Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

xHunt Campaign: Newly Discovered Backdoors Using Deleted Email Drafts and DNS Tunneling for Command and Control

Summary: Unit 42 reported that the xHunt campaign, active since at least July 2018 and targeting Kuwait government and shipping organizations, compromised a Microsoft Exchange server using two PowerShell backdoors: TriFive, which reads commands from base64-encoded email drafts in the Deleted Items folder and runs them every five minutes, and Snugy, a CASHY200 variant that uses DNS tunneling and runs every 30 minutes. The actors created scheduled tasks named ResolutionHosts and ResolutionsHosts in the WDI folder on Aug. 28 and Oct. 22, 2019 to imitate a legitimate Windows task, and TriFive used stolen credentials from a legitimate account to log into the inbox.

Why it matters: The command channel here is an email draft sitting in Deleted Items, written by an attacker logged in as a real user - no malware callback, no external infrastructure to block, and nothing your email gateway would flag. The stolen account credentials were in place before the backdoor was installed, which means the intrusion was already past authentication when the tooling arrived.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Threat Actors & Nation-State
Related