Full Report
In the cybersecurity community, we may hear analysts say, “Oh, threat actors change their tactics…”, and at times, they may include the word “always” as part of that statement. However, the question at hand is, “Does the data really show that to be the case?” What are we truly seeing in real-world incidents?
Analysis Summary
# Tool/Technique: Habitual Living-off-the-Land (LotL) and RMM Persistence
## Overview
This report summarizes the habitual behaviors of threat actors who leverage native Windows utilities and legitimate Remote Monitoring and Management (RMM) tools to maintain persistence and exfiltrate data. Despite the frequent introduction of new exploits (e.g., CVE-2023-48788), the post-exploitation tactics—specifically using "Living-off-the-Land" techniques—remain remarkably consistent, allowing defenders to build high-fidelity detections based on these predictable habits.
## Technical Details
- **Type**: Technique / Tool Framework
- **Platform**: Windows
- **Capabilities**: Persistence, Data Exfiltration, Command and Control (C2), File Download.
- **First Seen**: Ongoing; significantly documented in early 2024 (March–April).
## MITRE ATT&CK Mapping
- **[TA0003 - Persistence]**
- [T1219 - Remote Access Software]
- **[TA0011 - Command and Control]**
- [T1105 - Ingress Tool Transfer]
- [T1071.001 - Application Layer Protocol: Web Protocols]
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]
- [T1048 - Exfiltration Over Alternative Protocol]
- **[TA0005 - Defense Evasion]**
- [T1202 - Indirect Command Execution]
## Functionality
### Core Capabilities
- **Living-off-the-Land (LotL):** Use of native Windows binaries (Binaries) to perform non-standard tasks, such as using `finger.exe` for data transfer to bypass firewall restrictions.
- **RMM Deployment:** Installation of legitimate tools like **ScreenConnect** and **SimpleHelp** to establish a permanent, "legal" backdoor into the environment.
- **Scripted Downloads:** Use of PowerShell to retrieve secondary payloads from public web-hook services.
### Advanced Features
- **Protocol Abuse:** Utilizing the Finger protocol (Port 79) for exfiltration, a method rarely monitored by modern security stacks.
- **Exploit Stacking:** Quickly integrating new vulnerabilities (e.g., Fortinet/FortiClient EMS CVE-2023-48788) into existing delivery pipelines for the same RMM payloads.
## Indicators of Compromise
- **File Names:**
- `finger.exe` (Abnormal execution patterns)
- SimpleHelp installer/service files
- ScreenConnect (ConnectWise) installers
- **Network Indicators:**
- `https[:]//webhook[.]site` (Used for initial payload hosting/script retrieval)
- Unexpected outbound traffic on Port 79 (Finger protocol)
- **Behavioral Indicators:**
- `powershell.exe` commands calling `webhook.site`.
- `finger.exe` invoked with remote IP addresses for data transfer.
- Creation of unauthorized local administrative accounts following RMM installation.
## Associated Threat Actors
- **Akira Ransomware** (Associated with specific persistence tokens and account modifications).
- **Noberus/ALPHV** (Affiliates known for using backup utilities for exfiltration).
- **Unnamed Threat Clusters** (Identified by consistent use of `finger.exe` and specific IP addresses).
## Detection Methods
- **Behavioral Detection:** Monitor for native binaries (`finger.exe`, `certutil.exe`) making external network connections.
- **RMM Monitoring:** Audit the installation of RMM tools that are not part of the organization’s standard software inventory (Shadow IT/Malicious RMM).
- **Process Lineage:** Alert on PowerShell instances spawned from web-facing services (e.g., MSSQL or web servers) that attempt to download files.
## Mitigation Strategies
- **Binary Renaming/Disabling:** Disable or restrict execution of unnecessary native binaries like `finger.exe` if not required for business operations.
- **Software Allowlisting:** Implement application control to prevent the installation of unauthorized RMM tools (SimpleHelp, ScreenConnect, AnyDesk).
- **Network Segmentation:** Block outbound traffic on uncommon ports (like Port 79) and restrict access to public code/hook hosting sites from sensitive servers.
## Related Tools/Techniques
- **Kawalocker:** A ransomware variant often deployed via similar LotL methods.
- **CloudFlare Tunnels:** Used by actors (like Akira) for stealthy persistence.
- **Living off the Land Binaries and Scripts (LOLBAS):** The broader project documenting these types of native tool abuses.