New Cyber Espionage Campaigns Targeting Palestinians - Part 2: The Discovery of the New, Mysterious Pierogi Backdoor

Research by: Cybereason Nocturnus Team

Background

Since December 2019, the Cybereason Nocturnus team has been investigating a campaign targeting Palestinian individuals and entities in the Middle East, mostly within the Palestinian territories. This campaign uses social engineering and decoy documents related to geopolitical affairs and relations between the Palestinian government, and references Egypt, Hezbollah, and Iran.

Part one of this research investigates the Spark campaign, where attackers use social engineering to infect victims, mainly from the Palestinian territories, with the Spark backdoor. For more information about part one, click here.

During the attacks, victims are infected with a previously undocumented backdoor, dubbed Pierogi by Cybereason. This backdoor allows attackers to spy on targeted victims. Cybereason suspects that the backdoor may have been obtained in underground communities rather than home-grown, as the evidence found in the code of the backdoor suggests it may have been developed by Ukranian-speaking hackers.

The tactics, techniques, and procedures (TTPs), content, and theme of the decoy documents, as well as the victimology observed in the campaign, resemble previous attacks that have targeted Palestinians. In particular, these campaigns appear to be related to attacks carried out by a group called MoleRATs (aka, Gaza Cyber Gang, Moonlight), an Arabic-speaking, politically motivated group that has been operating in the Middle East since 2012.

Key Points

• Cyber Espionage with a New Malware: The Cybereason Nocturnus team has discovered recent, targeted attacks in the Middle East to deliver the Pierogi backdoor for politically-driven cyber espionage.
• Targeting Palestinians: The campaigns seems to target Palestinian individuals and entities, likely related to the Palestinian government.
• Using Geopolitically-charged Lure Content: The attackers use specially crafted lure content to trick their targets into opening malicious files that infect the victim’s machine with the Pierogi backdoor. The decoy content of the malicious files revolves around various political affairs in the Middle East, specifically targeting the tension between Hamas and other entities in the region.
• Perpetrated by an Arabic-speaking APT, MoleRATs: The modus-operandi of the attackers as well as the social engineering decoy content seem aligned with previous attacks carried out by an Arabic-speaking APT group called MoleRATs (aka Gaza Cybergang). This group has been operating in the Middle East since 2012.

For a synopsis of this research, check out the Molerats & Pierogis Threat Alert.

Table of Contents

• Infection Vector via Social Engineering
• Decoy Content
• Infection Vector: Analysis of the Malicious Word Document
• Analysis of the Pierogi Backdoor
• Persistence Mechanism
• C2 Communication by the Pierogi Backdoor
• Recent Infrastructure
• Conclusion
• MITRE ATT&CK Breakdown
• Indicators of Compromise

Infection Vector via Social Engineering

Similar to previous attacks, this campaign starts with social engineering. In one instance, it lures victims to open an email attachment. In others, it persuades victims to download a report about a recent political affair pertaining to the Middle East and specifically to Palestinian matters. In most cases, the downloaded file is either an executable that masquerades as a Microsoft Word document or a weaponized Microsoft Word document. 

Malicious file named “Reports on major developments__347678363764”,  uploaded to VirusTotal from the Palestinian territories.

Decoy Content 

As soon as the victim double-clicks on the dropper, they are presented with the decoy document. The document lowers the victim’s suspicions by distracting them with a real document while the dropper installs the backdoor. However, some of the documents also play an additional role in the attack. While some are more neutral, quoting from newspapers and the media, others seem to report fake news to spread misinformation that serves a political agenda. With regards to decoy content themes, this campaign resembles previous campaigns reported in blogs by Vectra, Unit 42, and Talos. The contents of the decoy documents seems to include: 

• Potentially fake documents that appear to be issued by the Palestinian government.
• Meetings minutes of different Palestinian organizations.
• News about Hamas and the Palestinian National Authority.
• Potentially fake, leaked Hamas documents.  
• Criticism of and embarrassing content about Hamas.

 Select screenshots from the above decoy content: 

Excerpt of the decoy documents presented to the victims.

Potentially leaked Hamas document detailing expenses for Hamas 32th anniversary celebrations.

In addition to the documents, the content includes a number of political cartoons that criticize Hamas’ relations with Iran and Hamas’ standing as a resistance movement. 

Infection Vector: Analysis of the Malicious Word Document 

While the majority of infections in this campaign did not originate from Malicious Microsoft Word documents, the Cybereason Nocturnus team found several weaponized Microsoft Word documents with an embedded downloader macro that downloads and installs the backdoor used in this attack. 

Malicious Microsoft Word Document uploaded from the Palestinian territories.

When the victims open the document, they are encouraged to click on Enable Content, which causes the embedded malicious macro code to run.

Contents of the weaponized Microsoft Word document.

The macro code embedded in the document is rather simple and is not obfuscated. In fact, it is almost unusual in its unsophistication. 

