Hackers deploy WIP26 espionage to abuse cloud infrastructure in targeted telco attacks

SentinelLabs detailed on Thursday a new threat cluster that it tracks as WIP26, which has been identified to target telecommunication providers in the Middle East. Assessed as espionage-related, WIP26 relies heavily on public cloud infrastructure in an attempt to evade detection by making malicious traffic look legitimate. 

The group has been characterized by abusing public cloud infrastructure – Microsoft 365 Mail, Microsoft Azure, Google Firebase, and Dropbox – for malware delivery, data exfiltration, and C2 purposes. It also involves the use of backdoors, dubbed CMD365 and CMDEmber, which abuse Microsoft 365 Mail and Google Firebase services for C2 purposes.

“The WIP26 activity is initiated by precision targeting of employees through WhatsApp messages that contain Dropbox links to a malware loader,” the SentinelLabs report said. “Tricking employees into downloading and executing the loader ultimately leads to the deployment of backdoors that leverage Microsoft 365 Mail and Google Firebase instances as C2 servers. We refer to these backdoors as CMD365 and CMDEmber, respectively. The main functionality of CMD365 and CMDEmber is to execute attacker-provided system commands using the Windows command interpreter.”

The use of public cloud infrastructure for C2 purposes is an attempt to make malicious C2 network traffic look legitimate and therefore make detection harder for defenders, according to the report. “The CMD365 and CMDEmber samples we observed masquerade as utility software, such as a PDF editor or browser, and as software that conducts update operations. The masquerading attempt involves the use of filenames, application icons, and digital signatures that indicate existing software vendors,” it added.

The report provides details on the WIP26 threat activity and further context around the use of CMD365 and CMDEmber.

SentinelLabs said that the initial intrusion vector observed involved precision targeting. “The threat actor sent WhatsApp messages to targets with download links to backdoor malware. Further, the targeting of telecommunication providers in the Middle East suggests the motive behind this activity is espionage-related. Communication providers are frequent targets of espionage activity due to the sensitive data they hold. Finally, evidence suggests that once they established a foothold, the threat actor targeted users’ private information and specific networked hosts of high value,” the report added.

The report said that the hacker behind WIP26 activity appears to have made some OPSEC errors. “For example, the JSON file where the Google Firebase C2 server stores data exchanged with machines infected by CMDEmber is publicly accessible at the time of writing, providing further insights into the WIP26 activity.”

The use of public cloud infrastructure by APT groups is not unheard of. These threat actors continue to innovate in order to stay stealthy. This includes leveraging public cloud infrastructure for C2 purposes to blend in and make the detection of C2 traffic harder for defenders.

For example, the North Korean APT 37 (InkySquid) has used the Microsoft Graph API for C2 operations. Further, similar to CMD365, the SIESTAGRAPH backdoor, used in the REF2924 intrusion set targeting the Foreign Affairs Office of an ASEAN member,  leverages the Microsoft Graph API to access Microsoft 365 Mail for C2 communication, the SentinelLabs report said. “Also, the DoNot threat group, which is known for targeting Kashmiri non-profit organizations and Pakistani government officials, has abused Google Firebase Cloud Messaging to stage malware. Finally, threat activity tied to APT28 (Fancy Bear) has leveraged Microsoft OneDrive services for C2 purposes,” it added.

In conclusion, SentinelLabs said that the WIP26 activity is a relevant example of threat actors continuously innovating their TTPs in an attempt to stay stealthy and circumvent defenses. “The use of public cloud infrastructure for malware hosting, data exfiltration, and C2 purposes aims at making malicious traffic look legitimate. This gives attackers the opportunity to conduct their activities unnoticed. We hope that this report helps to emphasize this tactic in the continuous effort to identify threat groups engaged in targeting critical industries,” it added.

SentinelLabs researchers provided last September details of an advanced threat actor called Metador that primarily targets telecommunications, internet service providers, and universities in several countries across the Middle East and Africa. The operators are highly aware of operations security, managing carefully segmented infrastructure per victim while deploying intricate countermeasures in the presence of security solutions.

Earlier this month, SentinelLabs announced that it identified ‘the first’ Linux variant of Cl0p ransomware group. Investigation has identified that the ELF executable contains a flawed encryption algorithm making it possible to decrypt locked files without paying the ransom.

Anna Ribeiro

Industrial Cyber News Editor. Anna Ribeiro is a freelance journalist with over 14 years of experience in the areas of security, data storage, virtualization and IoT.