A RAT in the spreadsheet.

Dave Bittner: Hello, everyone, and welcome to the CyberWire's "Research Saturday." I'm Dave Bittner and this is our weekly conversation with researchers and analysts tracking down the threats and vulnerabilities, solving some of the hard problems, and protecting ourselves in a rapidly evolving cyberspace. Thanks for joining us. [ Music ]

Aaron Beardslee: One of our researchers in India picked up I believe it was from Reversing Labs and she ran with it when she realized it was an active C2.

Dave Bittner: That's Aaron Beardslee, manager of threat research at Securonix. The research we're discussing today is titled "Analyzing Sheet Creep." Sheet Creep is up again with different config obfuscation. [ Music ] Let's set the table here and tell the story for us. My understanding from reading the research is that this malware family wasn't entirely new, that Sheet Creep activity has taken place before.

Aaron Beardslee: Yeah. So that is something that is super interesting with this particular campaign evolution. The -- and I personally had to look that up myself because -- and same with our researchers that worked on this particular campaign was that there were -- there's an existing Z scaler research that actually went over this Sheet Creep in its I don't want to say, meh, infancy, or maybe just the start of a new design of existing C2 frameworks like custom frameworks that are coming out of what is attributed to APT 36 where they have existing rats that have been named and then this one is -- that started some time earlier in the year that then became this now unnamed Sheet Creep rat. So we picked up the evolution of what we believe is the same sample that -- or the same attribution that Z scaler picked up on.

Dave Bittner: Well, let's walk through it together here. How would someone find themselves in the cross hairs of these threat actors and what happens if they find themselves infected?

Aaron Beardslee: Typically in this case with this C2 campaign it's targeting the Indian government. So when it comes to other organizations or other countries those are more like attacks of opportunity where this particular campaign is targeting fence -- geofenced in India. So the things that you would be looking for, and that's one of the interesting things with Sheet Creep is you're asking me, "How would you threat hunt this or know you're actually infected?" Am I right?

Dave Bittner: Yeah.

Aaron Beardslee: Yeah. So this one is - and this is where when you look at the design and architecture of a threat actor's tooling like that is the kind of appreciation for their design that leads in to my answer of this question. So try to find where the malware actually lands. Okay. So you have the first piece is what the user's do to themselves. So this one started out with an iso and I still to this day I try to understand why somebody would actually open an iso they got from the internet. But again this would be somebody opens an iso. Say they think it's legitimate for whatever reason. The have the iso file. They open it. They see a link file that they're like, "Okay. This shortcut." Or it's something they don't even see or recognize it's a shortcut. They see a PDF file. So they've fallen for the lure. And then the dropper execution which the design of this is hence typically when you have nation state quality malware everything is happening in the background. Even some of this stuff is hidden from our security tools. So then you have the actual scheduled task that gets created and that's going to be where the artifacts start landing where they're visible. But this is where a normal user is probably not going to be looking. And this is where you would have to rely on your security teams to be monitoring for abnormal or new artifacts getting created in places like your Microsoft vault, an unsigned or a new binary landing in a registry key that is new. If you're monitoring for like new registry keys or schedule tasks getting created and then from there you are hoping for some kind of telemetry going out that. And this is the aspect of Sheet Creep that is very hard to catch which looking at the way they designed their C2 server I'm like, "Wow. This is -- this is clever." Because I myself have built my fair share of malware and payloads that will call back to like havoc or CobaltStrike. And it's really challenging. So this C2 channel that goes to the Google cloud is going to completely blend in with the rest of what someone is normally going to be doing. Like it's Google name space. It's Google IP addresses. So that part of it, the network telemetry, is going to be I would argue off the table for your average SOC analyst and it would take a very dedicated and skilled threat hunter to be able to see the nuanced connection from this particular custom rat. I'm a big end point telemetry guy so the -- I'm looking for -- because I mean you have your initial infection. You have okay the threat actor was successful in getting on your box. What do they do? Like what are they going to execute next? What are their steps in completing their task or fulfilling their agenda for that particular campaign? They have to do something with their session. So in this case I would be looking for like command artifacts. What is the abnormal parent child process relationship that's going to be tipping off a SOC analyst and even the more trained advanced threat hunters? So beginning to end that would be where I would point someone to start looking or at least a SOC. Like this is what you're going to want to look for.

Dave Bittner: Well, you mentioned one of the standout elements to me which is that they're using Google Sheets as command and control. Can you walk us through how that works and why that's so effective? A great place for attackers to hide.

Aaron Beardslee: Yeah. That. So when we first discovered this new version of the -- how the actual C2 works so this custom payload, this rat, when it sets itself up and then when it starts to communicate with the Google Sheets API it's actually enumerating the sheet that it's working off of and it's looking at, well, am I already here? Is the system that is compromised already found in the sheet? It then looks for the tabs that it's -- that has its individual compromised systems. And then it will go through and say, "Okay. Here's the beacon." It's your first pulse. And then it writes the bay 64 encoded commands in to that sheet. And then the rat will pull four commands. It's a very clever way of rather than the usual like framework that you have in like havoc or Cobalt Strike where you have your beacon sessions that you can just chew up commands to send to your demons or your CobaltStrike beacons, this is where the threat actors are just dropping their commands in the actual sheet and the rat is reading from that sheet. And then executing based off of what is put in the cell that the rat is actually reading. And then of course there's the rate limiting piece where it's they can't like overload the rat with a bunch of different commands. So that's a very high level of how that C2 channel works. Like I'd love to see the code [inaudible 00:10:10].

