DFIR Report at Cons - Deconstructing Real-World Intrusions

DFIR Report at Cons - Deconstructing Real-World Intrusions

Speakers: Angelo Violetti (Incident Response Specialist, Swisscom & The DFIR Report); Alessandro Di Carlo (Detection and Response Product Lead, ThreatDown & The DFIR Report)

Conference: Area41

YouTube: https://www.youtube.com/watch?v=5pnI2mHIMv4

Overview

In this insightful Area41 talk, "DFIR Report at Cons - Deconstructing Real-World Intrusions," Angelo Violetti and Alessandro Di Carlo, both contributors to The DFIR Report, delve into the intricacies of actual cyberattacks. Moving beyond theoretical scenarios, the speakers present two distinct case studies, offering a granular look at the tactics, techniques, and procedures (TTPs) employed by sophisticated threat actors. Their core philosophy, "Real incidents teach better than perfect examples," underpins the entire presentation, providing attendees with practical, evidence-based lessons from the front lines of incident response.

The presentation dissects the full lifecycle of two intrusions: a North Korean advanced persistent threat (APT) campaign targeting cryptocurrency developers through elaborate social engineering, and a rapid, SEO-poisoned GoodLoader infection leading to extensive lateral movement and data exfiltration. Violetti and Di Carlo meticulously trace the attacker's journey from initial access and foothold establishment to credential harvesting, lateral movement, and ultimately, the meticulous cleanup efforts designed to erase their tracks. This deep dive is crucial for defenders, offering unparalleled insights into the evolving landscape of cyber threats and actionable intelligence for enhancing detection and response capabilities.

The significance of this talk lies in its commitment to transparency and detail, unmasking the complex behaviors of threat actors that often remain hidden in sanitized reports. By sharing real-world artifacts and observations, including the exploitation of misconfigured command and control (C2) servers and the identification of new malware families, the speakers empower incident responders, threat hunters, and security engineers with the knowledge necessary to anticipate, detect, and mitigate similar attacks. It serves as a stark reminder that even seemingly legitimate user actions can mask highly malicious intent, demanding a vigilant and informed defensive posture.

Background

▶ Watch: Introduction & DFIR Report's Real-World Incident Philosophy (0:00)

The DFIR Report, the platform central to the speakers' work, is founded on the principle that understanding real-world incidents provides the most effective learning experience for cybersecurity professionals. Rather than relying on hypothetical scenarios or controlled lab environments, their analysis stems directly from live incident response cases, collecting and dissecting artifacts left behind by actual threat actors. This approach ensures that the insights shared are immediately relevant and applicable to contemporary cyber defense challenges.

Angelo Violetti, an Incident Response Specialist at Swisscom B2B CSIRT, brings extensive experience in ransomware investigations, APT cases, business email compromises, and infrastructure hunting. Alessandro Di Carlo, the Detection and Response Product Lead at ThreatDown (powered by Malwarebytes), focuses on developing detection and response products, complementing Violetti's incident-focused expertise with a strong emphasis on proactive threat identification. Together, their combined experience forms the bedrock of the detailed analyses presented.

The talk introduces two primary narratives. The first, dubbed "Contagious Interview," exposes a cunning social engineering campaign attributed to North Korean threat actors. These groups, known for their financial motivations, particularly in the cryptocurrency space, leverage fake job interviews on platforms like LinkedIn and X (formerly Twitter) to compromise developers. The second case, "GoodLoader Returns," revisits the persistent threat of GoodLoader, a JavaScript malware family active since 2020 and tracked by Microsoft as Storm-0494. This intrusion highlights the effectiveness of SEO poisoning as an initial access vector, where legitimate-looking search results lead users to malicious downloads, setting off a rapid and impactful infection chain. Both cases underscore the importance of understanding not just the malware itself, but the broader TTPs that enable successful intrusions.

Key Findings

▶ Watch: Contagious Interview: Initial Access via GitHub Repo (4:00)

The talk presented two distinct, yet equally critical, case studies, each yielding significant findings for the cybersecurity community.

