Wednesday, December 6, 2023

xHunt Hackers Uses New Backdoor to Attack Exchange Servers

xHunt hackers uses New Backdoor to attack Exchange Servers and the xHunt Campaign has also targeted Kuwait organizations to compromise systems. One amongst the tools used is CASHY200, which is a Powershell based back door that communicates with a C2 server using DNS tunneling.

What is CASHY200?

CASHY200 works on the basis of PowerShell scripts associated with the larger xHunt malware campaign.

ThisCASHY200 is delivered through a malicious Microsoft Office attachments distributed through email phishing campaigns. Which then uses the Exchange Web Services (EWS) to create drafts within the Deleted Items folder of a compromised email account.

When the email is opened, a preliminary script in the attachments will execute CASHY200 directly in memory.

If the execution is successful, then CASHY200 will connect to a command and will control the server, and will use a DNS tunnelling channel to bypass standard network monitoring and successfully run commands on the compromised server.

CASHY200 variants also have the ability to extract files as well as install secondary payloads.

Affected platforms

All the versions of Microsoft Windows are known to be affected

CASHY200 C2 domains

windows64x[.]com
winx64-microsoft[.]com
firewallsupports[.]com
windows-updates[.]com

Samples found

On May 1st and June 3rd 2018, the first executables were found to be installing and executing CASHY200 PowerShell which communicated with the domains windowsupdates[.]com and firewallsupports[.]com.

It was determined that Word documents were used to deliver PowerShell payloads using firewallsupports[.]com as a C2 to target government organizations in Kuwait, also it is observed that the threat actors compromised a Microsoft Exchange Server at an organization in Kuwait which as per timestamp predicts to have occurred on or before August 22, 2019.

Despite initially being heavily targeted at government, transportation and shipping organisations in the Middle East, it now appears to be affecting organisations throughout Europe.

Precautions that can be Taken

C2 domains such as windows64x[.]com, firewallsupports[.]com, windows-updates[.]com, and winx64-microsoft[.]com can be blocked.

All CASHY200 tunnelling protocols can be blocked by DNS Security.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

Hackers Using COVID-19 Training Lure to Attack Office 365 Users

Hackers Would Bypass Multi-Factor Authentication to Gain Full Access to Microsoft 365 Services

Website

Latest articles

Hackers Use Weaponized Documents to Attack U.S. Aerospace Industry

An American aerospace company has been the target of a commercial cyberespionage campaign dubbed...

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Booking.com Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles