Attacker identity revealed: insights from rogue VMs & BYOVD in EDR evasion

Attacker identity revealed: insights from rogue VMs & BYOVD in EDR evasion

Speakers: Renzen Cruz (Technical Director of Incident Response, Unit 42, Palo Alto Networks); Navin Thomas (Threat Researcher, Unit 42, Palo Alto Networks); Cuong Dinh (Palo Alto Networks)

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=FPMI2ANk8xE

Overview

In a revealing presentation at Virus Bulletin, Renzen Cruz and Navin Thomas from Palo Alto Networks' Unit 42 unveiled a compelling case study where an incident response engagement inadvertently led to the unmasking of a cybercriminal's identity. The talk, titled "Attacker identity revealed: insights from rogue VMs & BYOVD in EDR evasion," detailed how meticulous forensic analysis of a seemingly innocuous "rogue VM" discovered during an incident blossomed into a full-scale attribution effort. This investigation not only exposed the threat actor's personal and professional details but also provided profound insights into their EDR evasion techniques, tooling, and operational security failures.

The core of the presentation centered on how the attackers, in their attempt to demonstrate their EDR bypass tool for prospective buyers, inadvertently recorded and distributed videos that contained critical operational security (OPSEC) blunders. These lapses allowed researchers to piece together a mosaic of clues, from virtual machine configurations to host system applications and even official government documents, ultimately leading to the identification of the individual behind the "kernel mode" alias. This talk serves as a powerful reminder that even sophisticated adversaries are prone to human error, and that careful forensic examination can turn seemingly minor details into pivotal intelligence.

The findings are particularly significant for the cybersecurity community, offering a rare glimpse into the development and distribution of EDR evasion tools from the perspective of the threat actor themselves. It underscores the importance of comprehensive incident response, extending investigations beyond compromised corporate assets to any anomalous activity, and highlights the potential for attribution even in the face of advanced evasion tactics like Bring Your Own Vulnerable Driver (BYOVD).

Background

▶ Watch: Talk intro: Attacker identity revealed via demo videos (0:00)

The incident began as a typical ransomware engagement, initiated through an Initial Access Broker (IAB) who provided legitimate credentials, likely purchased on the dark web. The threat actors gained access to a help desk account with privileges to an RMM (Remote Monitoring and Management) tool named Atera. This legitimate application, used for troubleshooting and remote connections, became the primary conduit for the attackers' operations.

Once inside, the adversaries heavily abused Atera, leveraging its capabilities to launch cmd.exe for initial reconnaissance and to map the target's defensive posture. Their primary objective was to disable XDR/EDR (Extended Detection and Response) platforms. For this, they deployed a customized tool named disabler.exe, derived from the open-source EDR Sandblast project. This tool was designed to enumerate and detect userland hooks implemented by EDR solutions, a common technique for monitoring system activity.

The sophisticated aspect of their evasion strategy involved BYOVD (Bring Your Own Vulnerable Driver). Specifically, they utilized the WnBIOS driver, a known vulnerable component, to gain kernel-level access. This elevated privilege allowed them to unhook the EDR solutions, effectively blinding the security software to their subsequent activities. Following the EDR bypass, disabler.exe was also configured to create a persistent service.

For command and control (C2), the attackers extensively deployed Cobalt Strike beacons across the client's infrastructure, with Atera effectively acting as a C2 in "steroids." Analysis of the VM32.dll beacon revealed a specific Cobalt Strike watermark that has been observed in use by various threat actors since 2023, indicating the tool's prevalence. Persistence for the Cobalt Strike beacons was achieved through standard scheduled tasks.

Data exfiltration was performed using rclone, a legitimate cloud sync tool. The attackers attempted to disguise it by renaming the executable to VMware.exe. However, a critical OPSEC failure emerged here: the rclone.config file, containing the username and an encoded password, was left on the compromised system. While the password was encoded, rclone itself provides a reveal command that can decode these values, a functionality hidden from the standard rclone config -shell output but nevertheless discoverable. This oversight provided a crucial lead into the attacker's own infrastructure.

During the incident response, a rogue VM was identified connecting to the client's tenant. Its naming convention did not align with corporate assets, prompting a deep forensic investigation. This rogue VM proved to be the pivotal turning point, transforming a standard incident into an unprecedented attribution effort. Separately, the threat actors engaged in a negotiation with the client, initially demanding $350,000 USD and eventually settling for a 46% reduction, highlighting the financial motivations behind such attacks.

