Forest Global Training Partners

Cyber Risks · Cisco Talos

Attackers use domain fronting technique to target Myanmar with Cobalt Strike

Summary: Cisco Talos found a campaign active since at least August 2021 that used an obfuscated Meterpreter stager to reflectively load Cobalt Strike beacon DLLs, with beacons from September 2021 fronted through www[.]mdn[.]gov[.]mm, a domain owned by the Myanmar government's state digital newspaper. The beacon's DNS request resolved to a Cloudflare IP while the Host header redirected traffic to the attacker-controlled test[.]softlemon[.]net, a domain re-registered on Aug. 5, 2021 and hosted on an IP at a Russian provider.

Bottom line: The beacon carried watermark 305419896, previously tied to a leaked Cobalt Strike version also used by Maze ransomware and Trickbot, so the watermark gives defenders no attribution path. Talos notes the actor experimented across hosts from mid-August to September to perfect the fronting technique, meaning the final configuration was tested before it was aimed at victims.

Read the original at Cisco Talos ↗

Topics
Malware
Related