Tactics and Techniques

​

Exploitation Tactics

​

Proxyshell Exploitation

Department 40 conducted extensive Proxyshell exploitation campaigns targeting Microsoft Exchange servers worldwide.

​

Campaign Scale

Documented targeting across multiple countries:

• India: 52+ targets exploited
• Greece: 34+ Exchange servers compromised
• Belgium: 31+ targets attacked
• Canada: Multiple targets identified
• Egypt: Various entities compromised

Mass exploitation conducted during May-June 2022 timeframe based on log timestamps.

​

Exploitation Process

1. Target Identification: Scanning for vulnerable Exchange servers
2. Vulnerability Exploitation: Using CVE-2024-1709 and Proxyshell vulnerabilities
3. Initial Access: Gaining authentication bypass
4. Webshell Deployment: Installing persistent access mechanisms
5. Credential Harvesting: Extracting user credentials and domain information

​

Target Selection

Proxyshell campaigns targeted:

• Corporate email infrastructure
• Government Exchange servers
• Financial institution mail servers
• Professional services organizations
• Healthcare entities

​

Webshell Deployment

Multiple webshell variants employed:

​

Webshell Types

1. ASP Webshells:
   • webshell.asp
   • m0s.asp
   • file.asp
   • Custom variants for Exchange OWA paths
2. Deployment Locations:
   • /owa/auth/OutlookOU.aspx
   • /owa/auth/webclient.aspx
   • Custom Exchange authentication paths
3. Capabilities:
   • File upload and download
   • Command execution
   • Credential harvesting
   • Network reconnaissance

​

Python Framework

Custom Python-based webshell management framework:

• Command Interface: Python scripts for attacker-side command management
• Remote Execution: RCE capabilities (rce5.py, RCE4.py)
• Connection Management: connect.py for session handling
• Centralized Control: Framework for managing multiple compromised hosts

​

BellaCiao Malware

Department 40 developed and deployed the BellaCiao malware family, publicly analyzed by BitDefender.

​

Variant 1: C# Webshell Dropper

Technical Details:

• .NET-based dropper service
• Disguised as legitimate Windows services:
  • “Exchange Agent Diagnostic Services”
  • “Microsoft Monitoring Exchange Services”
  • “Microsoft Agent Services”
  • “WinUpdateService”

Capabilities:

• Drops C# webshell on target systems
• File upload functionality
• File download capabilities
• Command execution interface
• Persistence through service installation

Known Usage:

• Turkish Foreign Ministry attack documented
• Multiple webshell deployments
• Sustained access operations

​

Variant 2: PowerShell Reverse Proxy

Technical Details:

• PowerShell-based implementation
• Uses Plink (PuTTY suite) for reverse proxy
• Customized PowerShell webserver based on publicly available code
• Reference: Modified version of Start-Webserver.ps1 from venom framework

Components:

• iis.ps1: PowerShell webserver script
• iis.txt: Configuration and logs
• Plink integration for tunneling

Capabilities:

• Reverse proxy establishment
• Network tunneling
• Command and control communications
• Bypassing network restrictions

​

TAGHEB System

Internal documents reference the “TAGHEB system” for Windows infection and access:

• Designed for Windows operating system targeting
• Access and persistence mechanisms
• Details contained in leaked operational documents

​

Social Engineering Operations

​

AMEEN ALKHALIJ Recruitment Campaign

Sophisticated social engineering operation targeting UAE security personnel.

