Full Report
In this blog, Huntress SOC investigators unravel the lateral movement and persistence of an interesting threat actor and their novel infrastructure
Analysis Summary
# Threat Actor: [Unattributed / "Novel November" Actor]
## Attribution & Identity
* **Actor Identification:** The threat actor remains currently unattributed to a specific named group (e.g., APT or FIN). Huntress SOC investigators identified them through their distinct use of "novel infrastructure" and specific persistence techniques observed in November 2024.
* **Aliases:** None specified.
* **Known Associations:** The actor demonstrates tradecraft common to ransomware affiliates, specifically utilizing brute-force methods and offensive security tools, though no specific group association was finalized in the report.
## Activity Summary
In early November 2024, the actor conducted a multi-stage operation starting with the exploitation of a public-facing RD-Web instance. After gaining a foothold via brute force, the actor moved laterally across the network using `PsExec` to execute batch files designed to disable security features and establish persistent remote access via a modified MeshAgent installation.
## Tactics, Techniques & Procedures
* **Brute Force (T1110):** Targeting non-MFA’d RD-Web instances.
* **Lateral Movement (T1021.002):** Using `PsExec` with wildcard commands (`\\*`) to execute across all domain computers simultaneously.
* **Disabling Security Tools (T1562.001):** Utilizing batch scripts (`mimon.bat`) to remove LSA protection.
* **Credential Discovery (T1003.001):** Enabling WDigest via registry modification to facilitate plaintext credential storage in memory.
* **Persistence / Remote Access (T1219):** Deploying a renamed MeshAgent (masquerading as `nvspbind.exe`) for persistent Command and Control (C2).
* **Masquerading (T1036.005):** Renaming malicious binaries to match legitimate virtualization tools (`nvspbind.exe`).
* **Firewall Modification (T1562.004):** Using `openrdp.bat` to modify firewall rules and enable RDP.
## Targeting
* **Sectors:** Not restricted to a specific sector; targets organizations with public-facing, poorly secured RDP/RD-Web infrastructure.
* **Geography:** Global (based on the nature of automated brute-force attempts).
* **Victims:** Not explicitly named; described as organizations utilizing RD-Web without Multi-Factor Authentication (MFA).
## Tools & Infrastructure
* **Malware/Tools:**
* **MeshAgent:** An open-source remote management tool repurposed for C2.
* **PsExec:** Legitimate Sysinternals tool used for lateral movement.
* **Batch Scripts:** `openrdp.bat` and `mimon.bat`.
* **Infrastructure:**
* **C2 Server:** `wss[://]193.46.255[.]73:443/agent[.]ashx`
* **C2 Hostname:** `WIN-O5926T00T93`
* **Brute Force IPs:**
* `217.138.216[.]60`
* `23.158.40[.]185`
* `147.135.112[.]230`
* `31.220.5[.]23`
* `78.141.202[.]136`
* `147.45.79[.]193`
## Implications
The actor demonstrates a high level of efficiency by using native administrative tools (`PsExec`) to scale an attack across an entire domain instantly. By modifying system configurations to store credentials in plaintext (WDigest), they ensure long-term access even if initial entry points are closed. The use of legitimate-sounding filenames for remote access agents increases the dwell time by evading basic file-name-based detection.
## Mitigations
* **Enforce MFA:** Mandatory Multi-Factor Authentication for all public-facing services, especially RD-Web and RDP.
* **Disable WDigest:** Ensure WDigest authentication is disabled and LSA Protection is enabled to prevent plaintext credential harvesting.
* **Restrict PsExec:** Limit the use of `PsExec` to authorized administrative workstations and monitor for wildcard usage (`\\*`) in command arguments.
* **Egress Filtering:** Block outbound traffic to known malicious IPs and monitor for unauthorized WebSocket (`wss://`) connections from non-standard binaries.
* **Application Whitelisting:** Monitor for "Living off the Land" binaries executing from unusual paths (e.g., `nvspbind.exe` running from `C:\Program Files\Windows NT\`).