Every month, the ReliaQuest team picks the best security operations articles and does a deep-dive. This month, we’re featuring the return of “Emotet,” the latest in phishing-as-a-service (PhaaS), and methods of bypassing multifactor authentication (MFA).

Jakob’s Pick

Emotet Returns with OneNote Macro Security Bypass Method

The Emotet modular banking trojan is active in the wild again, employing a new technique: using OneNote file types to bypass Microsoft’s macro security control. Ever since Microsoft’s summer 2022 initiative to block macros by default within Office Word and Excel files, there’s been a gap in the market for a new attack methodology. Cue Microsoft OneNote. Threat actors are exploiting a new phishing campaign by using this note-taking software to install the Emotet trojan and other malware. They do this by embedding Window Script Files (WSF) within the application.

Attackers are creating OneNote files that prompt victims to view a fake protected document, which uses a Visual Basic Script (VBS) via wscript when the WSF file is clicked. The VBS reaches out to a remote server to download the Emotet payload.

Let’s see this in action. The victim receives a seemingly innocuous email with the subject “RE: Documents for new Clientele.” The message asks its recipient to review the attached OneNote file. Upon opening, a legitimate OneNote application instructs the victim that they must click “View” to see the protected document. This generates a Microsoft protected warning, which the victim overrides.

At this point, nothing appears to have happened, from the victim’s perspective. Must be a bug, right?

In reality, an embedded WSF file is installing a VBS via wscript.exe into the OneNote Temp folder and reaching out to an external IP address to download an Emotet Dynamic Link Libraries (DLLs). From here, Emotet will gather sensitive information from the victim’s system, such as contacts, credentials, and emails. This continues while the malware waits for more commands from the C2 (command-and-control) server. With a C2 server communicating with the affected host, attackers have free rein, whether their motives are to move laterally within the environment, affecting more hosts, or install next-stage malware, such as “Qakbot,” “Impacket,” or “Mimikatz.”

Phishing campaigns continue to be the most successful intrusion point for companies and often lead to privilege escalation, lateral movement, persistence, or malware deployment. There are few ways to mitigate this activity. One is to implement stronger email security and spam filters, preventing the email from being delivered in the first place. Another is to block OneNote files (appended .one) from the environment entirely. Another mitigation is to implement strong firewall rules to prevent the next stage of execution if the script does happen to run. Lastly, taking the time to train employees on how to detect and report phishing attempts will, overall, increase your company’s security posture, making the lives of threat actors that much harder.

Read about this phishing technique here.

Gabe’s Pick

Phishing-as-a-Service

Give a man a password, and you give him access for a day; give a man a cookie, and he will never need access again.

Earlier this month, the ReliaQuest GreyMatter team ran into an interesting phishing incident involving a Miro site and weak operational security (OPSEC), which revealed a PhaaS operation using Telegram to communicate with buyers and GitHub to store the source code of the phishing kit. PhaaS has exploded in popularity recently. It entails a group of developers supplying and maintaining the infrastructure needed to allow buyers to easily engage in phishing campaigns (e.g., evilginx2).

When investigating this phishing incident, a lapse in the attackers’ OPSEC allowed us to retrieve a Telegram invitation link. Using the name and profile picture of the Telegram group, we traced these artifacts to a similarly named public GitHub repository (now taken down) where the threat actors stored their phishing arsenal.

After we joined the Telegram channel, it quickly became apparent that the attackers were selling this arsenal in well-marketed, subscription-based bundles, featuring tools like an automated bulk email sender, O365 account checkers, and a sophisticated tool to bypass multifactor authentication (MFA: the electronic authentication method in which two or more pieces of evidence are required to log into an account). This tool, the collection’s crown jewel, is called OV9. The operation also enabled buyers to receive discounts on future payments for any referrals made.

In the channel, the attackers kindly posted YouTube videos detailing step-by-step instructions to set up this infrastructure, deploy the tools, and scale up the buyer’s operation through automating the workflow. They left no room for confusion (which we thank them for!).

The attackers are making use of the Adversary in The Middle attack vector, which relies on the phishing site to act as a proxy between the legitimate login portal and the victim. In the linked article, Microsoft summarized the chain of events as shown here:

Figure 1: AiTM Phishing website intercepting authentication process (Source: Microsoft) image

Figure 1: AiTM Phishing website intercepting authentication process (Source: Microsoft)

In the specific incident we analyzed, the attackers hijacked the ESTSAUTH, ESTSAUTHPERSISTENT, and ESTSAUTHLIGHT cookies and supplied them to their tool, “OV9” (see Figure 2). ESTSAUTH and ESTSAUTHPERSISTENT are responsible for managing SSO authentication sessions, are specific to Azure infrastructure, and are the common target in MFA bypass techniques. Once the cookies have been set, the buyer can refresh the login portal and enter an authenticated Azure session without the need to go through MFA.

