Sunday, May 19, 2024

xHunt Hackers Uses New Backdoor to Attack Exchange Servers

xHunt hackers uses New Backdoor to attack Exchange Servers and the xHunt Campaign has also targeted Kuwait organizations to compromise systems. One amongst the tools used is CASHY200, which is a Powershell based back door that communicates with a C2 server using DNS tunneling.

What is CASHY200?

CASHY200 works on the basis of PowerShell scripts associated with the larger xHunt malware campaign.

ThisCASHY200 is delivered through a malicious Microsoft Office attachments distributed through email phishing campaigns. Which then uses the Exchange Web Services (EWS) to create drafts within the Deleted Items folder of a compromised email account.

When the email is opened, a preliminary script in the attachments will execute CASHY200 directly in memory.

If the execution is successful, then CASHY200 will connect to a command and will control the server, and will use a DNS tunnelling channel to bypass standard network monitoring and successfully run commands on the compromised server.

CASHY200 variants also have the ability to extract files as well as install secondary payloads.

Affected platforms

All the versions of Microsoft Windows are known to be affected

CASHY200 C2 domains


Samples found

On May 1st and June 3rd 2018, the first executables were found to be installing and executing CASHY200 PowerShell which communicated with the domains windowsupdates[.]com and firewallsupports[.]com.

It was determined that Word documents were used to deliver PowerShell payloads using firewallsupports[.]com as a C2 to target government organizations in Kuwait, also it is observed that the threat actors compromised a Microsoft Exchange Server at an organization in Kuwait which as per timestamp predicts to have occurred on or before August 22, 2019.

Despite initially being heavily targeted at government, transportation and shipping organisations in the Middle East, it now appears to be affecting organisations throughout Europe.

Precautions that can be Taken

C2 domains such as windows64x[.]com, firewallsupports[.]com, windows-updates[.]com, and winx64-microsoft[.]com can be blocked.

All CASHY200 tunnelling protocols can be blocked by DNS Security.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

Hackers Using COVID-19 Training Lure to Attack Office 365 Users

Hackers Would Bypass Multi-Factor Authentication to Gain Full Access to Microsoft 365 Services


Latest articles

Norway Recommends Replacing SSLVPN/WebVPN to Stop Cyber Attacks

A very important message from the Norwegian National Cyber Security Centre (NCSC) says that...

New Linux Backdoor Attacking Linux Users Via Installation Packages

Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices,...

ViperSoftX Malware Uses Deep Learning Model To Execute Commands

ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine,...

Santander Data Breach: Hackers Accessed Company Database

Santander has confirmed that there was a major data breach that affected its workers...

U.S. Govt Announces Rewards up to $5 Million for North Korean IT Workers

The U.S. government has offered a prize of up to $5 million for information...

Russian APT Hackers Attacking Critical Infrastructure

Russia leverages a mix of state-backed Advanced Persistent Threat (APT) groups and financially motivated...

Millions Of IoT Devices Vulnerable To Attacks Leads To Full Takeover

Researchers discovered four significant vulnerabilities in the ThroughTek Kalay Platform, which powers 100 million...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles