The Chinese state-sponsored threat actor Hafnium has been found using a brand new malware to maintain access on a breached Windows endpoint, with the help of hidden scheduled tasks, Microsoft has announced.
The Microsoft Detection and Response Team (DART) says the group has been leveraging a so far unknown vulnerability (a zero-day) in its attacks.
"Investigation reveals forensic artifacts of the usage of Impacket tooling for lateral movement and execution and the discovery of a defense evasion malware called Tarrask that creates 'hidden' scheduled tasks, and subsequent actions to remove the task attributes, to conceal the scheduled tasks from traditional means of identification,” DART explained.
Spotting the malware
Tarrask hides its activity from "schtasks /query" and Task Scheduler, by deleting any Security Descriptor registry value.
The Chinese criminals have been using these hidden tasks to re-establish the connection to C2 after the device restarts.
One of the ways to find the hidden tasks is to manually inspect Windows Registry for scheduled tasks without a Security Descriptor Value in their Task Key, it was further explained.
Another way to spot the malware is to enable the Security.evtx and the Microsoft-Windows-TaskScheduler/Operational.evtx logs and look for key events, in connection to any tasks "hidden" using Tarrask.
The Redmond giant has also recommended enabling logging for 'TaskOperational' in the Microsoft-Windows-TaskScheduler/Operational Task Scheduler log and keeping an eye out for outbound connections from critical Tier 0 and Tier 1 assets.
"The threat actors in this campaign used hidden scheduled tasks to maintain access to critical assets exposed to the internet by regularly re-establishing outbound communications with C&C infrastructure," DART says.
"We recognize that scheduled tasks are an effective tool for adversaries to automate certain tasks while achieving persistence, which brings us to raising awareness about this oft-overlooked technique."
In the same announcement, Microsoft also added that Hafnium targeted the Zoho Manage Engine Rest API authentication bypass vulnerability, to place a Godzilla web shell with similar properties, something Unit42 previously discovered, as well.
Since August 2021, Microsoft adds, Hafnium has been targeting organizations in the telecommunication, internet service provider and data services sectors, concluding that the group broadened its scope of interest.
Via: BleepingComputer