xHunt Campaign: New Watering Hole Identified for Credential Harvesting
AI summary · glm-5.3-flashSummaries by Vani AI
Unit 42 tied the xHunt campaign to a watering hole on a Kuwait government website used to passively harvest visitors' NTLM credential hashes.
Palo Alto Unit 42 identified a Kuwait government organization's webpage injected with hidden HTML referencing image paths on domains (microsofte-update.com, learn-service.com) tied to xHunt/Hisoka C2 infrastructure. When visitors loaded the page, Windows would attempt SMB/NetBIOS authentication to the remote share, allowing the operators to capture NTLM hashes that could be cracked or relayed. Related DNS redirect activity on xHunt infrastructure in 2019 pointed to additional credential-harvesting interest against Kuwaiti government email servers.
Key facts
- Hidden image on Kuwait government site triggered NTLM challenge-response authentication
- Responder tool in lab confirmed domain, username, IP, and NTLM hash capture
- Domains linked to xHunt/Hisoka command-and-control infrastructure
- DNS redirects on operator infrastructure suggested email credential harvesting
- Vendors
- Palo Alto Networks
- Threat actors
- xHunt
- Organizations
- Palo Alto NetworksRiskIQ
- Countries
- Kuwait
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 6google.com | update[.]top) 192.99.138[.]6 4/14/2019 - 5/4/2019 Sakabota (6google[.]com) 104.168.136[.]161 6/24/2019 Newly identified DNS redirec |
| domain | alforatsystem.com | activity 213.202.217[.]0,22 6/1/2018, 12/24/2018 Sakabota (alforatsystem[.]com) 213.202.217[.]4 9/8/2018 Sakabota (firewallsupports[.]co |
| domain | antivirus-update.top | ed DNS redirect activity 192.99.138[.]4 4/24/2019 Sakabota (antivirus-update[.]top) 192.99.138[.]6 4/14/2019 - 5/4/2019 Sakabota (6google[.] |
| domain | cloudipnameserver.com | d DNS Hijacking Activity 185.15.247[.]140 1/14/2017 Oilrig (cloudipnameserver[.]com) 185.15.247[.]140 9/9/2018 Sakabota (sakabota[.]com) 185. |
| domain | ffconnectivitycheck.com | /2018 DNSpionage Campaign 185.174.101[.]66 8/6/2018 Oilrig (ffconnectivitycheck[.]com) 185.174.101[.]68 2/14/2019 DNSpionage Campaign 199.247.3 |
| domain | firewallsupports.com | ta (alforatsystem[.]com) 213.202.217[.]4 9/8/2018 Sakabota (firewallsupports[.]com) 213.202.217[.]9 11/18/2018 - 11/29/2018 Oilrig (googie[. |
| domain | googie.email | orts[.]com) 213.202.217[.]9 11/18/2018 - 11/29/2018 Oilrig (googie[.]email) 91.132.139[.]200 4/16/2019, 5/12/2019 Newly identified D |
| domain | google-update.com | date[.]com) 104.168.244[.]213 7/15/2019 - 7/18/2019 Hisoka (google-update[.]com) Additional Resources xHunt Campaign: xHunt Actor’s Cheat |
| domain | learn-service.com | eferenced the domain microsofte-update[.]com but changed to learn-service[.]com in December 2019. As of January 2020, this image is no lo |
| domain | lowconnectivity.com | 2018 DNSpionage Campaign 185.161.211[.]86 10/4/2018 Oilrig (lowconnectivity[.]com) 185.161.209[.]147 11/28/2018 Widespread DNS Hijacking Ac |
| domain | microsofte-update.com | ure. Beginning in May 2019, the image referenced the domain microsofte-update[.]com but changed to learn-service[.]com in December 2019. As o |
| domain | sakabota.com | resolution of interest is with the Sakabota related domain sakabota[.]com . This domain resolved to the IP address 185.15.247[.]140 |