​

Campaign Design

Target Audience: Former government and security employees from the United Arab Emirates Operational Method:

1. Established fake recruitment website: ameen-alkhalij.nu
2. Posed as legitimate employment opportunity
3. Collected credentials and personal information
4. Gathered intelligence on UAE security personnel

​

Infrastructure

Server Logs Available: Complete access logs from the ameen-alkhalij.nu server showing:

• Visitor IP addresses
• Access timestamps
• User agent information
• Attack reconnaissance activities

Timeline: Operations documented through January 2025 with extensive access logging

​

Objectives

1. Credential Harvesting: Collecting login credentials from targets
2. Intelligence Gathering: Profiling former UAE security personnel
3. Network Mapping: Identifying connections and relationships
4. Operational Preparation: Building target database for future operations

​

Technical Capabilities

​

Credential Harvesting

Multiple methods employed:

1. Webshell Access: Extracting credentials from compromised systems
2. Phishing Operations: Social engineering for credential collection
3. Domain Enumeration: Active Directory user discovery
4. Password Extraction: From memory and stored credentials

​

DNS Beaconing

Command and control communications via DNS:

• Covert C2 channel establishment
• Data exfiltration through DNS queries
• Avoiding traditional network monitoring
• Maintaining persistent communications

​

Network Reconnaissance

Systematic intelligence gathering:

• Active Directory enumeration
• Network mapping and topology discovery
• User and group identification
• Service and application discovery
• Credential and privilege mapping

​

Operational Security

​

Anti-Detection Measures

Documented testing against security products:

• Antivirus Testing: Malware tools tested against:
  • Microsoft Defender
  • Kaspersky
  • Avira
  • ESET
  • Other major AV products
• Stealth Operations: Focus on avoiding detection during operations

​

Infrastructure Security

Procurement Methods:

• Multiple procurement identities for server purchases
• Use of front companies
• Compartmentalized infrastructure
• Operational servers separated by function:
  • Attack servers
  • Tunnel servers
  • File storage servers
  • C2 infrastructure

Access Control:

• Documented credentials for server access
• Internal communication platforms (ISABELLE, 3CX, SIGNAL)
• File extraction systems
• Centralized infrastructure management

​

Attack Lifecycle

​

Initial Access

1. Vulnerability Exploitation: Proxyshell, CVE-2024-1709, other CVEs
2. Social Engineering: Phishing and fake recruitment sites
3. Credential Compromise: Harvested credentials for initial entry

​

Persistence

1. Webshell Deployment: Multiple ASP and custom webshells
2. Service Installation: BellaCiao dropper services
3. Backdoor Placement: Multiple access methods maintained
4. Credential Collection: For future access

​

Privilege Escalation

1. Domain Enumeration: Identifying privileged accounts
2. Credential Harvesting: Administrator and service account credentials
3. Lateral Movement Preparation: Mapping privilege paths

​

Collection and Exfiltration

1. File Access: Via webshells and backdoors
2. Email Access: Through compromised Exchange servers
3. Credential Databases: User and system credentials
4. Intelligence Gathering: Documents and communications
5. DNS Exfiltration: Covert data extraction

​

Documented Attack Examples

​

Turkish Foreign Ministry

• Method: BellaCiao malware deployment
• Access: Sustained webshell access
• Duration: Extended operation documented
• Objective: Government intelligence collection

​

Mass Proxyshell Campaign

• Timeline: May-June 2022
• Scale: 200+ targets across multiple countries
• Method: Automated exploitation and webshell deployment
• Success Rate: Documented successful compromises in logs

​

UAE Security Personnel

• Operation: AMEEN ALKHALIJ social engineering
• Target: Former government and security employees
• Method: Fake recruitment website
• Duration: Extended campaign with detailed logging

​

Training and Development

Leaked documents reveal:

• Training Programs: Internal training materials
• Technical Documentation: Espionage techniques and tools
• Malware Development: Source code and testing procedures
• Intelligence Reports: Analysis of Israeli entities and other targets
• Operational Guides: Including “The Group’s Phishing Guide”

​

Tools and Frameworks

​

Custom Malware

• BellaCiao (both variants with source code)
• CYCLOPS (referenced in public reporting)
• Custom webshells (ASP variants)
• Python command framework
• PowerShell scripts

​

Third-Party Tools

• Plink (PuTTY suite) for tunneling
• Modified open-source tools
• Standard penetration testing utilities

​

Infrastructure

• Comprehensive server inventory
• Attack infrastructure
• Tunnel servers
• Storage servers
• Internal communication platforms