ThreatThursday: Orangeworm

This week on #ThreatThursday we cover the latest release of MITRE ATT&CK (with sub-techniques), announce a healthcare partnership, and look at a threat actor that has been targeting the healthcare sector for years: Orangeworm. As usual, we consume Cyber Threat Intelligence, create a threat profile and adversary emulation plan, and discuss how to defend against Orangeworm. We hope you enjoy it!

MITRE ATT&CK Update

On July 8, 2020, MITRE announced the latest update to ATT&CK. This update brings some fundamental changes to how techniques are covered by introducing sub-techniques. ATT&CK (stands for an acronym for Adversary Tactics, Techniques, and Common Knowledge) enables. It allows the Cyber Threat Intelligence team, Red Team, and Blue Team to all speak the same language. Our If you are familiar with #ThreatThursday you are aware these blog posts focus, in part, on cover those three key players to enable collaboration and improve security through the SCYTHE platform.

We use ATT&CK to discuss adversary tactics, techniques, and procedures. The ATT&CK matrix covers the tactics and techniques while showcasing some procedures when you drill down on each technique. The introduction of sub-techniques adds another layer to better illustrate a specific adversary action. At the highest level, a sub-technique is a more specific technique.

Cyber Alliance to Defend our Healthcare

At SCYTHE, it is embedded in our culture to share and build our communities and we are happy to announce a partnership with C5 Capital to support our healthcare community. We are seeing an unprecedented number of attacks on our healthcare systems, healthcare providers, and laboratories from malicious cyber actors wanting to cause maximum damage to systems and services most in need during the pandemic. C5 Capital has formed an alliance of cyber professionals who will C.A.R.E. for the cyber defense of our healthcare systems and providers so they can protect us.

Cyber Threat Intelligence

If you read #ThreatThursday on APT19 or APT33 you saw how to leverage MITRE ATT&CK for Cyber Threat Intelligence and map it with ATT&CK Navigator. Orangeworm is documented on the MITRE ATT&CK site but only lists 2 sub-techniques. It links to various software that we will be able to emulate but we may also need to extract TTPs from Cyber Threat Intelligence like we did with Buhtrap. We always recommend reading through the CTI as you may get details about the procedures used by the threat actor. Here are a few reports on Orangeworm, in particular we want to know more about Kwampirs which is the malware they used.

• https://attack.mitre.org/software/S0236/
• https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia

Leveraging the new ATT&CK Navigator, we select Orangeworm with the selector tool but do not see any changes. This is because there are only 2 technique IDs tagged to Orangeworm and they are both sub-techniques as shown in Figure 1. Navigator does not show them because they are sub-techniques; we need to expand the technique in Navigator to see them or click on the ATT&CK Navigator Layers button and select view. It will take you to this page.

Orangeworm Threat Profile

Reading through the CTI sources provided (feel free to read other sources) and Navigator, we can extract the TTPs and create a Threat Profile for Orangeworm:

Adversary Emulation Plan

Orangeworm performs a significant amount of Discovery by leveraging built in tools such as arp, cmd, ipconfig, net, netstat, route, and systeminfo. We will do the same with our adversary emulation plan, conscience that most of these tools will run without being blocked. In the industry, we call leveraging built in tools: “ Living off the Land”.

Head over to our Community Threat Github and download the Orangeworm adversary emulation plan. Import it to SCYTHE and begin testing.

For this threat, we are going to execute the dropper leveraging the RunDLL sub-technique (T1218.011 - Rundll32) under technique T1218 - Signed Binary Proxy Execution. To do this:

• Download the 32-bit DLL from your SCYTHE campaign onto the target system; make sure to save it as a .dll (we will use ServiceLogin.dll as the example)
• Open a Command Prompt
• Change directory to where the DLL was downloaded
• Execute with: rundll32.exe ServiceLogin.dll,PlatformClientMain

Persistence

Orangeworm achieves persistence through creating a new account and creating a new service that executes the malware on reboot. Both of these can be accomplished with SCYTHE. It is not recommended to add this to your automated steps as it will try to persist when it is already persistent.

To create a new user and add to the local administrator group:

• run cmd /c net user Kwampirs SecurePass123 /add
• run cmd /c net localgroup administrators Kwampirs /add

To persist through a service:

• loader --load persist
• persist --hostname TARGETSERVER01 --name SCYTHEC --display SCYTHEC --description SCYTHE Client --path \TARGETSERVER01\c$\windows\temp\scythe.exe

Defend against Orangeworm

Orangeworm leverages many built in tools, often called “ Living off the Land”. These built in tools like arp, cmd, ipconfig, net, netstat, route, and systeminfo are very difficult to prevent (as they come with the operating system). Detecting these built in tools executed in an attack chain is useful for alerting when an adversary may be operating in your environment. We recommend looking into sysmon to be able to do this without having to purchase more technology.

Clean up

Make sure to clean up when complete, open a privileged cmd.exe

• sc delete SCYTHEC
• del C:\Windows\temp\scythe.exe
• net localgroup administrators Kwampirs /del
• net user Kwampirs /del

Conclusion

This #ThreatThursday we covered the latest version of MITRE ATT&CK (with sub-techniques) and announced our participation in the C5-Health Alliance to collaborate with the healthcare sector. If you are interested in leveraging SCYTHE please fill out this form: https://www.scythe.io/healthcare

Given our collaboration, we featured a threat actor that has been targeting the health sector for the past 5 years. This actor uses built in windows tools so anyone can emulate these manually. SCYTHE allows for automated and consistent emulation so you can focus on tuning detective controls. Stay tuned for next week as we will have someone from the healthcare sector on #ThreatThursday.

This Threat Thursday post discusses active research by SCYTHE and other cited third parties into an ongoing threat. The information in this post should be considered preliminary and may be updated as research continues. This information is provided “as-is” without any warranty or condition of any kind, either express or implied.