Thursday, March 28, 2024

xHunt Hackers Uses New Backdoor to Attack Exchange Servers

xHunt hackers uses New Backdoor to attack Exchange Servers and the xHunt Campaign has also targeted Kuwait organizations to compromise systems. One amongst the tools used is CASHY200, which is a Powershell based back door that communicates with a C2 server using DNS tunneling.

What is CASHY200?

CASHY200 works on the basis of PowerShell scripts associated with the larger xHunt malware campaign.

ThisCASHY200 is delivered through a malicious Microsoft Office attachments distributed through email phishing campaigns. Which then uses the Exchange Web Services (EWS) to create drafts within the Deleted Items folder of a compromised email account.

When the email is opened, a preliminary script in the attachments will execute CASHY200 directly in memory.

If the execution is successful, then CASHY200 will connect to a command and will control the server, and will use a DNS tunnelling channel to bypass standard network monitoring and successfully run commands on the compromised server.

CASHY200 variants also have the ability to extract files as well as install secondary payloads.

Affected platforms

All the versions of Microsoft Windows are known to be affected

CASHY200 C2 domains

windows64x[.]com
winx64-microsoft[.]com
firewallsupports[.]com
windows-updates[.]com

Samples found

On May 1st and June 3rd 2018, the first executables were found to be installing and executing CASHY200 PowerShell which communicated with the domains windowsupdates[.]com and firewallsupports[.]com.

It was determined that Word documents were used to deliver PowerShell payloads using firewallsupports[.]com as a C2 to target government organizations in Kuwait, also it is observed that the threat actors compromised a Microsoft Exchange Server at an organization in Kuwait which as per timestamp predicts to have occurred on or before August 22, 2019.

Despite initially being heavily targeted at government, transportation and shipping organisations in the Middle East, it now appears to be affecting organisations throughout Europe.

Precautions that can be Taken

C2 domains such as windows64x[.]com, firewallsupports[.]com, windows-updates[.]com, and winx64-microsoft[.]com can be blocked.

All CASHY200 tunnelling protocols can be blocked by DNS Security.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Also Read

Hackers Using COVID-19 Training Lure to Attack Office 365 Users

Hackers Would Bypass Multi-Factor Authentication to Gain Full Access to Microsoft 365 Services

Website

Latest articles

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles