Rubeus

THREAT ANALYSIS: Cobalt Strike - IcedID, Emotet and QBot

Threat researchers reported that Emotet, IcedID, and QBot were used as initial access malware to quickly deliver Cobalt Strike on compromised Windows systems, sharply reducing the time defenders had to respond before hands-on-keyboard activity began. In observed intrusions, reconnaissance started within 6 to 8 minutes of infection, while Cobalt Strike was deployed in as little as under an hour to roughly two hours later. The activity was commonly initiated through targeted phishing emails carrying malicious Office documents and macros, with follow-on use of PowerShell, scheduled tasks, Run keys, or services to establish persistence and pull additional payloads.

APT techniques: Token theft via UpdateProcThreadAttribute. Simple C++ example. - cocomelonc

Security researchers detailed how attackers abuse Windows access tokens to impersonate users, elevate privileges, and move laterally across enterprise environments. The technique relies on the way Windows ties logon sessions, privileges, and cached credentials to access tokens, allowing an attacker with sufficient local rights to duplicate or impersonate another process token and launch a new process under that security context. One proof-of-concept shows a local administrator enabling SeDebugPrivilege, opening a privileged process such as winlogon.exe, duplicating its token, and using CreateProcessWithTokenW to spawn a process as SYSTEM. Additional analysis shows token manipulation extends beyond local privilege escalation into stealthier authentication abuse, including NETONLY logons, Pass-the-Hash, Pass-the-Ticket, and Overpass-the-Hash. Researchers said attackers can abuse Windows APIs such as LogonUserW, CreateProcessWithLogonW, DuplicateTokenEx, SetThreadToken, ImpersonateLoggedOnUser, and LsaCallAuthenticationPackage to create new logon sessions or alter authentication behavior without changing the visible local user context. Defenders were advised to watch for artifacts such as Event ID 4624 with LogonType 9 and to account for detection gaps where Kerberos ticket operations may occur without direct LSASS process access.

APT techniques: Access Token manipulation. Token theft. Simple C++ example. - cocomelonc

Emotet infection with Cobalt Strike - SANS ISC

Attacks on industrial control systems using ShadowPad - Kaspersky ICS CERT EN

Researchers reported a cyber-espionage campaign using the ShadowPad backdoor against industrial control system operators, telecommunications providers, and government-linked organizations in Pakistan, Afghanistan, Malaysia, and later Argentina-linked victimology. In several intrusions, attackers gained initial access through Microsoft Exchange Server exploitation tied to CVE-2021-26855, while another cluster used trojanized MSI installers for Pakistan government eOffice software to deliver a malicious mscoree.dll loader and encrypted payloads under SYSTEM privileges. Kaspersky said the activity began around March 2021 and assessed with high confidence that a Chinese-speaking threat actor was responsible, though it stopped short of a definitive link to HAFNIUM; Trend Micro likewise found overlaps with previously reported China-linked ShadowPad activity but said attribution remained inconclusive. The intrusions relied on multiple execution and persistence methods, including launching ShadowPad through the legitimate AppLaunch.exe, DLL hijacking via OleView with IVIEWERS.dll and IVIEWERS.dll.dat, and web-shell access consistent with tooling such as China Chopper. Post-compromise operations included credential theft, lateral movement, scheduled tasks, Cobalt Strike, PlugX, Mimikatz, procdump, Nextnet scanning, RAR archiving, and data exfiltration over BITS, indicating a sustained effort to harvest sensitive information from strategically important networks.

Emotet is Back - Cisco Blogs

Emotet now drops Cobalt Strike, fast forwards ransomware attacks

How attackers abuse Access Token Manipulation (ATT&CK T1134) | Elastic Blog