In the "Contagious Interview" scenario, the speakers unveiled a sophisticated North Korean APT campaign, likely associated with groups such as Lazarus Group, specifically targeting cryptocurrency developers. A key finding was the use of elaborate social engineering, where fake coding challenges distributed via GitHub repositories served as the initial infection vector. The attackers deployed a multi-stage toolkit, including the Otter Cookie Node.js backdoor for initial machine enumeration and C2 communication, followed by Invisible Ferret (a Python-based implant), and the Tsunami toolkit for establishing robust persistence. A crucial forensic insight was the discovery of a misconfigured C2 WebSocket, which allowed the DFIR Report team to collect statistics, revealing 13 already compromised hosts, predominantly macOS systems, with infections leading to complete disruption in under 51 minutes. The global reach of this campaign was also highlighted, with victims identified in India, the US, and France.

The "GoodLoader Returns" case brought to light a new malware family identified by the speakers as New Back On, a proxy tunneling utility. This incident underscored the threat actor's deliberate efforts to hide their actions, including extensive log deletion and removal of RDP traces. The intrusion demonstrated an incredibly rapid kill chain, with initial access leading to lateral movement within a mere 45 minutes. The infection began with SEO poisoning, directing users to sponsored websites offering fake templates (e.g., NDA, common law marriage), which then delivered a malicious zip file containing a JavaScript payload disguised as a .txt file for 7-Zip users. Once inside, the threat actors leveraged Kerberoasting to obtain privileged credentials and employed two custom proxy DLLs, Supper (a SOCKS5 backdoor proxy) and the newly discovered New Back On, to facilitate stealthy lateral movement via RDP. A pivotal defensive finding was that despite the use of proxy tunneling, Windows logs still recorded the command and control server's hostname as the source for RDP authentications, providing a crucial forensic artifact for breach detection.

Technical Deep Dive

▶ Watch: Contagious Interview: Victim Statistics & Attack Speed (16:00)

The technical exposition provided a meticulous dissection of the attack methodologies for both real-world intrusions.

Contagious Interview: North Korean APT Targeting Crypto Developers

The "Contagious Interview" attack chain commenced with highly targeted social engineering. North Korean threat actors contacted developers on platforms like LinkedIn and X, offering fake job interviews that culminated in a "coding challenge." This challenge involved directing the victim to clone a seemingly legitimate project from a GitHub repository.

Upon cloning the repository, the victim was instructed to run npm install, a standard command for Node.js projects. However, the repository contained a server config environment file with a peculiar dev API key. This key was a base64-encoded string that, upon npm install, was decoded to reveal a URL pointing to jsonkeeper.com. This URL then downloaded a payload masquerading as a fake font, which was, in reality, the initial malware.

The payload exhibited multi-operating system capabilities, checking for Node.js presence and executing fallback commands depending on whether the machine was macOS, Linux, or Windows. It then downloaded additional packages and scripts, including axios (an HTTP client) and a malicious main.js file, staging them within the /tmp temporary folder.

The execution of main.js triggered the Otter Cookie malware family, which functioned as a backdoor. Its immediate actions included extensive machine enumeration to identify the environment (e.g., checking for VMs using commands like system profiler on macOS or cat /proc/cpuinfo on Linux). This initial phase established communication with the first C2 IP address (e.g., 216.x.x.x). A critical discovery during the investigation was that the C2's WebSocket was misconfigured, allowing the DFIR Report team to observe and collect statistics on compromised hosts and attacker activity.

Following the initial backdoor, the C2 instructed the download of several additional files, constituting the main implant, likely Invisible Ferret. These included:

• p.zip: A Python runtime environment, ensuring the implant could run even if Python wasn't pre-installed.
• main six: Described as another loader.
• pay six: A versatile component used for clipboard logging and keylogging, which proved highly effective given the financial motivations.
• brown six: This component was identified as Tsunami, a comprehensive toolkit used for establishing persistence.

Tsunami leveraged various techniques for persistence, including attempting to whitelist itself in Windows Defender, dropping launch agent files or cron scripts on macOS/Linux, and installing scheduled tasks on Windows. The attackers also employed an aggressive privilege escalation tactic, bombarding users with fake User Account Control (UAC) prompts, hoping for a single "Yes" click to gain elevated permissions.

