xHunt Campaign: Attacks on Kuwait Shipping and Transportation Organizations
xHunt deployed custom backdoors Hisoka, Killua, Gon, and EYE against Kuwait shipping and transportation organizations, using DNS tunneling and email-draft C2 channels.
Unit 42 observed the xHunt campaign targeting Kuwait transportation and shipping organizations between May and June 2019, installing backdoors named after characters from the anime Hunter x Hunter, including Hisoka, Killua, Sakabota, and Netero. The tools use HTTP and DNS tunneling for C2, and Hisoka v0.9 added an unusual email-based C2 channel that abuses Exchange Web Services with stolen credentials to exchange email drafts. The Gon tool provides port scanning, file transfer, screenshots, remote command execution, and RDP session creation, while EYE acts as a cleanup failsafe if a legitimate user logs in. Related activity targeting Kuwait between July and December 2018 was reported by IBM X-Force IRIS, suggesting the campaigns are likely related.
- Custom backdoors Hisoka, Killua, Gon, EYE, Sakabota, Netero used in Kuwait
- C2 via HTTP, DNS tunneling, and EWS-based email drafts
- SMB lateral transfers via compromised IT service desk accounts observed
- Gon supports RDP, screenshots, port scanning, and remote command execution
- Likely linked to 2018 Kuwait activity reported by IBM X-Force IRIS
- ATT&CK
- T1071.004 DNST1071.003 Mail ProtocolsT1021.002 SMB/Windows Admin SharesT1021.001 Remote Desktop ProtocolT1113 Screen Capture
- Vendors
- Unit 42
- Products
- Exchange
- Threat actors
- xHunt
- Organizations
- IBM X-Force IRIS
- Countries
- Kuwait
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 6google.com | 2019 Masked winx64-microsoft[.]com 7/15/18 - 7/15/19 Masked 6google[.]com 7/31/18 - 7/31/19 Masked alforatsystem[.]com 5/29/18 - 5/ |
| domain | alforatsystem.com | /18 - 7/15/19 Masked 6google[.]com 7/31/18 - 7/31/19 Masked alforatsystem[.]com 5/29/18 - 5/29/19 Masked windows64x[.]com 8/18/18 - 8/18/ |
| domain | check-updates.com | - 10/10/19 Masked pasta58[.]com 12/27/17 - 12/27/18 Masked check-updates[.]com 6/24/18 - 6/24/19 Sofia Weber locas.l[@]yahoo.com travele |
| domain | firewallsupports.com | lation to pasta58[.]com : Domain Date Registered Registrant firewallsupports[.]com 5/6/2018 - 5/6/2019 Masked winx64-microsoft[.]com 7/15/18 |
| domain | mail.contoso.com | ing, we were able to enable the C2 channel: hisoka;pass123!;mail.contoso.com;2010 To initiate communications, Hisoka notifies the actor |
| domain | microsoft-check.com | 18/19 Masked windows-updates[.]com 1/10/18 - 1/10/19 Masked microsoft-check[.]com 10/10/18 - 10/10/19 Masked pasta58[.]com 12/27/17 - 12/27 |
| domain | microsofte-update.com | ven Hisoka v0.8 samples configured to beacon to the domains microsofte-update[.]com . Each of these samples also contain the following debug |
| domain | pasta58.com | a samples -- all of which were configured to use the domain pasta58[.]com for its C2 server. During general infrastructure analysis |
| domain | sakabota.com | domain registration details, we also identified the domain sakabota[.]com whose web server served a page with the title “Outlook We |
| domain | traveleasy-kw.com | tes[.]com 6/24/18 - 6/24/19 Sofia Weber locas.l[@]yahoo.com traveleasy-kw[.]com 6/13/18 - 6/13/19 Masked Table 1. Domains associated with |
| domain | windows64x.com | 7/31/19 Masked alforatsystem[.]com 5/29/18 - 5/29/19 Masked windows64x[.]com 8/18/18 - 8/18/19 Masked windows-updates[.]com 1/10/18 - |
| domain | windows-updates.com | - 5/29/19 Masked windows64x[.]com 8/18/18 - 8/18/19 Masked windows-updates[.]com 1/10/18 - 1/10/19 Masked microsoft-check[.]com 10/10/18 - |
| domain | winx64-microsoft.com | egistrant firewallsupports[.]com 5/6/2018 - 5/6/2019 Masked winx64-microsoft[.]com 7/15/18 - 7/15/19 Masked 6google[.]com 7/31/18 - 7/31/19 |
| sha256 | 892d5e8e763073648dfebcfd4c89526989d909d6189826a974f17e2311de8bc4 | soka\\Hisoka\\obj\\Debug\\inetinfo.sys.pdb The file SHA256: 892d5e8e763073648dfebcfd4c89526989d909d6189826a974f17e2311de8bc4 was used in reference to the below analysis on Hisoka v0.8. |
From the original article
14 min read at unit42.paloaltonetworks.com
Between May and June 2019, Unit 42 observed previously unknown tools used in the targeting of transportation and shipping organizations based in Kuwait. The first known attack in this campaign targeted a Kuwait transportation and shipping company in which the actors installed a backdoor tool named Hisoka. Several custom tools were later downloaded to the system in order to carry out post-exploitation activities.
By Brittany Barbehenn · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.