Premium Domain Names for Sale at CrocoDom.com
BlackBerry has discovered a new campaign we’ve dubbed “Silent Skimmer,” involving a financially motivated threat actor targeting vulnerable online payment businesses in the APAC and NALA regions. The attacker compromises web servers, using vulnerabilities to gain initial access. The final payload deploys payment scraping mechanisms on compromised websites to extract sensitive financial data from users.
The campaign has been active for over a year, and targets diverse industries that host or create payment infrastructure, such as online businesses and Point of Sales (POS) providers. We have uncovered evidence suggesting the threat actor is proficient in the Chinese language, and operates predominantly in the Asia-Pacific (APAC) region.
In this blog, we’ll dig into the tactics, techniques, and procedures (TTPs) used in this attack, and provide background on the threat actor currently running this campaign.
This campaign operates using at least five Privilege Escalations, one Remote Code Execution (RCE), one Remote Access, one Downloader/Stager, and one Post Exploitation tool.
T1218.005, T1070.006, T1036.005
T1105, T1071.001, T1573.001, T1090
Exploit Public-Facing Application T1190
Virtual Private Servers (VPS), HTTP File Server (HFS), Microsoft Azure, Cloudflare Fast Flux, Content Delivery Network (CDN)
Regional websites with payment data.
Web Servers running IIS and vulnerable Web Applications
In early May this year, the BlackBerry Threat Research and Intelligence team discovered a campaign targeting entities primarily in the Asia-Pacific region, and several victims across North America. The campaign operators exploit vulnerabilities in web applications, particularly those hosted on Internet Information Services (IIS). Their primary objective is to compromise the payment checkout page, and swipe visitors’ sensitive payment data.
The threat actor gains initial access by exploiting web applications facing the Internet. Once the attacker has obtained initial access to the web server, they deploy various tools and techniques, including open-source tools and Living Off the Land Binaries and Scripts (LOLBAS).
Our network infrastructure analysis indicated that the threat actor is operating their command-and-control (C2) servers to host all services used in this campaign. They run an HTTP File Server (HFS) to host a veritable arsenal of tools and post-exploitation payloads. Their C2 server also acts as a data exfiltration node and an endpoint reverse shell.
Figure 1: HTTP File Server hosting the threat actor’s toolkit for malicious post-exploitation actions
ITW Tool Name:
Remote Code Execution
Cobalt Strike Beacon
The threat actor targets vulnerable web applications for opportunistic exploitation. The victims identified thus far have all been individual websites. The group employs tools developed by GitHub user ihoney, including a port scanner and an implementation of CVE-2019-18935, notable for its former use by advanced persistent threat (APT) group HAFNIUM, and suspected Vietnamese crimeware actors XE Group, to exploit the legitimate software tool Telerik UI. The initial payload is a .NET assembly DLL that was generated using ihoney’s CVE-2019-18935 implementation.
Exploitation of CVE-2019-18935 can result in remote code execution (RCE). The exploit process, in this case, involves the attacker uploading a DLL to a specific directory on the target server. This step is completely dependent on the web server having write permissions. Once uploaded, the DLL is loaded into the application using an exploit that takes advantage of insecure deserialization. Insecure deserialization is a vulnerability in which untrusted/unknown data can be used to inflict a denial-of-service (DDoS) attack, cause malicious code to execute, bypass authentication, or otherwise abuse the logic behind a legitimate application.
The malicious DLL aims to abuse Windows-native binary Mshta.exe to execute an HTML Application (HTA) called MsMsp.hta, directly from the IP address 52[.]253[.]105[.]171.
Figure 2: HTML application execution via mshta.exe
The HTA file hosted on 52[.]253[.]105[.]171 is a VBScript that performs an ingress tool transfer via certutil.exe, to download server.ps1 from 4[.]216[.]137[.]19. VBScript is an Active Scripting language modeled on Visual Basic, a programming language developed by Microsoft.
Figure 3: VBScript downloading malicious ps1 via certutil
Pivoting to PowerShell, server.ps1 is a remote access tool (RAT) that allows an attacker to control a victim’s computer remotely. It opens a connection on a given port and gives the threat actor a comprehensive list of actions they can perform:
The server.ps1 RAT includes a hardcoded C2 at the beginning of the script of tk[.]tktktkcscscs[.]com, which attempts to connect via port 443. Further investigation of the C2 server reveals the threat actor is operating the C2 to host post-exploitation payloads on port 8080 via a HTTP file server. This file server hosts an array of tools, including Potato exploits, Godzilla generated C# webshells, PowerShell remote access scripts, HTA downloader scripts, PowerShell utility scripts, and Cobalt Strike beacons.
