Threat Report: xHunt Targets Microsoft Exchange and IIS with Custom Backdoors

The xHunt advanced persistent threat group continues to pose a significant cybersecurity risk through sophisticated attacks targeting Microsoft Exchange and IIS web servers with custom-built backdoors.

This highly focused cyber-espionage operation has maintained persistent, multi-year campaigns primarily aimed at organizations in Kuwait, with particular emphasis on the shipping, transportation, and government sectors.

First identified in July 2018, xHunt has distinguished itself through a unique, evolving toolkit that uses malware named after characters from the popular anime series “Hunter x Hunter” the inspiration behind the group’s name.

The threat actors, also tracked as SectorD01, Hive0081, Cobalt Katana, and Hunter Serpens, have demonstrated exceptional technical capabilities and creativity in their attack methodologies.

The group employs diverse infiltration techniques, ranging from direct server compromises to elaborate credential-harvesting operations.

One of their most innovative tactics involved a watering hole attack on a compromised Kuwaiti government website.

The attackers injected a hidden HTML image tag pointing to an actor-controlled server, designed to passively harvest NTLM hashes from visitors by triggering automatic browser authentication attempts.

This technique leveraged a malicious SMB share reference using the file:// URI scheme, automatically capturing users’ NTLMv2 hashes when they visited the compromised page.

Custom Backdoor Arsenal

In direct compromises of Microsoft Exchange and IIS web servers, xHunt deploys a sophisticated suite of custom backdoors.

The BumbleBee webshell enables direct command execution on compromised servers, while PowerShell-based backdoors like TriFive and Snugy a variant of CASHY200 provide persistent access to victim networks.

These tools demonstrate the group’s advanced programming capabilities and deep understanding of Windows infrastructure.

Perhaps most notable is xHunt’s creative approach to command and control communications. The Hisoka and TriFive backdoors utilize Exchange Web Services to communicate by reading and writing email drafts within compromised user mailboxes, explicitly targeting the Drafts or Deleted Items folders.

This technique allows the attackers to blend malicious communications with legitimate email traffic, significantly complicating detection efforts.

The TriFive backdoor exemplifies this approach by logging into legitimate user mailboxes using previously stolen credentials, retrieving PowerShell payloads stored as email drafts, and executing commands transmitted through encrypted and base64-encoded draft messages with the subject line “555.”

Operational Timeline

The group’s major activities include campaigns between May and June 2019 targeting transportation and shipping firms in Kuwait with backdoors named Hisoka, Sakabota, Netero, and Killua.

During 2019-2020, xHunt actors compromised Microsoft Exchange Servers at Kuwaiti organizations, deploying the TriFive and Snugy PowerShell backdoors alongside the BumbleBee webshell to establish long-term persistence.

To maintain access, xHunt leverages scheduled tasks that execute its PowerShell backdoors at regular intervals, often masquerading as legitimate Windows system tasks to evade detection.

The group also demonstrates advanced defense evasion capabilities, including credential dumping from LSASS memory, registry modifications to enable plaintext password storage, and the use of VPN infrastructure spanning multiple countries to obfuscate their origin.

Organizations can test their defenses against xHunt tactics using security validation platforms that simulate real-world attack scenarios, helping security teams identify gaps in their detection and response capabilities before facing actual threats.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.