The ultimate objective was comprehensive data exfiltration, focusing on financially relevant information. This included desktop screenshots (PNG format), cryptocurrency wallet passphrases or seed phrases, and sensitive data from web browsers such as Brave, Opera, and Chrome. Throughout this process, a functional, decoy project was presented to the developer, masking the malicious activity occurring in the background. As a fallback, after approximately 30-35 minutes, an additional file named tmp.js was deployed, serving as a secondary Node.js package for keylogging and full-screen capture, ensuring data collection even if the primary C2 channel faced issues. The analysis revealed that the infection-to-disruption timeline for a machine was under 51 minutes, highlighting the speed of compromise.

GoodLoader Returns: Rapid SEO Poisoning and Proxy Tunneling

The "GoodLoader Returns" case initiated with SEO poisoning. Users searching for common document templates (e.g., "NDA template" or "common law marriage template") were directed to sponsored, malicious websites. Clicking a download button on these sites, often after providing an email address, led to the download of a malicious zip file.

The behavior of this zip file was contingent on the extraction software used:

• If extracted with WinZip, a JavaScript file was directly presented.
• If extracted with 7-Zip, the same JavaScript file was present but masqueraded as a .txt file, relying on user habit to double-click.

Execution of the JavaScript file initiated the GoodLoader infection chain. This immediately created multiple files within the local app data directory, specifically in a folder named Mozilla, along with .lnk files, and established initial persistence via the startup folder. Memory dumps of compromised machines revealed the execution of an obfuscated PowerShell command directly in memory, which made C2 server addresses clearly visible.

The kill chain progressed rapidly:

• Initial Access (T0): User search via SEO poisoning.
• Foothold (T+7 minutes): GoodLoader established.
• Internal Activity (T+20 minutes): Threat actors performed Kerberoasting, targeting service accounts to harvest credentials, aiming for high-privilege accounts.
• Lateral Movement (T+45 minutes): Using compromised accounts, the threat actor moved laterally via RDP to other systems. On these further compromised systems, they established two proxy DLLs: Supper and New Back On.

Supper was identified as a SOCKS5 backdoor proxy, designed to tunnel C2 traffic from the external C2 server through the breached internal host to the rest of the internal infrastructure. This allowed the attackers to execute their tools on the C2 server and relay the results to target systems, greatly enhancing stealth. Memory forensics using YARA rules revealed strings associated with Supper and SOCKS activities (e.g., "debug", "main SOCKS"). A crucial forensic artifact stemming from proxy tunneling was observed in Windows logs: when RDP authentication was relayed through the proxy, the internal system recorded the source workstation name as that of the C2 server, rather than the intermediate proxy host. This provided a unique and often anomalous indicator of compromise.

The speakers also identified a new proxy DLL, named New Back On. Analysis of this DLL's shellcode revealed a build path string: /go_socks/new_back_on, which inspired its naming. Upon execution, New Back On enumerated the system and transmitted this information, along with a working port and randomly generated credentials (unassociated with the compromised infrastructure), back to its C2.

Finally, after approximately four hours, the threat actors initiated a comprehensive cleanup operation to erase their traces. This included:

• Deletion of Windows event logs (Application, System, and Security) using WebUtila (a log being utility).
• Removal of RDP bitmap caches, which store screenshots of RDP sessions.
• Deletion of RDP connection history from the Windows registry.
• Deletion of the default.rdp file.
• Removal of the Supper and New Back On DLLs themselves, along with their associated scheduled tasks, effectively removing persistence mechanisms.

Demo / Proof of Concept

▶ Watch: Case 2: 'GoodLoader Returns' - SEO Poisoning (18:00)

While the talk did not feature a live demonstration or proof of concept performed by the speakers, it was inherently built upon the detailed analysis and deconstruction of real-world intrusions. The findings presented were derived from forensic evidence, memory dumps, network traffic captures, and log analysis collected during actual incident response engagements. This approach allowed the speakers to illustrate the complete attack chains, from initial compromise to cleanup, using visual aids and concrete data points rather than simulated environments.

Defensive Implications

▶ Watch: GoodLoader: Extensive Cleanup & Evasion Techniques (26:00)

The detailed deconstruction of these real-world intrusions provides critical insights for strengthening defensive postures against similar threats.

