korea or for particular person members of the group.
Onyx Sleet tradecraft
Onyx Sleet has used the identical ways, strategies, and procedures (TTPs) over prolonged durations, suggesting the menace actor views its tradecraft as efficient. Onyx Sleet traditionally leveraged spear-phishing to compromise targets, and in newer campaigns, they’ve been noticed to primarily use exploits for preliminary entry, alongside a loader, downloader, and backdoor as part of its well-established assault chain.
Onyx Sleet however made some adjustments, for instance, including new C2 servers and internet hosting IPs, creating new malware, and launching a number of campaigns over time. Up to now, Onyx Sleet launched customized ransomware strains as part of its campaigns. It additionally created and deployed the RAT recognized by Kaspersky as Dtrack, which was noticed in international assaults from September 2019 to January 2024. The Dtrack RAT follows the frequent assault chain utilized by Onyx Sleet and consists of the exploitation of the Log4j 2 CVE-2021-44228 vulnerability for preliminary entry and using payloads signed with an invalid certificates masquerading as official software program to evade detection.
One other instance of Onyx Sleet introducing variations within the implementation of its assault chain is the marketing campaign recognized by AhnLab Safety Intelligence Heart (ASEC) in Could 2024. On this marketing campaign, the menace actor employed a beforehand unseen malware household dubbed as Dora RAT. Developed within the Go programming language, this practice malware pressure focused South Korean academic establishments, building firms, and manufacturing organizations.
Onyx Sleet avoids frequent detection strategies throughout its assault lifecycle by closely utilizing customized encryption and obfuscation algorithms and launching as a lot of its code in reminiscence as attainable. These instruments and strategies have been noticed in a number of reported campaigns, together with TDrop2.
Onyx Sleet has additionally used a number of off-the shelf instruments, together with Sliver, distant monitoring and administration (RMM) instruments SOCKS proxy instruments, Ngrok, and masscan. We have now additionally noticed Onyx Sleet utilizing industrial packers like Themida and VMProtect to obfuscate their malware. In January 2024, Microsoft Menace Intelligence recognized a marketing campaign attributed to Onyx Sleet that deployed a Sliver implant, an open-source C2 framework that helps a number of operators, listener varieties, and payload era. Just like the Dtrack RAT, this malware was signed with an invalid certificates impersonating Tableau software program. Additional evaluation revealed that this Onyx Sleet marketing campaign compromised a number of aerospace and protection organizations from October 2023 to June 2024.
Aside from the beforehand talked about Log4j 2 vulnerability, Onyx Sleet has exploited different publicly disclosed (N-day) vulnerabilities to realize entry to focus on environments. Some vulnerabilities not too long ago exploited by Onyx Sleet embody:
- CVE-2023-46604 (Apache ActiveMQ)
- CVE-2023-22515 (Confluence)
- CVE-2023-27350 (PaperCut)
- CVE-2023-42793 (TeamCity)
Along with these well-known and disclosed vulnerabilities, Onyx Sleet has used customized exploit capabilities in campaigns focusing on customers principally in South Korea. In these campaigns, Onyx Sleet exploited vulnerabilities in a distant desktop/administration utility, an information loss prevention utility, a community entry management system, and an endpoint detection and response (EDR) product.
Current malware campaigns
In December 2023, South Korean authorities attributed assaults that stole over 1.2 TB of knowledge from focused South Korean protection contractors utilizing customized malware to Andariel. Microsoft has attributed a number of customized malware households used within the stated assaults – TigerRAT, SmallTiger, LightHand, and ValidAlpha – to Onyx Sleet.
TigerRAT
Since 2020, Onyx Sleet has been noticed utilizing the customized RAT malware TigerRAT. In some campaigns utilizing TigerRAT, Onyx Sleet exploited vulnerabilities in Log4j 2 to ship and set up the malware. When launched, this malware can steal confidential data and perform instructions, akin to keylogging and display recording, from the C2.
SmallTiger
In February 2024, ASEC recognized SmallTiger, a brand new malware pressure focusing on South Korean protection and manufacturing organizations. Throughout the means of lateral motion, this malware is delivered as a DLL file (SmallTiger[.]dll) and makes use of a C2 connection to obtain and launch the payload into reminiscence. Microsoft researchers have decided that SmallTiger is a C++ backdoor with layered obfuscation, encountered within the wild as a Themida or VMProtect packed executable.
The SmallTiger marketing campaign will be tied again to a marketing campaign utilizing the same assault chain starting in November 2023 that delivered the DurianBeacon RAT malware. In Could 2024, Microsoft noticed Onyx Sleet persevering with to conduct assaults focusing on South Korean protection organizations utilizing SmallTiger.
LightHand
LightHand is a customized, light-weight backdoor utilized by Onyx Sleet for distant entry of goal units. Through LightHand, Onyx Sleet can execute arbitrary instructions by command shell (cmd.exe), get system storage data, carry out listing itemizing, and create/delete recordsdata on the goal machine.
