Popping Eagle: How We Leveraged Global Analytics to Discover a Sophisticated Threat Actor
Summary: Unit 42 used global statistical baselines of signed-application behavior to flag clicksharelauncher.exe, signed by Barco N.V., resolving the domain dnszonetransfer[.]com in only one environment and on three unique agents out of thousands. The loader side-loaded an unsigned uxtheme.dll (compiled name CoL_Final_Lib.dll, a different SHA256 on each of the three hosts) that decoded a C2 URL via one-byte XOR and pulled a Go-written second stage, Going Eagle, used as a reverse SOCKS proxy for RDP and SMB scanning, Impacket wmiexec, PsExec, lsass dumping and secretsdump against the domain controller.
Key Takeaway: The attacker reused local administrator passwords across hosts and still failed only because Cortex XDR blocked the lsass dump and secretsdump - the same password reuse in your estate, without that agent coverage, is the whole intrusion.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026