Key Findings

▶ Watch: Rogue VM discovery: the investigation's turning point (6:15)

The discovery and subsequent deep forensic analysis of the rogue VM represented a significant breakthrough in the investigation. This machine, which was not part of the victim’s corporate assets, turned out to be the threat actor's own testing environment, replete with a treasure trove of incriminating evidence.

Within the rogue system, researchers found a directory named Z freelance, containing folders with suspicious aliases. These aliases, when searched on cybercrime forums like XSS and Exploit, led to a user named Marty71, who was actively seeking AV/EDR bypass solutions. Further investigation revealed kernel mode, another user, offering a custom-made bypass tool in response to Marty71's requests. Kernel mode was also found to be selling subscriptions to this tool and offering video demonstrations.

Critically, the rogue system contained an archive file, contraining.rar, which held a torrent file for the Conti ransomware playbook, leaked publicly in 2021. This indicated the actor's interest in or involvement with ransomware operations. A suite of other tools was also recovered, including utilities for shellcode generation, kernel driver manipulation, code obfuscation, and anti-cheat software bypasses, demonstrating the actor's diverse technical capabilities. Messy text files containing IP addresses, login credentials, and escrow payment details further illuminated their operational practices.

A particularly significant artifact was a spreadsheet named P1 form. Research confirmed this as an official government document from the Republic of Kazakhstan, used for invoicing and documenting completed work. This specific P1 form detailed a transaction between two Kazakhstan-based companies, one of which was exposed by name. This company name became a vital piece of the puzzle for threat actor profiling. Intriguingly, the form also documented the rental of 30 Mercedes cars, a detail whose full context remains unclear but speaks to potentially illicit or unusual financial activities.

The most damning evidence came from the demo recordings of EDR bypassing tooling found on the rogue VM. These videos were identical to those distributed by kernel mode on cybercrime forums. While intended as a sales pitch, these recordings contained numerous OPSEC failures. Screenshots from the videos revealed the actor's desktop during demonstrations, showing an Oracle Virtual Box VM instance running the bypass tool. The host system's taskbar, visible at the bottom of the recordings, displayed multiple other VM instances running simultaneously. More crucially, the taskbar also showed open applications, including Winbox (a tool for administering MikroTik routers), with a partial username "Andry," and OBS Studio, a common open-source tool for video recording.

Further analysis of the VM's hostname, visible on the EDR agent panel within the demo, matched the hostname captured during the initial investigation of the rogue VM, confirming its role as a testing environment. An unconventional management console URL, revealed through base64 decoding of a fake installation token shared in a Telegram channel, provided another thread connecting the actor to specific online communities and activities.

By cross-referencing the company name from the P1 form with the exposed name "Andry" from the Winbox application in the demo videos, researchers were able to locate the individual's LinkedIn profile. This confirmed their employment at the Kazakhstan-based company, which was registered in early 2023 for software development and had approximately five employees. The individual's VK social media profile further corroborated their identity, with posts suggesting Saran, Kazakhstan, as their hometown – the same town listed as the company's legal address. The company's website also provided employee profiles, and one photo was an exact match to the identified individual's LinkedIn profile.

Based on this convergence of digital and real-world intelligence, Unit 42 assessed with high confidence that the identified individual is "kernel mode," and likely the sole developer of the AV/EDR bypass tool. While the rogue machine was primarily used for testing and not directly involved in the observed attack, the insights gained were invaluable for understanding the adversary's capabilities and identity.

Technical Deep Dive

▶ Watch: Unmasking 'Kernel mode' via cybercrime forums (8:20)

The investigation provided a granular look at the technical methodologies employed by the threat actors, from initial compromise to sophisticated EDR evasion and exfiltration.

The initial foothold was established through the abuse of Atera, a legitimate RMM tool. Atera's web console offers extensive capabilities, including direct access to Command Prompt and PowerShell sessions on managed endpoints. The attackers leveraged these features to execute arbitrary commands, perform reconnaissance, and deploy their malicious payloads, effectively transforming a benign administrative tool into a stealthy Command and Control (C2) channel. This highlights a critical vulnerability in many organizations: the inherent trust placed in legitimate software that, when compromised, can facilitate a wide array of malicious activities with reduced scrutiny.