Dave Bittner: Yeah. Isn't that interesting? I mean somehow despite the fact that, you know, we're talking about adversaries that there is a certain amount of curiosity and dare I say, you know, respect for their trade craft.

Aaron Beardslee: Yeah. You know, this is -- if you ever hear me talk to a crowd of red teamers I'm like, "Man, you guys are so talented and creative." I would have the same kind of conversation with if I was sitting down with APT 36. I'd be like, "Why do you guys have to not be good guys?"

Dave Bittner: Right. Right. Couldn't you use your talents for good?

Aaron Beardslee: Yeah. And actually Marcus Hutchins is a really good example of like a hacker with morality. Right?

Dave Bittner: Yeah.

Aaron Beardslee: So he was like, "Wait. I'm doing what for who?" Whoa. Whoa. Whoa. We're not doing that anymore. And now he's doing really good work for the cybersecurity community like putting his skills to really good use. So, you know, props to that guy for actually having a moral compass and trying to help versus the rest of the APT groups that are doing what they're doing. [ Music ]

Dave Bittner: We'll be right back. [ Music ] One of the things that really stood out to me was your team actually authenticated to the attacker's live command and control infrastructure. That's not something we hear about every day. What did you all find when you got in there?

Aaron Beardslee: So this is something that when I came in to the management position of this team -- because I'm a blue teamer at heart, but I understand that to craft a good defense you need to have a really strong offense. You need to know how to attack a system. And when it comes to like threat emulation what better way to get a bead on what the bad guys are doing than to infect yourself and monitor? So in this case my team whenever we have a live C2 or a good sample that is active we will run it in our cyber range that is it's a fully fleshed out domain that looks real. And we go in and look at whatever C2 or whatever we can get out of that particular connection. In this case we got to see the sheets. Now full transparency. I personally wasn't the one that actually saw the connection and actually watched the enumeration of the bad guy's C2 infrastructure. But the research report that I reviewed showed that we found ourselves in the actual sheet and we saw the rest of what was currently collected in that particular C2 with a bunch of I mean the usual automated sandboxes and researcher systems and empty sheets and the one thing that we zero in on are like the actual real targets. And that's because I mean when you have an active C2 and we are able to connect to it and maybe there's something we need to like let an organization or authorities know like we're looking for that kind of stuff.

Dave Bittner: Yeah.

Aaron Beardslee: Because if somebody's popped we want to, you know, let them know. Hey, guys. Did you know this is happening?

Dave Bittner: You know, the report describes several stealth techniques. I mean you talk about things like hiding in the windows vault directory and running PowerShell entirely in memory. Were there any particular techniques that either impressed you or concerned you the most from a defender's perspective?

Aaron Beardslee: Yeah. In fact the running and memory piece. That one. Whenever -- again this is the appreciation for the creativity of the design of this particular rat and how it works. Whenever as a threat hunter when I'm looking at malware and I'm like, "Okay. That's cool." You've got a connection to the system. I'm going to watch everything you do. But when you have things happening in memory like in this case the system management automation name space, that place in memory, in the process of the rat, that's sitting in that scheduled task vault. Commands that are coming from that Google Sheets are running in that process's memory. So it's not bubbling up any kind of like PowerShell telemetry or Sysmon Event ID 1 or Windows 4688 events. Like it's very similar to -- and if I had to guess the architecture of this rat would be very similar to like execute assembly from havoc and Cobalt Strike where everything's running in memory and then the results are happening either through like conhost or just through that process itself. So an example of like something abnormal would be if you're enumerating active directory through your beacon or in this case this rat. You would see like strange LDAP connections coming from a process that shouldn't be communicating to your domain controller. Things like that. So that was something that I thought was really interesting with an invasion technique that this particular sample used. But then also the evolution of how they're hardening their own rat where they're like they're the previous variants with the spreadsheet IDs where it used to be stored as plain text strings and now they're XOR obfuscated and they have a key that's used to decrypt run time by that just in time or that JIT function. So that's another piece of the hardening of this sample that I thought was really interesting. Yeah. Those were the two big ones. I mean there's a lot of really cool concepts that are in this. And, like I said, this was very well built.

Dave Bittner: Yeah. Well, given that all the network traffic looks like legitimate Google API traffic let's say I'm a security operations senator -- or center analyst. What are some indicators that could tip me off that something's amiss?

