SLOW#TEMPEST Campaign Targets Chinese Users with Cobalt Strike and Mimikatz Attacks

Introduction

On August 29, 2024, Securonix released a security advisory detailing a sophisticated attack campaign identified as SLOW#TEMPEST. This campaign, targeting Chinese-speaking users, employed a combination of Cobalt Strike and Mimikatz to infiltrate and persist within compromised systems. The attack appears to have been conducted through phishing emails containing malicious ZIP files, allowing the attackers to move laterally and remain undetected for over two weeks.

Report Overview

The SLOW#TEMPEST campaign was discovered by Securonix Threat Research, who observed that the attack specifically targeted victims within China. The use of Chinese language in the file names and lures, along with command and control (C2) infrastructure hosted by Shenzhen Tencent Computer Systems Company Limited, strongly suggests that the campaign was aimed at Chinese users. Although the exact origin of the attack remains unclear, the tactics used align with traditional phishing methods, likely involving ZIP files distributed via unsolicited emails.

The initial infection begins when the user opens a password-protected ZIP file containing a malicious LNK file masquerading as a legitimate document. Upon execution, the LNK file triggers the Cobalt Strike implant via DLL hijacking. The attackers leveraged a legitimate Microsoft-signed executable, LicensingUI.exe, to sideload a malicious DUI70.DLL, allowing them to establish a foothold in the system.

Post-exploitation activities included using several tools for privilege escalation, lateral movement, and credential harvesting. The attackers set up a staging directory on the compromised host, downloaded additional tools like fscan.exe for scanning live hosts, and used sharpdecryptpwd.exe to extract cached credentials from various applications. Mimikatz was also employed to dump Windows credentials used to pivot across the network.

The SLOW#TEMPEST campaign poses significant risks to affected systems. The attackers maintain persistent access through scheduled tasks and elevated privileges. By manipulating the built-in guest user account, they created a powerful backdoor, enabling ongoing access with minimal detection. The campaign's advanced techniques, including undocumented DLL injection and the use of tools like BloodHound for Active Directory reconnaissance, indicate a high level of sophistication.

Insights and Analysis

Securonix's SLOW#TEMPEST campaign analysis emphasizes monitoring unusual activity in common malware staging directories and deploying robust endpoint logging capabilities. Encrypted channels over various ports highlight the need for advanced detection methods to identify and mitigate such threats.

The SLOW#TEMPEST campaign is a serious threat to organizations, particularly those in China. Security teams should remain vigilant and consider implementing the recommended preventative measures, including avoiding downloading files from unsolicited sources, monitoring script-related activity, and enhancing endpoint logging capabilities. By understanding the methods and tools used in this campaign, defenders can better protect their networks from similar attacks in the future.

Preventative Measures:

• Avoid downloading files or attachments from unknown or unsolicited sources.
• Monitor common malware staging directories for unusual script activity.
• Deploy robust endpoint logging capabilities, including process-level logging, for enhanced detection coverage.

Indicators of Compromise (IOCs)

MITRE ATT&CK Table

References

From Cobalt Strike to Mimikatz: A Deep Dive into the SLOW#TEMPEST Campaign Targeting Chinese Users

The Securonix Threat Research team has uncovered a covert campaign targeting Chinese-speaking users with Cobalt Strike payloads likely delivered through phishing emails. The attackers managed to move laterally, establish persistence and remain undetected within the systems for more than two weeks.

Securonix