For the Contagious Interview scenario, organizations, particularly those employing developers, must prioritize security awareness training. Developers should be educated on the risks of unsolicited job offers, especially those involving cloning repositories from unknown sources or running npm install on projects from unverified origins. Endpoint Detection and Response (EDR) systems should be configured to monitor for unusual process execution chains, such as npm install leading to network connections to suspicious domains like jsonkeeper.com, or the staging of uncommon files in temporary directories (/tmp). Network monitoring is crucial for detecting C2 communications, especially through protocols like WebSockets, and for identifying anomalous traffic patterns or connections to known malicious IPs. Defenders should also look for unexpected installations of Python runtimes (p.zip) or the creation of persistence mechanisms like launch agents, cron scripts, or scheduled tasks associated with known malware (e.g., Tsunami). Monitoring for excessive or fake User Account Control (UAC) prompts can indicate privilege escalation attempts. Finally, robust Data Loss Prevention (DLP) and egress filtering are essential to detect and prevent the exfiltration of sensitive data such as screenshots, cryptocurrency wallet information, and browser data.

Regarding the GoodLoader Returns case, the primary defensive implication revolves around user education and robust endpoint protection. Users must be trained to recognize and avoid SEO-poisoned search results, sponsored links, and suspicious document downloads, even if they appear to be from legitimate-looking sites. Email filtering and gateway solutions should aggressively block emails containing suspicious attachments or links to known malicious domains. EDR solutions should focus on detecting obfuscated PowerShell commands executed from memory, suspicious file creations in unusual directories (e.g., local app data/Mozilla), and the creation of .lnk files or startup entries. Memory forensics is highlighted as a vital tool; security teams should regularly acquire and analyze memory dumps from potentially compromised machines using YARA rules to identify strings associated with tools like Supper or SOCKS proxies. Centralized log management and analysis are paramount, particularly for RDP logs. Defenders should actively monitor the source workstation name field in RDP authentication events for anomalies, such as non-internal hostnames or known C2 IP addresses, as this can be a strong indicator of proxy tunneling and lateral movement. Detection of Kerberoasting attempts, characterized by unusual service ticket requests, is also critical. Finally, defenders should implement strong logging and alerting for post-exploitation cleanup activities, such as the deletion of Windows event logs (Application, System, Security), RDP bitmap caches, RDP history in the registry, and scheduled tasks, as these often signal a successful intrusion and an attempt to evade detection.

Key Takeaways

• Real-world incidents are the best teachers: Analyzing actual intrusions provides invaluable, actionable intelligence that transcends theoretical knowledge, highlighting the evolving TTPs of threat actors.
• Sophisticated social engineering is a primary vector: North Korean APTs effectively leverage fake job interviews and coding challenges on professional platforms to gain initial access, demonstrating the need for continuous user awareness training.
• Multi-stage toolkits and persistence are common: Attackers deploy a combination of backdoors (Otter Cookie), implants (Invisible Ferret), and persistence tools (Tsunami) to ensure long-term access and data exfiltration, often adapting to multiple operating systems.
• SEO poisoning remains highly effective: Even established malware families like GoodLoader continue to thrive by exploiting search engine vulnerabilities and user trust, leading to rapid compromise and lateral movement within minutes.
• Proxy tunneling leaves forensic clues: While tools like Supper and New Back On enhance attacker stealth during lateral movement, careful analysis of RDP logs can reveal the C2's true source IP, providing a critical detection opportunity.
• Thorough cleanup is a hallmark of advanced adversaries: Threat actors meticulously erase logs, RDP traces, and malware artifacts post-compromise, underscoring the importance of robust, off-host logging and proactive forensic collection.

About the Speaker(s)

Angelo Violetti is an Incident Response Specialist at Swisscom B2B CSIRT and a dedicated contributor to The DFIR Report. His expertise spans a wide array of cybersecurity domains, including comprehensive incident response cases, ransomware investigations, advanced persistent threat (APT) analysis, business email compromises (BEC), and infrastructure hunting. Violetti's work focuses on dissecting real-world intrusions to extract actionable lessons for defenders.

Alessandro Di Carlo serves as the Detection and Response Product Lead for ThreatDown, a company powered by Malwarebytes, and is also a key contributor to The DFIR Report. In his role, Di Carlo is responsible for developing and enhancing detection and response products. His work with The DFIR Report involves the meticulous study, analysis, and collection of artifacts from live cyber incidents, translating raw data into valuable insights for the cybersecurity community.