Microsoft Albanian Government Attacks September 2022

During HomeLand Justice, threat actors primarily used RDP for lateral movement in the victim environment.

During HomeLand Justice, threat actors used SMB for lateral movement.

The ROADSWEEP binary contains RC4 encrypted embedded scripts.

During HomeLand Justice, threat actors executed the Advanced Port Scanner tool on compromised systems.

During HomeLand Justice, threat actors used WMI to modify Windows Defender settings.

During HomeLand Justice, threat actors used PowerShell cmdlets New-MailboxSearch and Get-Recipient for discovery.

ROADSWEEP can open cmd.exe to enable command execution.

During HomeLand Justice, threat actors used Windows batch files for persistence and execution.

ROADSWEEP can use embedded scripts to remove itself from the infected host.

During HomeLand Justice, threat actors used the built-in administrator account to move laterally using RDP and Impacket.

ROADSWEEP can enumerate files on infected devices and avoid encrypting files with .exe, .dll, .sys, .lnk, or . lck extensions.

During HomeLand Justice, threat actors added the `ApplicationImpersonation` management role to accounts under their control to impersonate users and take ownership of targeted mailboxes.

During HomeLand Justice, threat actors used web shells to download files to compromised infrastructure.

During HomeLand Justice, threat actors used custom tooling to acquire tokens using `ImpersonateLoggedOnUser/SetThreadToken`.

ROADSWEEP requires four command line arguments to execute correctly, otherwise it will produce a message box and halt execution.

ROADSWEEP can RC4 encrypt content in blocks on targeted systems.

During HomeLand Justice, threat actors used ROADSWEEP ransomware to encrypt files on targeted systems.

ROADSWEEP has dropped ransom notes in targeted folders prior to encrypting the files.

For HomeLand Justice, threat actors used .aspx webshells named pickers.aspx, error4.aspx, and ClientBin.aspx, to maintain persistence.

ROADSWEEP has been placed in the start up folder to trigger execution upon user login.

During HomeLand Justice, threat actors used a version of ZeroCleare to wipe disk drives on targeted hosts.

During HomeLand Justice, threat actors used tools including Advanced Port Scanner, Mimikatz, and Impacket.

ROADSWEEP can enumerate logical drives on targeted devices.

During HomeLand Justice, threat actors modified and disabled components of endpoint detection and response (EDR) solutions including Microsoft Defender Antivirus.

During HomeLand Justice, threat actors deleted Windows events and application logs.