Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent
Unit 42 details Patchwork APT campaigns against the Indian subcontinent using EPS exploits and an updated BADNEWS backdoor targeting Pakistani military and nuclear interests.
Unit 42 observed the Patchwork group (also known as Dropping Elephant and Monsoon) conducting campaigns against targets in the Indian subcontinent using weaponized documents that exploit CVE-2015-2545 and CVE-2017-0261. The documents deliver an updated BADNEWS backdoor that grants attackers full control of victim machines, using dead drop resolvers on legitimate third-party websites for C2 and HTTP for communications. Lures referenced Pakistan Army promotions, the Pakistan Atomic Energy Commission and the Ministry of the Interior, and in late January 2018 the group shifted from CVE-2017-0261 to the older CVE-2015-2545.
- BADNEWS is delivered via a signed VMware executable side-loading a malicious DLL and a scheduled task named BaiduUpdateTask1.
- The new variant adds mutex 'com_mycompany_apps_appname_new', changed filenames and modified C2 retrieval and communications.
- The malware supports downloading and executing files, uploading documents of interest and taking desktop screenshots.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1203 Exploitation for Client ExecutionT1053.005 Scheduled TaskT1574.002 DLL Side-LoadingT1102.001 Dead Drop Resolver
- Vendors
- Palo Alto Unit 42
- Products
- BADNEWS
- Threat actors
- PatchworkDropping ElephantMonsoon
- Malware
- BADNEWS
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-2545 | Malformed EPS Image RCE in Microsoft Office | — | 86% | KEV | — KEV |
| CVE-2017-0261 | Use-After-Free RCE in Microsoft Office 2010/2013/2016 | 7.8 | 78% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | feed43.com | 85.203.118[.]115 94.156.35[.]204 Dead Drop Resolvers hxxp://feed43[.]com/8166706728852850.xml hxxp://feed43[.]com/3210021137734622 |
| domain | rapidfeeds.com | an be seen in the following images taken from hxxp:// feeds.rapidfeeds[.]com/88604/, which is one of the dead drop resolvers we encoun |
| domain | webrss.com | 850.xml hxxp://feed43[.]com/3210021137734622.xml hxxp://www.webrss[.]com/createfeed.php?feedid=49966 hxxp://feeds.rapidfeeds[.]com |
| ipv4 | 185.203.118.115 | the example shown above, we are presented with a result of 185.203.118[.]115 after all four steps are taken. BADNEWS performs many of |
| ipv4 | 94.156.35.204 | 8b7dff7abf25ea817585e4c923adb2 C2 Servers 185.203.118[.]115 94.156.35[.]204 Dead Drop Resolvers hxxp://feed43[.]com/8166706728852850. |
| md5 | 79ad2084b057847ce2ec2e48fda64073 | 80154705794e96d0c6d657c948b7dff7abf25ea817585e4c923adb2 MD5 79ad2084b057847ce2ec2e48fda64073 Compile Date 2017-12-22 11:54:03 UTC One of the first modif |
| md5 | dd1876848203d9e10abceec07282ff37 | d using AES-128 and the following static key (hex-encoded): DD1876848203D9E10ABCEEC07282FF37 Conclusion The Patchwork group continues to plague victims |
| md5 | e3e7e71a0b28b5e96cc492e636722f73 | cation with the C2 (note the additional forward slashes): //e3e7e71a0b28b5e96cc492e636722f73//4sVKAOvu3D//ABDYot0NxyG.php In the event data is uploaded |