| domain | zombsroyale.io | Activity 199.247.3[.]186 - 198 5/6/2018 - 8/30/2018 Chafer (zombsroyale[.]io) 213.202.217[.]31 7/6/2018 Newly identified DNS redirect |
| ipv4 | 104.168.136.161 | 92.99.138[.]6 4/14/2019 - 5/4/2019 Sakabota (6google[.]com) 104.168.136[.]161 6/24/2019 Newly identified DNS redirect activity 104.168. |
| ipv4 | 104.168.244.213 | .136[.]161 6/24/2019 Newly identified DNS redirect activity 104.168.244[.]213 7/14/2019 Hisoka (microsofte-update[.]com) 104.168.244[.] |
| ipv4 | 185.15.247.140 | ain sakabota[.]com . This domain resolved to the IP address 185.15.247[.]140 in September 2018. Between December 2017 and January 2018 |
| ipv4 | 185.161.209.147 | n 185.161.211[.]86 10/4/2018 Oilrig (lowconnectivity[.]com) 185.161.209[.]147 11/28/2018 Widespread DNS Hijacking Activity 185.174.101[ |
| ipv4 | 185.161.211.72 | [.]com) 185.15.247[.]140 9/9/2018 Sakabota (sakabota[.]com) 185.161.211[.]72 - 79 9/28/2018 - 10/26/2018 DNSpionage Campaign 185.161.2 |
| ipv4 | 185.161.211.86 | 61.211[.]72 - 79 9/28/2018 - 10/26/2018 DNSpionage Campaign 185.161.211[.]86 10/4/2018 Oilrig (lowconnectivity[.]com) 185.161.209[.]14 |
| ipv4 | 185.174.101.66 | 185.174.101[.]68 9/28/2018 - 10/11/2018 DNSpionage Campaign 185.174.101[.]66 8/6/2018 Oilrig (ffconnectivitycheck[.]com) 185.174.101[. |
| ipv4 | 185.174.101.68 | .161.209[.]147 11/28/2018 Widespread DNS Hijacking Activity 185.174.101[.]68 9/28/2018 - 10/11/2018 DNSpionage Campaign 185.174.101[.] |
| ipv4 | 192.99.138.4 | 91.132.139[.]183 4/7/2019 Hisoka (microsofte-update[.]com) 192.99.138[.]4 4/17/2019 - 6/17/2019 Newly identified DNS redirect activ |
| ipv4 | 192.99.138.6 | 192.99.138[.]4 4/24/2019 Sakabota (antivirus-update[.]top) 192.99.138[.]6 4/14/2019 - 5/4/2019 Sakabota (6google[.]com) 104.168.136 |
| ipv4 | 199.247.3.186 | 199.247.3[.]191 11/5/2018 Widespread DNS Hijacking Activity 199.247.3[.]186 - 198 5/6/2018 - 8/30/2018 Chafer (zombsroyale[.]io) 213. |
| ipv4 | 199.247.3.191 | check[.]com) 185.174.101[.]68 2/14/2019 DNSpionage Campaign 199.247.3[.]191 11/5/2018 Widespread DNS Hijacking Activity 199.247.3[.]1 |
| ipv4 | 213.202.217.31 | [.]186 - 198 5/6/2018 - 8/30/2018 Chafer (zombsroyale[.]io) 213.202.217[.]31 7/6/2018 Newly identified DNS redirect activity 213.202.2 |
| ipv4 | 213.202.217.4 | [.]0,22 6/1/2018, 12/24/2018 Sakabota (alforatsystem[.]com) 213.202.217[.]4 9/8/2018 Sakabota (firewallsupports[.]com) 213.202.217[.] |
| ipv4 | 213.202.217.9 | 213.202.217[.]4 9/8/2018 Sakabota (firewallsupports[.]com) 213.202.217[.]9 11/18/2018 - 11/29/2018 Oilrig (googie[.]email) 91.132.13 |
| ipv4 | 91.132.139.183 | 4/16/2019, 5/12/2019 Newly identified DNS redirect activity 91.132.139[.]183 4/7/2019 Hisoka (microsofte-update[.]com) 192.99.138[.]4 |
| ipv4 | 91.132.139.200 | 202.217[.]9 11/18/2018 - 11/29/2018 Oilrig (googie[.]email) 91.132.139[.]200 4/16/2019, 5/12/2019 Newly identified DNS redirect activi |
From the original article
7 min read at unit42.paloaltonetworks.com
During the analysis of the xHunt campaign activities, we identified a Kuwait government organization’s webpage used as an apparent watering hole. The webpage contained a hidden image which was observed between June and December 2019, and referenced domains associated with malicious activity conducted by the xHunt campaign operators.
By Brittany Barbehenn · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.