xHunt Hackers Uses New Backdoor to Attack Exchange Servers

xHunt hackers uses New Backdoor to attack Exchange Servers and the xHunt Campaign has also targeted Kuwait organizations to compromise systems. One amongst the tools used is CASHY200, which is a Powershell based back door that communicates with a C2 server using DNS tunneling.

What is CASHY200?

CASHY200 works on the basis of PowerShell scripts associated with the larger xHunt malware campaign.

ThisCASHY200 is delivered through a malicious Microsoft Office attachments distributed through email phishing campaigns. Which then uses the Exchange Web Services (EWS) to create drafts within the Deleted Items folder of a compromised email account.

When the email is opened, a preliminary script in the attachments will execute CASHY200 directly in memory.

If the execution is successful, then CASHY200 will connect to a command and will control the server, and will use a DNS tunnelling channel to bypass standard network monitoring and successfully run commands on the compromised server.

CASHY200 variants also have the ability to extract files as well as install secondary payloads.

Affected platforms

All the versions of Microsoft Windows are known to be affected

CASHY200 C2 domains

windows64x[.]com
winx64-microsoft[.]com
firewallsupports[.]com
windows-updates[.]com

Samples found

On May 1st and June 3rd 2018, the first executables were found to be installing and executing CASHY200 PowerShell which communicated with the domains windowsupdates[.]com and firewallsupports[.]com.

It was determined that Word documents were used to deliver PowerShell payloads using firewallsupports[.]com as a C2 to target government organizations in Kuwait, also it is observed that the threat actors compromised a Microsoft Exchange Server at an organization in Kuwait which as per timestamp predicts to have occurred on or before August 22, 2019.

Despite initially being heavily targeted at government, transportation and shipping organisations in the Middle East, it now appears to be affecting organisations throughout Europe.

Precautions that can be Taken

C2 domains such as windows64x[.]com, firewallsupports[.]com, windows-updates[.]com, and winx64-microsoft[.]com can be blocked.

All CASHY200 tunnelling protocols can be blocked by DNS Security.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Also Read

Hackers Using COVID-19 Training Lure to Attack Office 365 Users

Hackers Would Bypass Multi-Factor Authentication to Gain Full Access to Microsoft 365 Services