ValidAlpha (BlackRAT)
ValidAlpha (often known as BlackRAT) is a customized backdoor developed within the Go programming language and utilized by Onyx Sleet to focus on organizations globally within the vitality, protection, and engineering sectors since a minimum of 2023. ValidAlpha can run an arbitrary file, listing contents of a listing, obtain a file, take screenshots, and launch a shell to execute arbitrary instructions.
Samples of ValidAlpha analyzed by Microsoft had a singular PDB string: I:/01___Tools/02__RAT/Black/Client_Go/Shopper.go
Suggestions
Microsoft recommends the next mitigations to defend towards assaults by Onyx Sleet:
- Maintain software program updated. Apply new safety patches as quickly as attainable.
- Activate cloud-delivered safety in Microsoft Defender Antivirus, or the equal on your antivirus product, to assist cowl quickly evolving attacker instruments and strategies. Cloud-based machine studying protections block a majority of recent and unknown variants.
- Allow community safety to assist stop entry to malicious domains.
- Run endpoint detection and response (EDR) in block mode in order that Microsoft Defender for Endpoint may also help block malicious artifacts, even when your non-Microsoft antivirus doesn’t detect the menace or when Microsoft Defender Antivirus is working in passive mode. EDR in block mode works behind the scenes to assist remediate malicious artifacts which are detected post-breach.
- Configure investigation and remediation in full automated mode to permit Microsoft Defender for Endpoint to take fast motion on alerts to assist resolve breaches, considerably lowering alert quantity
Microsoft Defender clients can activate assault floor discount guidelines to assist stop frequent assault strategies utilized by Onyx Sleet:
Detection particulars
Microsoft Defender Antivirus
Microsoft Defender Antivirus detects menace parts as the next malware households:
Microsoft Defender for Endpoint
The next Microsoft Defender for Endpoint alerts can point out related menace exercise:
- Onyx Sleet exercise group
The next alerts may additionally point out menace exercise associated to this menace. Word, nevertheless, that these alerts will be additionally triggered by unrelated menace exercise:
- Doc accommodates macro to obtain a file
Microsoft Defender Vulnerability Administration
Microsoft Defender Vulnerability Administration surfaces units which may be affected by the next vulnerabilities used on this menace:
Microsoft Defender Menace Intelligence
Microsoft clients can use the next studies in Microsoft merchandise to get essentially the most up-to-date details about the menace actor, malicious exercise, and strategies mentioned on this weblog. These studies present the intelligence, safety data, and advisable actions to stop, mitigate, or reply to related threats present in buyer environments.
Microsoft Sentinel queries
Microsoft Sentinel clients can use the TI Mapping analytics (a sequence of analytics all prefixed with ‘TI map’) to mechanically match the malicious area indicators talked about on this weblog put up with knowledge of their workspace. If the TI Map analytics are usually not at present deployed, clients can set up the Menace Intelligence answer from the Microsoft Sentinel Content material Hub to have the analytics rule deployed of their Sentinel workspace.
Use this question to evaluate the existence of vulnerabilities utilized by Onyx Sleet:
DeviceTvmSoftwareVulnerabilities
| the place CveId in ("CVE-2021-44228","CVE-2023-27350","CVE-2023-42793")
| undertaking DeviceId,DeviceName,OSPlatform,OSVersion,SoftwareVendor,SoftwareName,SoftwareVersion,
CveId,VulnerabilitySeverityLevel
| be part of form=inside ( DeviceTvmSoftwareVulnerabilitiesKB | undertaking CveId, CvssScore,IsExploitAvailable,VulnerabilitySeverityLevel,PublishedDate,VulnerabilityDescription,AffectedSoftware ) on CveId
| undertaking DeviceId,DeviceName,OSPlatform,OSVersion,SoftwareVendor,SoftwareName,SoftwareVersion,
CveId,VulnerabilitySeverityLevel,CvssScore,IsExploitAvailable,PublishedDate,VulnerabilityDescription,AffectedSoftware
Use this question to detect related community IOCs:
let remoteip = dynamic(["84.38.134.56","45.155.37.101","213.139.205.151","109.248.150.147","162.19.71.175","147.78.149.201"]);
let remoteurl = dynamic(["americajobmail.site","privatemake.bounceme.net","ww3c.bounceme.net","advice.uphearth.com","http://84.38.134.56/procdump.gif"]);
DeviceNetworkEvents
