{"id":91604,"date":"2020-09-24T12:00:38","date_gmt":"2020-09-24T19:00:38","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/?p=91604"},"modified":"2023-05-15T23:06:09","modified_gmt":"2023-05-16T06:06:09","slug":"gadolinium-detecting-empires-cloud","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/09\/24\/gadolinium-detecting-empires-cloud\/","title":{"rendered":"Microsoft Security\u2014detecting empires in the cloud"},"content":{"rendered":"

Microsoft consistently tracks the most advanced threat actors and evolving attack techniques. We use these findings to harden our products and platform and share them with the security community to help defenders everywhere better protect the planet.<\/p>\n

Recently, the Microsoft Threat Intelligence Center (MSTIC) observed the evolution of attacker techniques by an actor we call GADOLINIUM using cloud services and open source tools to enhance weaponization of their malware payload, attempt to gain command and control all the way to the server, and to obfuscate detection. These attacks were delivered via spear-phishing emails with malicious attachments and detected and blocked by Microsoft Defender, formerly Microsoft Threat Protection (MTP), and able to be detected using Azure Sentinel.<\/p>\n

As these attacks were detected, Microsoft took proactive steps to prevent attackers from using our cloud infrastructure to execute their attacks and suspended 18 Azure Active Directory applications that we determined to be part of their malicious command & control infrastructure. This action helped transparently protect our customers without requiring additional work on their end.<\/p>\n

GADOLINIUM is a nation-state activity group that has been compromising targets for nearly a decade with a worldwide focus on the maritime and health industries. As with most threat groups, GADOLINIUM tracks the tools and techniques of security practitioners looking for new techniques they can use or modify to create new exploit methods.<\/p>\n

Recently, MSTIC has observed newly expanded targeting outside of those sectors to include the Asia Pacific region and other targets in higher education and regional government organizations. As GADOLINIUM has evolved, MSTIC has continued to monitor its activity and work alongside our product security teams to implement customer protections against these attacks.<\/p>\n

Historically, GADOLINIUM used custom-crafted malware families that analysts can identify and defend against. In response, over the last year GADOLINIUM has begun to modify portions of its toolchain to use open-source toolkits to obfuscate their activity and make it more difficult for analysts to track. Because cloud services frequently offer a free trial or one-time payment (PayGo) account offerings, malicious actors have found ways to take advantage of these legitimate business offerings. By establishing free or PayGo accounts, they can use cloud-based technology to create a malicious infrastructure that can be established quickly then taken down before detection or given up at little cost.<\/p>\n

The following GADOLINIUM technique profile is designed to give security practitioners who may be targeted by this specific actor\u2019s activity insight and information that will help them better protect from these attacks.<\/p>\n

2016: Experimenting in the cloud<\/h3>\n

GADOLINIUM has been experimenting with using cloud services to deliver their attacks to increase both operation speed and scale for years. The image in Figure 1 is from a GADOLINIUM controlled Microsoft TechNet profile established in 2016. This early use of a TechNet profiles\u2019 contact widget involved embedding a very small text link that contained an encoded command for malware to read.<\/p>\n

\"An<\/p>\n

Figure 1: GADOLINIUM controlled TechNet profile with embedded malware link.<\/em><\/p>\n

2018: Developing attacks in the cloud<\/h3>\n

In 2018 GADOLINIUM returned to using Cloud services, but this time it chose to use GitHub to host commands. The image in Figure 2 shows GitHub Commit history on a forked repository GADOLINIUM controlled. In this repository, the actors updated markdown text to issue new commands to victim computers. MSTIC has worked with our colleagues at GitHub to take down the actor accounts and disrupt GADOLINIUM operations on the GitHub platform.<\/p>\n

