Folder2iso. how to#
Folder2iso. pdf#

T1071 - Application Layer Protocol: HTTPS heartbeat of 62 seconds and jitter of 39% T1204.002 - User Execution: Malicious File (Windows Explorer Shortcut) T1218.011 - Signed Binary Proxy Execution: Rundll32 T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass (ISO Image) T1566.002 - Phishing: Spearphishing Link (Link downloads ISO image) T1566.003 - Phishing: Spearphishing via Service (Constant Contact) T1584.006 - Compromise Infrastructure: Web Services (compromised the Constant Contact account of USAID) NOBELIUM, the Russian threat actor behind SolarWinds compromised Constant Contact to send malicious emails with a weaponized ISO file

Folder2iso. pdf#

The ISO file contained a decoy PDF file, a DLL, and a shortcut file that executed Rundll32.exe: T1204.002 & T1218.011Ĭommand and Control is established via HTTPS: T1071.001& T1573.Opening an ISO file bypassed Mark-of-the-Web security control, evading defenses: T1553.005 ISO files are images that can be mounted as “Disk Drives”.NOBELIUM sends emails to USAID subscribers with a link that downloads an ISO file: T1566.002.This is significant because most subscribers are accustomed to receiving emails from USAID via Constant Contact and are essentially a known, trusted email they are used to receiving: T1566.003 Constant Contact is an email service to send newsletters and updates to anyone that subscribes.NOBELIUM, the Russian threat actor behind SolarWinds, compromised the Constant Contact account of USAID: T1584.006.Microsoft was quick to release an alert and then a number of follow up posts when it realized that NOBELIUM, the same threat actor behind the attacks against SolarWinds, SUNBURST, TEARDROP, and GoldMax, compromised Constant Contact:Ĭyber Threat Intelligence reports can be dense and long, so here is a quick summary: We also committed an atomic test to the Atomic Red Team project.

Folder2iso. how to#

For this post, we look at the recent attack from NOBELIUM and show how to emulate these techniques with SCYTHE. Matt Graber was quick in putting together a PowerShell script that highlights why attackers likely choose ISO/IMG as a delivery mechanism: it evades SmartScreen because Mark-of-the-Web (MOTW) cannot be applied to non NTFS volumes. We had not considered nor documented using an ISO file as a defense evasion method so we started looking into it after this report was published. Microsoft released a blog post late on Thursday about a new sophisticated email-based attack from NOBELIUM, the SolarWinds threat actor, where they compromised Constant Contact to send malicious emails with a weaponized ISO file. Evading Defenses with ISO files like NOBELIUM