| sha256 | 07d5509988b1aa6f8d5203bc4b75e6d7be6acf5055831cc961a51d3e921f96bd | 02c2119f62762f78523aa7cbc96ef1 Figure 2 Lure extracted from 07d5509988b1aa6f8d5203bc4b75e6d7be6acf5055831cc961a51d3e921f96bd Figure 3 Lure extracted from b8abf94017b159f8c1f0746dca24b4 |
| sha256 | 290ac98de80154705794e96d0c6d657c948b7dff7abf25ea817585e4c923adb2 | research blog, we are discussing the following file: SHA256 290ac98de80154705794e96d0c6d657c948b7dff7abf25ea817585e4c923adb2 MD5 79ad2084b057847ce2ec2e48fda64073 Compile Date 2017-12-2 |
| sha256 | a67220bcf289af6a99a9760c05d197d09502c2119f62762f78523aa7cbc96ef1 | n be seen in the images below: Figure 1 Lure extracted from a67220bcf289af6a99a9760c05d197d09502c2119f62762f78523aa7cbc96ef1 Figure 2 Lure extracted from 07d5509988b1aa6f8d5203bc4b75e6 |
| sha256 | ab4f86a3144642346a3a40e500ace71badc06a962758522ca13801b40e9e7f4a | 67e92b49169c24051ee9de41327ee5e6ac7c2 BADNEWS SHA256 Hashes ab4f86a3144642346a3a40e500ace71badc06a962758522ca13801b40e9e7f4a 290ac98de80154705794e96d0c6d657c948b7dff7abf25ea817585e4c92 |
| sha256 | b8abf94017b159f8c1f0746dca24b4eeaf7e27d2ffa83ca053a87deb7560a571 | 6acf5055831cc961a51d3e921f96bd Figure 3 Lure extracted from b8abf94017b159f8c1f0746dca24b4eeaf7e27d2ffa83ca053a87deb7560a571 Figure 4 Lure extracted from d486ed118a425d902044fb7a84267e |
| sha256 | d486ed118a425d902044fb7a84267e92b49169c24051ee9de41327ee5e6ac7c2 | 7e27d2ffa83ca053a87deb7560a571 Figure 4 Lure extracted from d486ed118a425d902044fb7a84267e92b49169c24051ee9de41327ee5e6ac7c2 and fd8394b2ff9cd00380dc2b5a870e15183f1dc3bd82ca6ee58f055b4 |
| sha256 | fd8394b2ff9cd00380dc2b5a870e15183f1dc3bd82ca6ee58f055b44074c7fd4 | a425d902044fb7a84267e92b49169c24051ee9de41327ee5e6ac7c2 and fd8394b2ff9cd00380dc2b5a870e15183f1dc3bd82ca6ee58f055b44074c7fd4 The payload from each of the malicious documents is an upda |
| url | http://feed43.com/3210021137734622.xml | ead Drop Resolvers hxxp://feed43[.]com/8166706728852850.xml hxxp://feed43[.]com/3210021137734622.xml hxxp://www.webrss[.]com/createfeed.php?feedid=49966 hxxp: |
| url | http://feed43.com/8166706728852850.xml | rvers 185.203.118[.]115 94.156.35[.]204 Dead Drop Resolvers hxxp://feed43[.]com/8166706728852850.xml hxxp://feed43[.]com/3210021137734622.xml hxxp://www.webrs |
| url | http://feeds.rapidfeeds.com/88604/ | 622.xml hxxp://www.webrss[.]com/createfeed.php?feedid=49966 hxxp://feeds.rapidfeeds[.]com/88604/ Script to Decrypt Dead Drop Resolvers 1 2 3 4 5 6 7 8 9 1 |
| url | http://www.webrss.com/createfeed.php?feedid=49966 | 66706728852850.xml hxxp://feed43[.]com/3210021137734622.xml hxxp://www.webrss[.]com/createfeed.php?feedid=49966 hxxp://feeds.rapidfeeds[.]com/88604/ Script to Decrypt De |
From the original article
9 min read at unit42.paloaltonetworks.com
In the past few months, Unit 42 has observed the Patchwork group, alternatively known as Dropping Elephant and Monsoon , conducting campaigns against targets located in the Indian subcontinent. Patchwork threat actors utilized a pair of EPS exploits rolled into legitimate, albeit malicious, documents in order to propagate their updated BADNEWS payload.
By Brandon Levene, Brittany Barbehenn · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.