Central to their EDR evasion strategy was disabler.exe, a custom-built tool based on the EDR Sandblast project. This tool's execution flow began with an enumeration phase, designed to detect userland hooks – common mechanisms used by EDR solutions to intercept API calls and monitor process behavior. By identifying these hooks, disabler.exe could then target them for disabling. The key to this deep-seated evasion was the Bring Your Own Vulnerable Driver (BYOVD) technique, specifically utilizing the WnBIOS driver. WnBIOS is a legitimate but known vulnerable driver that, when loaded, can be exploited to achieve arbitrary kernel-level read/write primitives. With kernel-level access, the threat actor could directly manipulate kernel structures and memory, allowing them to unhook EDR agents, disable callbacks, and effectively bypass security controls that operate in user mode. This technique ensures a higher degree of stealth and persistence, as kernel-level operations are harder for user-mode EDRs to detect and prevent. The disabler.exe also established persistence by creating a service on the compromised system.

For their C2 infrastructure, the attackers relied on Cobalt Strike beacons. The analysis of the VM32.dll beacon provided a crucial piece of threat intelligence: a specific Cobalt Strike watermark. These watermarks, often unique identifiers generated during the compilation of the Cobalt Strike payload, can be used by researchers to link different campaigns or identify specific threat actor groups. The watermark observed in this case has been active since 2023, suggesting a consistent toolset or shared infrastructure among various groups. Persistence for these beacons was achieved through the creation of scheduled tasks, a common technique that ensures the malware restarts even after system reboots.

Data exfiltration was facilitated by rclone, a versatile command-line program for managing files on cloud storage. The attackers disguised rclone.exe by renaming it to VMware.exe. However, a significant OPSEC failure occurred with the rclone.config file. This file, containing configuration details including an encoded password for the cloud storage, was left on the system. While the password was encoded, rclone itself provides a reveal command (rclone config show --option <remote_name> password) that can decode it. The attackers likely overlooked this detail, or assumed its obscurity, as the reveal command is not displayed when using rclone config -shell. This oversight provided the incident responders with direct access to the attacker's exfiltration credentials.

The forensic investigation of the rogue VM was a masterclass in piecing together disparate clues. The Z freelance directory suggested the actor's engagement in illicit services. The contraining.rar archive containing the Conti ransomware playbook highlighted their interest in or preparation for ransomware operations, even though this specific incident did not involve ransomware. The collection of other tools for shellcode, kernel driver utilities, code obfuscation, and anti-cheat bypasses painted a picture of a technically proficient individual with a broad range of offensive capabilities.

The analysis of the attacker's own demo videos was perhaps the most critical technical deep dive. The visible Oracle Virtual Box window confirmed the use of virtualized environments for testing, a standard practice for malware developers. The host system's taskbar revealed multiple running VM instances, indicating a multi-environment testing setup. The presence of Winbox, an administration tool for MikroTik routers, with a partial username "Andry," suggested the actor's involvement in network infrastructure management, potentially for their C2 or other illicit activities. OBS Studio, an open-source video recording software, confirmed how the demo videos were created. These seemingly minor details, when aggregated, formed a clear picture of the actor's working environment and habits.

The P1 form provided the crucial link to the real world. As an official Kazakhstan government procurement document, its discovery on the rogue VM was highly unusual. The exposed company name, combined with the "Andry" alias from the Winbox application, allowed researchers to pivot from digital artifacts to real-world identities. This cross-referencing between cybercrime forum handles, technical artifacts, and publicly available information (LinkedIn, VK profiles, company registration details) demonstrates a powerful methodology for attribution, revealing the human element behind the digital persona. The company's registration as a software development firm in Kazakhstan, with the identified individual listed as an employee, further solidified the link between the "kernel mode" alias and a real-world entity.

Demo / Proof of Concept

▶ Watch: Key opsec failures in attacker's demo videos (13:30)

The talk's "Demo / Proof of Concept" section didn't involve a live demonstration by the speakers, but rather a detailed analysis of the threat actor's own demonstration videos. These videos were a central piece of evidence, initially created by the "kernel mode" actor to showcase their EDR bypass tool to potential buyers on cybercrime forums.

In these recordings, the actor meticulously demonstrated the tool's effectiveness. Each video typically featured a system with a specific EDR agent visibly installed and running. The actor would then execute their custom disabler.exe tool. To definitively prove the success of the bypass, they would subsequently run Mimikatz, a post-exploitation tool notoriously detected by EDRs, to dump credentials or perform other sensitive operations. The successful execution of Mimikatz without triggering EDR alerts served as the "proof of concept" for their potential customers.