Figure 4: server.ps1 content
We also found Fast Reverse Proxy (RFP) in the toolkit, which allows the attacker to expose a local server located behind a Network Address Translation (NAT), a feature found in many firewalls that translates between external and internal IP addresses. The actor may also use Request for Proposal (RFP) as a means to bypass network restrictions and expose a compromised server located behind a NAT or firewall to the Internet, enabling unauthorized access and exploitation of internal resources.
Figure 5 below shows an overview of the objectives pursued by this PowerShell RAT when used in the intrusion.
Figure 5: server.ps1 TTPs overview of objectives
The exact choice of tools chosen and stored on the file server was deliberate. The attacker employs these tools to compromise the web server and elevate their privileges, with the intent to deploy a scraper in the payment checkout service of the victim web server.
The Godzilla C# webshell is one of the tools used in the attack. Godzilla is a webshell generator and management tool which was developed by the GitHub user BeichenDream, with its instructions written in a Chinese language. Godzilla webshells have been deployed in numerous campaigns by threat actors in recent years, with notable mentions including Unit42 and Microsoft. The BlackBerry Research and Intelligence team has noticed an increase in usage of Godzilla webshells in the APAC region and in the U.S. in the last few months.
In this particular campaign, we observed the use of “bypass.aspx”, a C# dynamic payload. The webshell is generated using an encryptor type of CSharp_AES_Raw. Webshells maintain persistent access to compromised web servers and enable remote code execution, as is the case with bypass.aspx. The key differentiator between Godzilla webshells and other webshells like ChinaChopper is the usage of AES encryption for its network traffic.
Figure 6: Example of a webshell generator
The webshell analyzes incoming HTTP POST requests, decrypts the data by employing a secret key, executing the decrypted content to perform additional tasks, and delivering the outcome through an HTTP response.
Figure 7: Payload handling via RijndaelManaged class
The developer of Godzilla has now integrated no less than 20 built-in plugins, which are utilized depending on the payload generated. For the C# dynamic payload, for example, here are some of the available plug-ins:
The compromised web application or web server constrains the webshell’s permissions. If the web application or web server works with administrator user account privileges, there is a potential for unauthorized access to systems or data. In cases where the account privileges are insufficient, the threat actor demonstrates their capability to easily escalate privileges by manipulating access tokens. That allows them to operate under a different user or system security context and perform various malicious actions.
We found numerous open-source privilege escalation tools hosted on their C2. The attacker’s robust arsenal included BadPotato, GodPotato, and SharpToken, which are also tools developed by the Godzilla developer BeichenDream, mentioned earlier. Also hosted on the C2 was Juicy Potato, a tool developed by Andrea Pierini and Giuseppe Trotta back in 2018, and Cobalt Strike beacons. Cobalt Strike is a legitimate adversary simulation tool, and beacons are Cobalt Strike’s payload that model the behaviors of an advanced actor; for example, by executing PowerShell scripts, logging keystrokes, downloading files, and spawning other payloads.
The threat actor utilizes all of these tools to elevate their permissions beyond that of the web application, so they can deploy their final payload.
When the event listener is triggered, a function is then called that retrieves and processes the values manually entered by the user in the form fields, such as billing information and credit card details.
Figure 8: Payment data exfiltration by the threat actor
During this processing, the values from each field are either concatenated (linked together sequentially) into a single variable, or stored in an object with various key-value pairs before being base64 encoded using window.btoa(). Once the data is processed, it is sent to a remote server for further action.
Figure 9: Victim’s payment data, when structured
This particular threat actor uses an HTTP file server deployed on a temporary virtual private server (VPS), primarily hosted on the Microsoft Azure cloud computing platform. The targets of the ‘Silent Skimmer’ campaign are vulnerable web applications all over the world.
We noted that a typical VPS node is online for less than a week. During that period, it acts as the primary C2 for newly exploited targets, which are usually just one or two compromised companies or entities. Each VPS node hosts the HTTP file server on either port 80 or 8080, while Cobalt Strike relies on port 80 and/or 443. One-off scripts and tools used post-exploitation are also hosted on this file server for delivery to the target post-exploitation.
One interesting point to note that came up in our investigation is that each VPS location appears to be chosen based on the target’s hosted location. For example, the threat actor set up one VPS in Canada to specifically use in an attack against Canadian businesses. When we found targets of this campaign in the United States, the VPS was typically hosted within the same state as the vulnerable web server.
The task of exfiltrating the scraped payment data is the only thing that moves to an entirely new infrastructure. Cloudflare is used for this task due to its fast flux feature, making it extremely difficult to trace traffic via Netflow. Fast fluxing is a technique that involves associating multiple IP addresses with a single domain name, and then changing out these IP addresses rapidly. Often, hundreds or even thousands of IP addresses are used in a single fast flux attack. This type of attack has been likened to a bank robber repeatedly switching license plates or getaway cars, so police can’t track them down.
