Volexity UPSTYLE 2024

UPSTYLE retrieves a non-existent webpage from the command and control server then parses commands from the resulting error logs to decode commands to the web shell.

During Operation MidnightEclipse, threat actors obtained active directory credentials via the NTDS.DIT file.

During Operation MidnightEclipse, threat actors stole saved cookies and login data from targeted systems.

During Operation MidnightEclipse, threat actors used SMB to pivot internally in victim networks.

During Operation MidnightEclipse, threat actors used WinRM to move laterally in targeted networks.

UPSTYLE stores primary content as base64-encoded objects.

UPSTYLE has masqueraded filenames using examples such as `update.py`.

During Operation MidnightEclipse, threat actors configured cron jobs to retrieve payloads from actor-controlled infrastructure.

During Operation MidnightEclipse, threat actors piped output from stdout to bash for execution.

UPSTYLE is a Python-based application.

UPSTYLE removes `bootstrap.min.css` after parsing command and control instructions, restoring the file to its original state.

UPSTYLE restores timestamps to original values following modification.

During Operation MidnightEclipse, threat actors used `wget` via HTTP to retrieve payloads.

During Operation MidnightEclipse, threat actors extracted sensitive credentials while moving laterally through compromised networks.

During Operation MidnightEclipse, threat actors used a compromised domain admin account to move laterally.

During Operation MidnightEclipse, threat actors used the GO Simple Tunnel reverse proxy tool.

UPSTYLE parses encoded commands from error logs after attempting to resolve a non-existing webpage from the command and control server.

During Operation MidnightEclipse, threat actors downloaded additional payloads on compromised devices.

UPSTYLE encodes its main content prior to loading via Python as base64-encoded blobs.

During Operation MidnightEclipse, threat actors exploited CVE-2024-3400 in Palo Alto Networks GlobalProtect.

UPSTYLE creates a `.pth` file beginning with the text `import` so that any time another process or script attempts to reference the modified item the malicious code will also run.

During Operation MidnightEclipse, threat actors wrote output to stdout then piped it to bash for execution.

During Operation MidnightEclipse, threat actors abused Virtual Private Servers to store malicious files.

During Operation MidnightEclipse, threat actors abused compromised AWS buckets to store files.

During Operation MidnightEclipse, threat actors used the GO Simple Tunnel (GOST) reverse proxy tool.

UPSTYLE attempts to retrieve a non-existent webpage from the command and control server resulting in hidden commands sent via resulting error messages.

UPSTYLE clears error logs after reading embedded commands for execution.