| the place RemoteIP == remoteip or RemoteUrl == remoteurl
| undertaking TimeGenerated, DeviceId, DeviceName, Protocol, LocalIP, LocalIPType, LocalPort,RemoteIP, RemoteIPType, RemotePort, RemoteUrl
Use this question to detect related file IOCs:
let selectedTimestamp = datetime(2024-07-17T00:00:00.0000000Z);
let fileName = "SmallTiger.dll";
let FileSHA256 = dynamic(["f32f6b229913d68daad937cc72a57aa45291a9d623109ed48938815aa7b6005c","0837dd54268c373069fc5c1628c6e3d75eb99c3b3efc94c45b73e2cf9a6f3207 ","29c6044d65af0073424ccc01abcb8411cbdc52720cac957a3012773c4380bab3","fed94f461145681dc9347b382497a72542424c64b6ae6fcf945f4becd2d46c32","868a62feff8b46466e9d63b83135a7987bf6d332c13739aa11b747b3e2ad4bbf","f1662bee722a4e25614ed30933b0ced17b752d99fae868fbb326a46afa2282d5","1b88b939e5ec186b2d19aec8f17792d493d74dd6ab3d5a6ddc42bfe78b01aff1","3098e6e7ae23b3b8637677da7bfc0ba720e557e6df71fa54a8ef1579b6746061","8daa6b20caf4bf384cc7912a73f243ce6e2f07a5cb3b3e95303db931c3fe339f","7339cfa5a67f5a4261c18839ef971d7f96eaf60a46190cab590b439c71c4742b"]);
let SignerName = "INVALID:Tableau Software program Inc.";
let Signerhash = "6624c7b8faac176d1c1cb10b03e7ee58a4853f91";
let certificateserialnumber = "76cb5d1e6c2b6895428115705d9ac765";
search in (AlertEvidence,BehaviorEntities,CommonSecurityLog,DeviceBaselineComplianceProfiles,DeviceEvents,DeviceFileEvents,DeviceImageLoadEvents,
DeviceLogonEvents,DeviceNetworkEvents,DeviceProcessEvents,DeviceRegistryEvents,DeviceFileCertificateInfo,DynamicEventCollection,EmailAttachmentInfo,OfficeActivity,SecurityEvent,ThreatIntelligenceIndicator)
TimeGenerated between ((selectedTimestamp - 1m) .. (selectedTimestamp + 90d)) // from July seventeenth runs the search backwards for 90 days, change the above date accordingly.
and
( FileName == fileName or OldFileName == fileName or ProfileName == fileName or InitiatingProcessFileName == fileName or InitiatingProcessParentFileName == fileName
or InitiatingProcessVersionInfoInternalFileName == fileName or InitiatingProcessVersionInfoOriginalFileName == fileName or PreviousFileName == fileName
or ProcessVersionInfoInternalFileName == fileName or ProcessVersionInfoOriginalFileName == fileName or DestinationFileName == fileName or SourceFileName == fileName
or ServiceFileName == fileName or SHA256 in (FileSHA256) or InitiatingProcessSHA256 in (FileSHA256) or Signer == SignerName or SignerHash == Signerhash or CertificateSerialNumber == certificateserialnumber )
Indicators of compromise
IP addresses
- 84.38.134[.]56
- 45.155.37[.]101
- 213.139.205[.]151
- 109.248.150[.]147
- 162.19.71[.]175
- 147.78.149[.]201
URL
- hxxp://84.38.134[.]56/procdump.gif
Actor-controlled area
- americajobmail[.]web site
- privatemake.bounceme[.]web
- ww3c.bounceme[.]web
- recommendation.uphearth[.]com
SHA-256
- TigerRAT
- f32f6b229913d68daad937cc72a57aa45291a9d623109ed48938815aa7b6005c
- 0837dd54268c373069fc5c1628c6e3d75eb99c3b3efc94c45b73e2cf9a6f3207
- 29c6044d65af0073424ccc01abcb8411cbdc52720cac957a3012773c4380bab3
- fed94f461145681dc9347b382497a72542424c64b6ae6fcf945f4becd2d46c32
- 868a62feff8b46466e9d63b83135a7987bf6d332c13739aa11b747b3e2ad4bbf
- LightHand
- f1662bee722a4e25614ed30933b0ced17b752d99fae868fbb326a46afa2282d5
- 1b88b939e5ec186b2d19aec8f17792d493d74dd6ab3d5a6ddc42bfe78b01aff1
- 3098e6e7ae23b3b8637677da7bfc0ba720e557e6df71fa54a8ef1579b6746061
- 8daa6b20caf4bf384cc7912a73f243ce6e2f07a5cb3b3e95303db931c3fe339f
- 7339cfa5a67f5a4261c18839ef971d7f96eaf60a46190cab590b439c71c4742b
- ValidAlpha
- c2500a6e12f22b16e221ba01952b69c92278cd05632283d8b84c55c916efe27c
- c1a09024504a5ec422cbea68e17dffc46472d3c2d73f83aa0741a89528a45cd1
Pretend Tableau certificates
- Signer: INVALID:Tableau Software program Inc.
- SignerHash: 6624c7b8faac176d1c1cb10b03e7ee58a4853f91
- CertificateSerialNumber: 76cb5d1e6c2b6895428115705d9ac765
References
Study extra
For the newest safety analysis from the Microsoft Menace Intelligence neighborhood, try the Microsoft Menace Intelligence Weblog: https://aka.ms/threatintelblog.
To get notified about new publications and to affix discussions on social media, observe us on LinkedIn at https://www.linkedin.com/showcase/microsoft-threat-intelligence, and on X (previously Twitter) at https://twitter.com/MsftSecIntel.
To listen to tales and insights from the Microsoft Menace Intelligence neighborhood in regards to the ever-evolving menace panorama, take heed to the Microsoft Menace Intelligence podcast: https://thecyberwire.com/podcasts/microsoft-threat-intelligence.