The threat actor’s registered domains have obfuscated whois information to prevent the tracking of the domains’ registrars. Currently identified scrapers exfiltrate to www[.]krispykreme[.]one/Check.ashx and hxxps://cdn[.]nigntboxcdn[.]com/Nigntboxcdngetdata.php.
During our investigation into this campaign, BlackBerry identified victims across multiple industries and regions. Campaigns by this threat actor have historically targeted the APAC region but, since October of 2022, have started to include Canada and the United States, hinting that perhaps the threat actor is becoming emboldened by their past success, and is actively seeking out new and bigger targets.
The Silent Skimmer campaign targets diverse industries that host or assemble payment infrastructure, such as online businesses and Point of Sales (POS) providers. It also takes aim at web servers running ASP.NET and IIS, suggesting an opportunistic approach by the threat actor, rather than industry-specific targeting. The attacker focuses predominantly on regional websites that collect payment data, taking advantage of vulnerabilities in commonly used technologies to gain unauthorized access and retrieve sensitive payment information entered into or stored on the site.
Our analysis suggests that this actor has been active for over a year. The threat actor or group behind this campaign remains unknown at the time of writing. However, given that the GitHub repository they used is associated with Chinese-speaking developers, the code In PowerShell RAT is in simplified Chinese language, and the attacker’s C2 is located in Asia (specifically Japan), it’s likely the threat actor speaks the Chinese language and lives or operates in Asia.
The threat actor behind the “Silent Skimmer” campaign is currently actively exploring new targets and opportunities, moving its focus from Asia, to North America. The technical complexity of its operation hints that this may be an advanced or experienced actor. A prime example of this is how it deftly adjusts its network infrastructure according to the geolocation of the victims, so the Internet traffic around compromised servers might look natural to the casual observer.
Traditionally, some servers have been noted to lack the modern security technologies currently available for traditional endpoints. That makes them an attractive target for attackers, especially considering they are easier to maintain persistence on, and bearing in mind the sensitive type of data they process, specifically payment information. The Silent Skimmer campaign is an excellent example of how (relatively) easy it is for a motivated attacker to compromise IIS servers connected to the Internet.
Based on the existing research data and the expansion over time of the victims’ geolocation, we should expect more attacks against similar systems in the same and new regions in future.
Available upon request – see below.
Available upon request – see below.
Available upon request – see below.
These are based on server.ps1 execution by default, without commands sent by the threat actor
Available upon request – see below.
Tactic/ Technique/ Context
Available upon request – see below.
Disclaimer: The private version of this report is available upon request. It includes, but is not limited to, the complete and contextual MITRE ATT&CK® mapping, MITRE D3FEND™ countermeasures, Attack Flow by MITRE, and other threat detection content for tooling, network traffic, complete IoCs list, and system behavior. Please email us at email@example.com for more information.
The BlackBerry Research & Intelligence team examines emerging and persistent threats, providing intelligence analysis for the benefit of defenders and the organizations they serve.
© 2023 BlackBerry Limited. All rights reserved.
Premium Domain Names:
A premium domain name is a highly sought-after domain that is typically short, memorable, and contains popular keywords or phrases. These domain names are considered valuable due to their potential to attract more organic traffic and enhance branding efforts. Premium domain names are concise and usually consist of one to two words or two to four individual characters.
Top-Level Domain Names for Sale on Crocodom.com:
If you are looking for top-level domain names for sale, you can visit Crocodom.com. Crocodom.com is a platform that offers a selection of domain names at various price ranges. It is important to note that the availability of specific domain names may vary, and it’s recommended to check the website for the most up-to-date information.
Contact at firstname.lastname@example.org:
If you have any inquiries or need assistance regarding the domain names available on Crocodom.com, you can reach out to them via email at email@example.com. Feel free to contact them for any questions related to the domain names or the purchasing process.
Availability on Sedo.com, Dan.com, and Afternic.com:
Apart from Crocodom.com, you can also explore other platforms like Sedo.com, Dan.com, and Afternic.com for available domain names. These platforms are popular marketplaces for buying and selling domain names. Each platform may have its own inventory of domain names, so it’s worth checking multiple sources to find the perfect domain name for your needs.
#PremiumDomains #DomainInvesting #DigitalAssets #DomainMarketplace #DomainFlipping #BrandableDomains #DomainBrokers #DomainAcquisition #DomainPortfolio #DomainIndustry #DomainAuctions #DomainInvestors #DomainSales #DomainExperts #DomainValue #DomainBuyers #DomainNamesForSale #DomainBrand #DomainInvestment #DomainTrading