Figure 2: Hijack of ESTSAUTH, ESTSAUTHPERSISTENT, and ESTSAUTHLIGHT cookies image

Figure 2: Hijack of ESTSAUTH, ESTSAUTHPERSISTENT, and ESTSAUTHLIGHT cookies

This method of bypassing MFA requires no administrative rights, and the attacker does not need to have prior access to the victim’s user ID or password; all the information is stored within the cookie. No technologies have implemented a pre-emptive approach to this type of attack. Assuming a user falls for the phishing attack and submits the MFA token, they would be unable to prevent the attacker from successfully authenticating, due to the fact that clearing cookies occurs on the client side, not on the server side.

Although this might not seem like breaking news, this operation’s ability to sustain many buyers through affiliate links and referrals, in addition to general ease of use for the average Joe, makes it a security nightmare. Thanks to the attackers’ simplistic guides, along with continuous updates, sales, and increased functionality, PhaaS operations such as this have made initial access as simple as watching a couple of YouTube videos. Thankfully, the ReliaQuest team has the necessary content regarding all phishing incidents; our customers can rest assured that no threat will go unnoticed. 

The blog from Microsoft of AiTM Phishing can be seen here.

Joseph’s Pick

Threat Actors Bypass MFA

MFA makes compromising an account significantly more difficult, but threat actors are finding clever ways to bypass this critical security control. Threat actors love accounts that don’t use MFA—ones for which users are not required to enter their password, followed by a security token. Implementing MFA on any account instantly makes it significantly more difficult for an adversary to take advantage of compromised credentials or brute-force an account. But it’s not a silver bullet; recently we’ve seen an increase in phishing attacks in which threat actors use session cookies to completely bypass MFA, without any need for a username or password. MFA certainly increases your overall security posture, but it’s not impossible to bypass.

There are numerous ways adversaries can bypass the MFA token needed for authentication. A recent example is a MFA-bypass method called adversary-in-the-middle (AITM). Since the implementation of PhaaS, these types of MFA-bypass methods have become increasingly common.

At first glance, these methods appear to be normal phishing attacks, but behind the scenes, threat actors can cross-reference a user’s input with a legitimate domain. In that way they not only ensure correct credentials but prevent the user from receiving the session cookie once the token has been entered. Once the end user has entered their credentials and token, an attacker can simply authenticate with only the session cookie.

Here are some common techniques to bypass MFA:

  • SIM swap attacks – An intruder attempts to impersonate you and requests a network provider to transfer a phone number to a different SIM, allowing them to receive all SMS messages and notifications, such as MFA codes.
  • Channel hijacking – In this man-in-the-middle (MITM) attack, a threat actor eavesdrops on all information you transmit to a specific channel or device, such as a mobile phone or application.
  • OTP-based attacks – A one-time password (OTP) or code is generated and sent to a threat actor to verify their identity through a compromised medium, such as email.
  • Real-time phishing attacks – An end user is tricked into providing their login credentials and MFA, followed immediately by the threat actor authenticating on the legitimate website.

The most common technique to bypass MFA is phishing, and the best prevention methods for phishing attacks are end-user phishing training. Awareness is key to ensuring users are one step ahead of threat actors and it will prevent most (not all) phishing attempts. A great way to prevent users bypassing MFA are authentication apps, such as DUO or Okta, which send codes via the app; this can prevent SIM swaps.

Additionally, using a virtual private network (VPN) to encrypt the information being exchanged can prevent channel hijacking. There are other prevention methods, but the ones mentioned above are some of the most important.

Even if we take all the precautions, there is always the chance a threat actor will use an unknown technique, or a user will make a mistake. ReliaQuest has numerous rules in place to monitor for this activity, such as “Suspicious MFA Activity,” “MFA Pin Guessing,” etc. Taking necessary precautions can go a long way in preventing security breaches and save countless hours of remediation.

A great summation of MFA bypass methods can be found here.

Wrap-up

From the return of Emotet with a new phishing campaign using OneNote, to the rise of Phishing-as-a-Service facilitated by poor operational security, and finally, the various techniques used by threat actors to bypass Multifactor Authentication (MFA), we can see how cybercriminals are constantly evolving and finding new ways to exploit weaknesses in our systems. However, by implementing strong email security and spam filters, blocking risky file types, providing end-user phishing training, and using authentication apps or VPNs, we can take preventive measures to mitigate these risks. The ReliaQuest GreyMatter security operations platform can also help organizations detect and respond to security threats more effectively. Staying vigilant and following best practices is key to maintaining a secure digital environment for all.