Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

xHunt Campaign: xHunt Actor’s Cheat Sheet

Summary: Unit 42 found that developers of the Sakabota tool, used in the xHunt campaign against Kuwait organizations, ran two rounds of testing on July 21 and 23 and August 6 and 7, 2018, compiling variations and submitting them to online antivirus scanning services to see which vendors detected them. The oldest known sample contained an embedded resource named 'k' holding a cheat sheet of example commands for persistence, network reconnaissance, pivoting, credential dumping, data exfiltration and RDP configuration, which Unit 42 says is the first time it has seen a malware developer include such a cheat sheet to assist an operator.

Key Takeaway: The cheat sheet names tools including Mimikatz, Plink, Powercat, ProcDump and SharpHound/BloodHound, and its example commands contain domains and IP addresses - such as 213.202.217[.]31, tied to CASHY200 payload delivery - that confirm the group's infrastructure, so defenders now have the actor's likely post-compromise playbook in hand.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related