Grasshopper Hackers Mimic As Penetration Testing Service To Deploy Malware

Hackers often mimic penetration testing services to disguise their malicious activities as legitimate security assessments. 

By imitating authorized security testing, attackers can exploit the trust and access typically granted to legitimate penetration testers, allowing them to move more freely within networks and systems while avoiding immediate suspicion.

While the Israeli government investigated possible threats, it discovered an infection chain using a suspicious domain as a command and control server. 

Public malware and custom components are mixed in this attack. 

Grasshopper as Pen Test Services

Late 2023 saw targeted attacks launched against private companies that used common techniques, target-specific infrastructure, and custom WordPress sites for payload delivery.

"Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!"- Free Demo 

These campaigns affect diverse entities across unrelated sectors. 

However, since it may not be a genuine security firm, this information should have been shared with the cybersecurity community without linking to recognized security firms or legitimate penetration testing operations.

The infection chain, probably targeting an Israeli government entity, begins with a VHD file, a pretty custom WordPress website.

Specifically crafted delivery WordPress website (Source – Harfanglab)

It’s a VHD that comes with all the hidden files, like the HTA file, which has an image as the decoy and transfers malware components to the %TEMP% folder, followed by launching a first-stage Nim downloader.

Decoy image displayed when the HTA is executed (Source – Harfanglab)

This downloader retrieves a second-stage payload from a controlled server. The final payload combines Donut, a shellcode generation framework, with Sliver, an open-source Golang trojan.

Donut disables security measures such as AMSI and WLDP before running Sliver, which gives the attacker full control of the victim’s machine through a specified command and control server.

More investigations revealed another infrastructure the operators probably used for such attack campaigns.

Infection chain (Source – Harfanglab)

These domains are fakes corresponding to popular brands such as Carlsberg and SintecMedia, although some may not have been related to intelligence gathering in general.

One of these campaigns posed as the Israeli government intending to aim at individuals or local businesses.

A famous WordPress site connected a VHD file and URL that was once redirected to a “rickroll” video, perhaps part of geofencing techniques.

The targets do not seem to have any common pattern, as the fake brand identities could mean different things.

⁤This campaign’s intriguing aspects include its narrow scope, targeted approach, and use of mostly open-source tools. ⁤

⁤However, the commonly available tools could be employed for conducting sophisticated operations, making it difficult for threat researchers to analyze these attacks.

Are you from SOC/DFIR Teams? - Sign up for a free ANY.RUN account! to Analyse Advanced Malware Files

Tushar Subhra

Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Recent Posts

Nearest Neighbor Attacks: Russian APT Hack The Target By Exploiting Nearby Wi-Fi Networks

Recent research has revealed that a Russian advanced persistent threat (APT) group, tracked as "GruesomeLarch"…

1 day ago

240+ Domains Used By PhaaS Platform ONNX Seized by Microsoft

Microsoft's Digital Crimes Unit (DCU) has disrupted a significant phishing-as-a-service (PhaaS) operation run by Egypt-based…

2 days ago

Russian TAG-110 Hacked 60+ Users With HTML Loaded & Python Backdoor

The Russian threat group TAG-110, linked to BlueDelta (APT28), is actively targeting organizations in Central…

2 days ago

Earth Kasha Upgraded Their Arsenal With New Tactics To Attack Organizations

Earth Kasha, a threat actor linked to APT10, has expanded its targeting scope to India,…

2 days ago

Raspberry Robin Employs TOR Network For C2 Servers Communication

Raspberry Robin, a stealthy malware discovered in 2021, leverages advanced obfuscation techniques to evade detection…

2 days ago

145,000 ICS Systems, Thousands of HMIs Exposed to Cyber Attacks

Critical infrastructure, the lifeblood of modern society, is under increasing threat as a new report…

2 days ago