The macro code does the following: 

1. Downloads a Base64 encoded payload from the following URL:
   hxxp://linda-callaghan[.]icu/Minkowski/brown.
2. Writes the decoded payload to C:\ProgramData\IntegratedOffice.txt.
3. Decodes the Base64 payload and writes the file to C:\ProgramData\IntegratedOffice.exe.
4. Runs the executable file and deletes the .txt file.

Malicious macro code found in the phishing document.

Analysis of the Pierogi Backdoor 

Pierogi, the backdoor in this attack, appears to be a new backdoor written in Delphi. It enables the attackers to spy on victims using rather basic backdoor capabilities. While it is unknown at this point whether the backdoor was coded by the same members of the group behind the attacks, there are indications that suggest that the malware was authored by Ukranian-speaking malware developers. The commands used to communicate with the C2 servers and other strings in the binary are written in Ukrainian. 

This is why we chose to name the malware Pierogi, after the popular East European dish. 

Strings embedded in the backdoor binary that show Ukranian words.

The backdoor has the following capabilities: 

• Collects information about the infected machine.
• Uploads files to the attackers’ server.
• Downloads additional payloads.
• Takes screenshots from the infected machine.
• Executes arbitrary commands via the CMD shell.

In addition to spy features, the backdoor also implements a few checks to ensure it is running in a safe environment. Specifically, it looks for antivirus and other security products. 

1. The backdoor queries Windows for installed antivirus software using WMI: SELECT * FROM AntiVirusProduct
2. It looks for specific antivirus and security products installed on the infected machine, such as Kaspersky, eScan, F-secure and Bitdefender.

Strings of security products found in the backdoor code.

Persistence Mechanism

The backdoor achieves persistence using a classic startup item autorun technique: 

1.  A shortcut is added to the the startup folder: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.
2. Once the user logs on to the infected machine, the shortcut points to the file binary location in the C:\ProgramData\ folder.

The backdoor persistence shown via Sysinternals Autoruns tool.

The GUID generated by the malware is saved in a file called GUID.bin. This file is created in the same folder as the binary of the backdoor  (C:\ProgramData\GUID.bin).

Contents of the GUID.bin file generated by the backdoor.

C2 Communication by the Pierogi Backdoor

The backdoor has rather basic C2 functionality implemented through a predefined set of URLs: 

1. Sending machine information and a heartbeat to the C2:
URL: hxxp://nicoledotson[.]icu/debby/weatherford/Yortysnr

The information sent to the C2 includes: 

• cname:  computer name, username, and GUID
• av: Name of detected antivirus
• osversion: version of the operating system
• aname: the location of the malware on the infected machine

Sending basic information about the infected machine

2. Requesting commands from the C2 server:

URL: hxxp://nicoledotson[.]icu/debby/weatherford/Ekspertyza 

Ekspertyza means expertise or examination in Ukranian. There are 3 basic commands coming from the server in the form of md5 hashes:

Receiving command from the server to upload a screenshot of the infected machine’s screen.

3. Uploading data (mainly screenshots) to the C2: 

URL: hxxp://nicoledotson[.]icu/debby/weatherford/Zavantazhyty

Zavantazhyty means to load or download in Ukranian. This command is used to upload collected data to the C2 server. For example, in some instances the backdoor uploads screenshots taken from an infected machine, as can be seen in the example below.

The backdoor uploads a screenshot of the infected machine to the C2 server.

4. Removing information:

URL: hxxp://nicoledotso[.]icu/debby/weatherford/Vydalyty

Vydalyty means to remove or delete in Ukrainian. The malware can delete various requests based on the command below.

Excerpt from the code that handles deletion requests from the C2 server.

Recent Infrastructure

The records of the domains and IPs involved in this campaign seem to show that the attackers created a new infrastructure specifically for this campaign. The domains were registered in November 2019 and operationalized shortly after, as shown below. 

PassiveTotal UI: An activity timeline of the malicious domain Linda-callaghan[.]icu.

An activity timeline of the malicious domain Nicoledotson[.]icu.

Conclusion

In part two of this research, we examined the Pierogi campaign. Cybereason suspects this  campaign targets Palestinian individuals and entities in the Middle East, specifically directed at  those in the Palestinian government. The threat actors behind the campaign use social engineering to infect their victims with the Pierogi backdoor for cyber espionage purposes. 

The threat actor behind the attack invested considerable time and effort to lure their victims with specially-crafted documents that target Palestinian individuals and entities in the Middle East. In our analysis, we reviewed the TTPs and the decoy content, and pointed out the similarities between previous attacks that have been attributed to MoleRATs, an Arabic-speaking, politically motivated group that has operated  in the Middle East since 2012.

The Pierogi backdoor discovered by Cybereason during this investigation seems to be undocumented and gives the threat actors espionage capabilities over their victims. Based on the Ukranian language embedded in the backdoor, Cybereason raises the possibility that the backdoor was obtained in underground communities by the threat actors, rather than developed in-house by the group. 

Learn how to protect against these types of attacks with the right roles for SIEM and EDR. Download our white paper.

Indicators of Compromise

Click here to download the MoleRATs IOCs (PDF)

MITRE ATT&CK BREAKDOWN