Grasshopper Hackers Mimic As Penetration Testing Service To Deploy Malware

Hackers often mimic penetration testing services to disguise their malicious activities as legitimate security assessments. 

By imitating authorized security testing, attackers can exploit the trust and access typically granted to legitimate penetration testers, allowing them to move more freely within networks and systems while avoiding immediate suspicion.

While the Israeli government investigated possible threats, it discovered an infection chain using a suspicious domain as a command and control server. 

- Advertisement -

Public malware and custom components are mixed in this attack. 

Grasshopper as Pen Test Services

Late 2023 saw targeted attacks launched against private companies that used common techniques, target-specific infrastructure, and custom WordPress sites for payload delivery.

"Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!"- Free Demo 

These campaigns affect diverse entities across unrelated sectors. 

However, since it may not be a genuine security firm, this information should have been shared with the cybersecurity community without linking to recognized security firms or legitimate penetration testing operations.

The infection chain, probably targeting an Israeli government entity, begins with a VHD file, a pretty custom WordPress website.

It’s a VHD that comes with all the hidden files, like the HTA file, which has an image as the decoy and transfers malware components to the %TEMP% folder, followed by launching a first-stage Nim downloader.

This downloader retrieves a second-stage payload from a controlled server. The final payload combines Donut, a shellcode generation framework, with Sliver, an open-source Golang trojan.

Donut disables security measures such as AMSI and WLDP before running Sliver, which gives the attacker full control of the victim’s machine through a specified command and control server.

More investigations revealed another infrastructure the operators probably used for such attack campaigns.

These domains are fakes corresponding to popular brands such as Carlsberg and SintecMedia, although some may not have been related to intelligence gathering in general.

One of these campaigns posed as the Israeli government intending to aim at individuals or local businesses.

A famous WordPress site connected a VHD file and URL that was once redirected to a “rickroll” video, perhaps part of geofencing techniques.

The targets do not seem to have any common pattern, as the fake brand identities could mean different things.

⁤This campaign’s intriguing aspects include its narrow scope, targeted approach, and use of mostly open-source tools. ⁤

⁤However, the commonly available tools could be employed for conducting sophisticated operations, making it difficult for threat researchers to analyze these attacks.

Are you from SOC/DFIR Teams? - Sign up for a free ANY.RUN account! to Analyse Advanced Malware Files