These videos, intended as a sales and marketing tool, inadvertently became a critical forensic goldmine. As detailed in the "Technical Deep Dive," the threat actor's operational security (OPSEC) failures during these recordings provided investigators with an unprecedented view into their testing environment. Details such as the Oracle Virtual Box interface, the host machine's taskbar displaying other running applications like Winbox and OBS Studio, and even the VM's hostname, were all captured within these videos. These "demos" were not just showcasing a bypass; they were inadvertently revealing the attacker's identity and methodology, turning their sales pitch into self-incrimination.

Defensive Implications

▶ Watch: Attacker's full identity confirmed via public profiles (16:00)

The insights gleaned from this investigation offer several critical defensive implications for organizations and security professionals:

1. Monitor and Secure RMM Tools Rigorously: Legitimate tools like Atera are powerful and, when compromised, become highly effective C2 channels and deployment platforms. Organizations must implement stringent access controls, multi-factor authentication, and continuous monitoring for anomalous activity originating from or targeting RMM solutions. Any cmd.exe or powershell.exe executions via RMM tools should be flagged for immediate review.
2. Enhance BYOVD Detection and Prevention: The use of WnBIOS for kernel-level EDR unhooking highlights the growing sophistication of evasion techniques. Defenders need advanced kernel-level monitoring capabilities to detect suspicious driver loading, especially of known vulnerable drivers. Implementing driver signing enforcement and hypervisor-based security solutions can help prevent unauthorized or malicious drivers from loading.
3. Detect EDR Bypass Tools: Be vigilant for the presence and execution of tools like disabler.exe (or its EDR Sandblast derivatives). Implement behavioral detection rules that look for processes attempting to enumerate or tamper with EDR userland hooks, or any processes attempting to load known vulnerable drivers.
4. Leverage Threat Intelligence from C2 Watermarks: The Cobalt Strike watermark proved valuable in tracking the tool's usage. Security teams should integrate C2 framework watermark analysis into their threat intelligence pipelines to identify common adversaries or shared tooling.
5. Secure Configuration Files and Credentials: The rclone.config file exposed the attacker's exfiltration credentials due to an oversight. Organizations should enforce policies that encrypt or securely store configuration files, especially those containing sensitive information. Regular audits of application configurations for exposed credentials or easily decodable passwords are essential.
6. Comprehensive Rogue VM Investigation: The discovery of the rogue VM was pivotal. Organizations must have robust processes for identifying and forensically investigating any non-corporate assets or anomalous machines connecting to their networks or cloud tenants. These systems can be goldmines for intelligence.
7. Reinforce OPSEC Best Practices: While this applies to attackers, the case serves as a powerful reminder for all technical personnel. Even seemingly minor details in screenshots, videos, or shared documents can be used for attribution. Emphasize awareness of what is visible in recording or sharing environments.
8. Integrate Digital and Real-World Intelligence: The success of this attribution relied on combining digital artifacts (IPs, tool names, forum posts) with real-world information (government forms, LinkedIn, company registrations). Incident response teams should develop capabilities to bridge these two domains for more effective attribution.

Key Takeaways

• OPSEC failures are often the weakest link: Even sophisticated attackers can make critical mistakes, especially when recording or sharing information about their operations or tools.
• Legitimate tools are heavily abused: RMM platforms like Atera and cloud sync tools like rclone are prime targets for abuse, turning trusted applications into adversary infrastructure.
• BYOVD is a prevalent and effective EDR evasion technique: Attackers are increasingly leveraging vulnerable drivers to gain kernel-level access and disable security controls.
• Rogue assets are intelligence goldmines: Any unauthorized or anomalous system connecting to an environment warrants deep forensic investigation, as it can reveal invaluable adversary tradecraft and identity.
• Attribution requires a multi-faceted approach: Combining technical forensics, threat intelligence, and open-source intelligence (OSINT) from social media and public records is crucial for unmasking threat actors.
• Continuous monitoring and proactive hunting are essential: Organizations must move beyond signature-based detection to behavioral analysis and active threat hunting, especially for kernel-level activities and RMM abuse.

About the Speaker(s)

Renzen Cruz is a Technical Director of Incident Response at Unit 42 from Palo Alto Networks. He is an active contributor to the DFIR Report and is involved in AP labs for training purposes with CRA. His expertise lies in incident response engagements, where he helps organizations navigate complex cyberattacks.

Navin Thomas is a Threat Researcher at Unit 42, Palo Alto Networks, part of the reactive services team. His role involves providing intelligence support to incident response investigators and identifying opportunities to extract valuable intelligence from ongoing cases.

Cuong Dinh is also affiliated with Palo Alto Networks, though his specific role was not detailed in the presentation's introduction.