Aaron Beardslee: When I'm threat hunting or when I'm asked questions like these I'm trying to visualize the flow of the actual attack. And what I could predict or expect that I could like pick up on as like an abnormality. When it comes to like abnormal behavior in this case we have like just the network connection by itself where you have a system that is it keeps a long running pulse to the Google cloud like for all -- from a SOC's point of view, from an analyst's point of view, they're just seeing a connection to an API. Or too like a Google IP and it's encrypted. I mean it's going over 4443, HTTPS, and you're -- unless you're going to run -- you know, okay. This. If I was going to try to combat this, I just thought of this, if you have SSL inspection on your systems then you could potentially see the decrypted mechanisms going through something like a -- like a web proxy or if you have like Palo Alto's SSL inspection on your systems which I would hope that government entities that are being targeted in this way would actually leverage that tool so that they can actually see what's happening. But beyond that say you're a softer target and you don't have that kind of security tooling available to you. Then the network traffic is probably not where you're going to catch this guy.

Dave Bittner: Well, let's touch on attribution here. The report says with moderate confidence you attribute it to ATP 36. What led you to that assessment? >> So this is whenever we get samples that are themed in certain ways and we look at -- before we make a determination we'll look to see like where things are connecting to, what is the naming convention, is there any relation to other samples that are available and see if there's a common thread between like the techniques to where we can say this particular sample we're looking at is very similar to this other sample. It's also connecting back to C2 here. And it looks like it's targeting this particular group. So in this case that India strategic partnership week where that is very much themed at Indian diplomatic targets and C2 infrastructure going where it was going, that's where we were looking at the relationship between the C scaler sample and the other ATP 36 operations. So that's where that attribution was given to this particular campaign. I see. So what do your recommendations for the defenders in our audience here -- I mean based on the information you've gathered what are the take aways?

Aaron Beardslee: First and foremost don't open up isos from the internet. I mean that should go without saying, but you know in the case of like -- and I have to be somewhat sympathetic here because if there -- if you have a threat actor that is government aligned they know how to take advantage of the psychological warfare piece to this. So if there's a conflict happening in a region and the opportunity to send spear phishing documents at officials in the government where your likelihood of success is higher then they might just double click on it to be like, "You know what? I need to see what this is." Due to either stress, panic, whatever. So slow down. Be calm. Don't just open things. The second piece. Like I don't know. Do you have file extensions enabled on your system?

Dave Bittner: Well, I'm on a Mac. So.

Aaron Beardslee: Ah. Okay. Fair point. Okay. So in this case --

Dave Bittner: But I see where you're coming from.

Aaron Beardslee: You see where we are going with this... So like when one of the things that I even tell my friends and family like, "Turn on your file extensions." So in the case of if you're a target of a campaign like this where you open up the iso and you see something that has like multiple file extensions and the last file extension is the one that you are wanting to pay attention to then you're like, "Okay. This is actually not a PDF." So that is like just a way to give yourself better insight or just know what you're -- know what you're doing. Know what you're clicking on.

Dave Bittner: Yeah. Educational component.

Aaron Beardslee: Yes. Yeah. Totally. Like the -- like I said at the very beginning, like a good defense requires understanding the offense. So I try to tell the like my family and friends and even other colleagues I'm like, "Here's some -- like do this." And you can probably catch a lot of stuff yourself even if you open up the iso because the iso doesn't automatically execute anything. You have -- it's like a two step thing where it's like turning the safety off, turning a second safety off, and then pulling the trigger.

Dave Bittner: Right.

Aaron Beardslee: From there after those first few parts then it goes to like the actual SOC and threat hunter and analysts where you're looking at if you haven't installed sysmon on your endpoints or turned on PowerShell logging, although in this case the way that PowerShell is actually used actually wouldn't bubble up that particular telemetry, but I digress. Look for scheduled task creation like abnormal schedule tasks, unsigned binaries. If you can enable application white listing it's a pain to manage, but it will stop a lot of campaigns like this. As a cell inspection like with your web proxies that would also help expose some of these C2 channels. So end point monitoring. I think when organizations rely heavily on EDR by itself and something gets past your EDR you're now blind to what's happening on the end point. So then you're relying on the rest of the flow of normal behavior in your organization, in your network. So then you start threat hunting like abnormal connections to other systems. So that would then go to just knowing your own environment and looking for like abnormality from an individual system. So I mean we could keep going in the threat hunting world of all the different --

Dave Bittner: Right. Right.

Aaron Beardslee: Like ways you could -- you can hunt down bad guys that are on a compromised system. But that's where -- that's where I would -- I would start. Education. Understanding what you're doing. Don't let things cause you to panic. End point telemetry. I highly recommend sysmon, PowerShell logging. Layer your defenses. And application white listing. [ Music ]

Dave Bittner: Our thanks to Aaron Beardslee from Securonix for joining us. The research is titled "Analyzing Sheet Creep." Sheet Creep is up again with different config obfuscation. We'll have a link in the show notes. And that's "Research Saturday" brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire@n2k.com. This episode was produced by Liz Stokes. We're mixed by Elliott Peltzman and Tre Hester. Our executive producer is Jennifer Eiben. Peter Kilpe is our publisher and I'm Dave Bittner. Thanks for listening. We'll see you back here next time. [ Music ]