Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

xHunt Campaign: Attacks on Kuwait Shipping and Transportation Organizations

Summary: Unit 42 observed previously unknown tools between May and June 2019 targeting transportation and shipping organizations in Kuwait, beginning with a backdoor named Hisoka and followed by custom tools including Sakabota, Netero, Killua, Gon and EYE, all apparently built by one developer who named them after Hunter x Hunter characters. Hisoka v0.9 added an email-based command-and-control channel that used Exchange Web Services and stolen credentials to create email drafts rather than send messages, so no email was detected outbound or inbound.

What you should know: The actor used a legitimate Exchange account and saved drafts over HTTPS to relay commands, meaning the C2 traffic looked like normal mailbox activity to outbound and inbound email inspection. In one case the actor copied Hisoka and two Killua files to an additional system within 30 minutes using a third-party help desk service account.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related