Grasshopper Hackers Mimic As Penetration Testing Service To Deploy Malware

Hackers often mimic penetration testing services to disguise their malicious activities as legitimate security assessments. 

By imitating authorized security testing, attackers can exploit the trust and access typically granted to legitimate penetration testers, allowing them to move more freely within networks and systems while avoiding immediate suspicion.

While the Israeli government investigated possible threats, it discovered an infection chain using a suspicious domain as a command and control server. 

Public malware and custom components are mixed in this attack. 

Grasshopper as Pen Test Services

Late 2023 saw targeted attacks launched against private companies that used common techniques, target-specific infrastructure, and custom WordPress sites for payload delivery.

"Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!"- Free Demo 

These campaigns affect diverse entities across unrelated sectors. 

However, since it may not be a genuine security firm, this information should have been shared with the cybersecurity community without linking to recognized security firms or legitimate penetration testing operations.

The infection chain, probably targeting an Israeli government entity, begins with a VHD file, a pretty custom WordPress website.

Specifically crafted delivery WordPress website (Source – Harfanglab)

It’s a VHD that comes with all the hidden files, like the HTA file, which has an image as the decoy and transfers malware components to the %TEMP% folder, followed by launching a first-stage Nim downloader.

Decoy image displayed when the HTA is executed (Source – Harfanglab)

This downloader retrieves a second-stage payload from a controlled server. The final payload combines Donut, a shellcode generation framework, with Sliver, an open-source Golang trojan.

Donut disables security measures such as AMSI and WLDP before running Sliver, which gives the attacker full control of the victim’s machine through a specified command and control server.

More investigations revealed another infrastructure the operators probably used for such attack campaigns.

Infection chain (Source – Harfanglab)

These domains are fakes corresponding to popular brands such as Carlsberg and SintecMedia, although some may not have been related to intelligence gathering in general.

One of these campaigns posed as the Israeli government intending to aim at individuals or local businesses.

A famous WordPress site connected a VHD file and URL that was once redirected to a “rickroll” video, perhaps part of geofencing techniques.

The targets do not seem to have any common pattern, as the fake brand identities could mean different things.

⁤This campaign’s intriguing aspects include its narrow scope, targeted approach, and use of mostly open-source tools. ⁤

⁤However, the commonly available tools could be employed for conducting sophisticated operations, making it difficult for threat researchers to analyze these attacks.

Are you from SOC/DFIR Teams? - Sign up for a free ANY.RUN account! to Analyse Advanced Malware Files

Tushar Subhra

Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Recent Posts

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS devices.…

21 hours ago

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch Experts…

3 days ago

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan exploits…

3 days ago

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on organizations…

3 days ago

Google Chrome Security, Critical Vulnerabilities Patched

Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to millions…

3 days ago

Notorious WrnRAT Delivered Mimic As Gambling Games

WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling games…

4 days ago