While the threat actors attempted to masquerade the activity as a standard ransomware campaign, Microsoft found the unrecoverable actions show destruction and disruption were the ultimate goals.
Previous MERCURY attacks have been observed targeting on-premises environments, however, the impact in this case notably also included destruction of cloud resources. Microsoft said MERCURY likely worked in partnership with another actor that Microsoft tracks as DEV-1084, who carried out the destructive actions after MERCURY’s successful operations had gained access to the target environment.
MERCURY likely exploited known vulnerabilities in unpatched applications for initial access before handing off access to DEV-1084 to perform extensive reconnaissance and discovery, establish persistence, and move laterally throughout the network, oftentimes waiting weeks and sometimes months before progressing to the next stage, the researchers said in a post.
DEV-1084 was then later observed leveraging highly privileged compromised credentials to perform destruction of resources, including server farms, virtual machines, storage accounts, and virtual networks, and send emails to internal and external recipients.
Microsoft tracks the destructive actions documented in this blog post as DEV-1084. DEV-1084 likely worked in partnership with MERCURY – an Iran-based actor U.S. Cyber Command has publicly linked to Iran’s Ministry of Intelligence and Security (MOIS).
DEV-1084 publicly adopted the DarkBit persona and presented itself as a criminal actor interested in extortion, likely as an attempt to obfuscate Iran’s link to and strategic motivation for the attack.
The link between the DEV-1084 cluster and MERCURY was established based on the following evidence:
- DEV-1084 operators were observed sending threatening emails from 146.70.106[.]89, an IP address previously linked to MERCURY.
- DEV-1084 used MULLVAD VPN, the same VPN provider historically used by MERCURY.
- DEV-1084 used Rport and a customized version of Ligolo. MERCURY has also been observed using Rport and a similar version of Ligolo in previous attacks.
- DEV-1084 used the vatacloud[.]com domain for command and control (C2) during this incident. Microsoft assesses with high-confidence the vatacloud[.]com domain is controlled by MERCURY operators.
MERCURY gains access to the targets through remote exploitation of an unpatched Internet-facing device, Microsoft researchers said. MERCURY then handed off access to DEV-1084. It is not currently clear if DEV-1084 operates independently of MERCURY and works with other Iranian actors or if DEV-1084 is an ‘effects based’ sub-team of MERCURY that only surfaces when MERCURY operators are instructed to carry out a destructive attack.
Microsoft assesses with moderate confidence the threat actors attempted several times and succeeded to perform initial intrusion leveraging exposed vulnerable applications, for example, continuing to exploit Log4j 2 vulnerabilities in unpatched systems in July last year.
After gaining access, the threat actors deploy several tools and leverage techniques to maintain persistence, which provide effective and continued access to compromised devices, such as the following:
- Installing web shells
- Adding a local user account and elevating privileges to local administrator
- Installing legitimate remote access tools, such as RPort, Ligolo and eHorus
- Installing a customized PowerShell script backdoor
- Stealing credentials
Once persistence is established, the threat actors perform extensive discovery leveraging common native Windows tools and commands such as netstat and nltest. Such reconnaissance activities were seen leveraged throughout the attack chain.
The threat actors consistently perform extensive lateral movement actions using the acquired credentials within a targeted environment. These actions mainly involved:
- Remote scheduled tasks to launch their customized PowerShell backdoor
- Windows Management Instrumentation (WMI) to launch commands on devices
- Remote services to run encoded PowerShell commands
After infecting the new devices, the threat actors often installed the same persistence mechanisms as described above. After each main attack step, the actors did not always immediately continue their operations but would wait weeks and sometimes months before moving to the next step, the researchers said.
For execution and communication, the threat actors leverage several C2 servers and sometimes deploy tunnelling tools, such as Ligolo and OpenSSH, commonly leveraged to stay under the radar of security teams and solutions.
Click here for more on the Microsoft report.