Cyberespionage APT Group Hides Behind Cryptomining Campaigns

An advanced threat group called Bismuth recently used cryptocurrency mining as a way to hide the purpose of their activity and to avoid triggering high-priority alerts.

Coin mining is typically regarded as a non-critical security issue, so the method allowed the actor to establish persistence and move laterally on the compromised network, at the same time monetizing from the attack.

Cryptojacking decoy

Bismuth’s regularly targets human and civil rights organizations, but its list of victims includes multinational companies, financial services, educational institutions, and entities in the government sector.

The actor has been running cyberespionage operations since at least 2012. Its attacks have increased in complexity since then, combining custom tools with freely available ones.

In recent campaigns, though, Bismuth launched Monero coin miners on compromised systems belonging to private and government organizations in France and Vietnam.

Also Read: How To Prevent WhatsApp Hack: 7 Best Practices

Microsoft detected the attacks that occurred in July and August, saying that the cryptojacking activity did not change the actor’s objective, continuing to monitor and steal information of interest.

“The use of coin miners by BISMUTH was unexpected, but it was consistent with the group’s longtime methods of blending in”

– Microsoft

The hackers studied the victims before sending spear-phishing emails created for a specific recipient to obtain initial access. The researchers say that the attacker even corresponded with the victim to build trust and increase the chance of a successful infection.

Old, legit apps for DLL sideloading

They used Gmail accounts specifically created for each recipient. Microsoft believes Bismuth hackers used information from public sources to determine their targets and customize the messages.

Bismuth also used DLL side-loading, a widely used technique that takes advantage of how Windows applications handle these file types to load a malicious DLL that spoofs a legitimate one.

In the attacks over the summer, the actor planted older versions of several applications that were still vulnerable to DLL side-loading. Among them were Microsoft Defender, the Sysinternals DebugView tool, McAfee on-demand scanner, and Microsoft Word 2007.

The researchers were able to attribute these attacks to Bismuth based on a custom malware named KerrDown dropped during the infection chain and used exclusively by Bismuth. The malware impersonated a DLL from Microsoft Word 2007 and executed in the context of the application.

Also Read: 15 Best Tools For Your Windows 10 Privacy Settings Setup

Network discovery and spreading

According to Microsoft, Bismuth spent about a month identifying computers on the victim network before they moved laterally to servers that enabled them to spread further.

While scanning the network, the hackers collected details about the domain and local administrators, checked user privileges on local machines, and pulled device information.

Using PowerShell, the actor could fly under the radar and execute multiple cmdlets that helped with moving across the network and carry out the attack. The activity involved the following stages:

• steal credentials from the Security Account Manager (SAM) database
• collect domain group and user information
• connect to devices via WMI (Windows Management Instrumentation)
• collect credentials from security logs under Event ID 680 (possibly targeting logs related to NTLM fallbacks)
• collect domain trust info and ping database and file servers identified during reconnaissance
• install a Cobalt Strike beacon via DLL side loading, using an outdated copy of McAfee on-demand scanner that runs with elevated privileges

Installing the coin miners preceded credential theft efforts on local systems (via Mimikatz). Although the hackers did not make a lot of money from cryptojacking (over $1,000 from all attacks), it did pay off as it acted as a smokescreen for the real activity.

They hid this activity, too, by registering them under a legitimate service name. In one case, they used a common Virtual Machine process.

“Because BISMUTH’s attacks involved techniques that ranged from typical to more advanced, devices with common threat activities like phishing and coin mining should be elevated and inspected for advanced threats”

– Microsoft

The tactic used by this threat to blend in with regular network activity and the use of common threats that are often disregarded as non-critical allow them to run their operation without the pressure of immediate action against them.

Microsoft says that Bismuth shares similarities with a nation-state group called OceanLotus (APT 32), believed to work for the Vietnamese government.

The researchers recommend companies not to dismiss identified common threats like coin mining and to investigate them for more advanced hacker activity.