\"An<\/p>\n

Figure 2: GitHub repository controlled by GADOLINIUM.<\/em><\/p>\n

2019-2020: Hiding in plain sight using open source<\/h3>\n

GADOLINIUM\u2019s evolving techniques
\n<\/strong>Two of the most recent attack chains in 2019 and 2020 were delivered from GADOLINIUM using similar tactics and techniques. Below is a summary view of how these attacks techniques have evolved followed by a detailed analysis of each step that security practitioners can use to better understand the threat and what defenses to implement to counter the attacks.<\/p>\n

\"A<\/p>\n

Weaponization
\n<\/strong>In the last year, Microsoft has observed GADOLINIUM migrate portions of its toolchain techniques based on open source kits. GADOLINIUM is not alone in this move. MSTIC has noticed a slow trend of several nation-state activity groups migrating to open source tools in recent years. MSTIC assesses this move is an attempt to make discovery and attribution more difficult. The other added benefit to using open-source types of kits is that the development and new feature creation is done and created by someone else at no cost. However, using open source tools isn\u2019t always a silver bullet for obfuscation and blending into the noise.<\/p>\n

Delivery & Exploitation (2019)
\n<\/strong>In 2019, we discovered GADOLINIUM delivering malicious Access database files to targets. The initial malicious file was an Access 2013 database (.accde format). This dropped a fake Word document that was opened along with an Excel spreadsheet and a file called\u00a0mm.accdb.core<\/em>\u00a0which was subsequently executed. The file\u00a0mm.accdb.core<\/em>\u00a0is a VBA dropper, based on the\u00a0CactusTorch VBA module<\/a>, which loads a .NET DLL payload, sets configuration information, and then runs the payload. Defender for Office 365 detects and blocks malicious Microsoft Access database attachments in email. A redacted example of the configuration is displayed below.<\/p>\n

\"An<\/p>\n

Figure 3: VBA setting config and calling the “Run” function of the payload<\/em><\/p>\n

Command and Control (2019)
\n<\/strong>Having gained access to a victim machine the payload then uses attachments to Outlook Tasks as a mechanism for command and control (C2). It uses a GADOLINIUM-controlled OAuth access token with login.microsoftonline.com and uses it to call the Outlook Task API to check for tasks. The attacker uses attachments to Outlook tasks as a means of sending commands or .NET payloads to execute; at the victim end, the malware adds the output from executing these commands as a further attachment to the Outlook task.<\/p>\n

Interestingly, the malware had code compiled in a manner that doesn\u2019t seem to be used in the attacks we saw. In addition to the Outlook Tasks API method described above, the extra code contains two other ways of using Office365 as C2, via either the Outlook Contacts API (get and add contacts) or the OneDrive API (list directory, get and add a file).<\/p>\n

Actions on Objective (2019)
\n<\/strong>GADOLINIUM used several different payloads to achieve its exploitation or intrusion objectives including a range of PowerShell scripts to execute file commands (read\/write\/list etc.) to enable C2 or perform SMB commands (upload\/download\/delete etc.) to potentially exfiltrate data.<\/p>\n

LazyCat, one of the tools used by GADOLINIUM, includes privilege escalation and credential dumping capability to enable lateral movement across a victim network. Microsoft Defender for Endpoint detects the privilege escalation technique used:<\/p>\n

\"An<\/p>\n

LazyCat performs credential dumping through usage of the\u00a0MiniDumpWriteDump<\/em> Windows API call, also detected by Microsoft Defender for Endpoint:<\/p>\n

\"An<\/p>\n

Delivery (2020)
\n<\/strong>In mid-April 2020 GADOLINIUM actors were detected sending spear-phishing emails with malicious attachments. The filenames of these attachments were named to appeal to the target\u2019s interest in the COVID-19 pandemic. The PowerPoint file (20200423-sitrep-92-covid-19.ppt),<\/em>\u00a0when run, would drop a file,\u00a0doc1.dotm<\/em>. Similarly, to the 2019 example, Microsoft Defender for Office detects and blocks emails with these malicious PowerPoint and Word attachments.<\/p>\n

Command and Control (2020)
\n<\/strong>The malicious doc1.dotm had two payloads which run in succession.<\/p>\n