Bellingcat Malware Investigation

Introduction

Bellingcat, known for its investigative journalism, recently became the target of a sophisticated cyber attack. The analysis revolves around an email campaign that aimed to compromise Bellingcat’s systems. Here are the key details:

1. Attack Vector:
   • The attackers used an email campaign to deliver a malicious zip fileto Bellingcat.
   • The zip file contained a series of components that facilitated the attack.
2. Infection Chain:
   • Malicious Zip Archive: The attackers sent an email with an attachment—a seemingly innocuous zip file.
   • Fake PDF Shortcut (.lnk): Inside the zip file, there was a disguised PDF shortcut (.lnkfile).
   • PowerShell Reverse Shell: When the user clicked the fake PDF shortcut, it executed a PowerShell script. This script established a reverse shell, allowing the attacker to gain control over the victim’s system.
   • Data Exfiltration: The reverse shell enabled the exfiltration of sensitive data from Bellingcat’s network.

Statistics and Insights

While the exact statistics related to this specific attack are not publicly available, we can draw insights from similar incidents and general trends:

1. Targeted Attacks on Journalists:
   • Journalists and media organizations are often targeted by state-sponsored actors, hacktivists, or cybercriminals.
   • These attacks aim to compromise the integrity of news reporting, suppress dissent, or gain access to sensitive information.
2. Sophistication Level:
   • The multi-stage attack involving a malicious zip archive, disguised shortcut, and PowerShell script indicates a high level of sophistication.
   • Attackers invest time and effort to evade detection and achieve their objectives.
3. Attribution Challenges:
   • Attribution in cyber attacks is notoriously difficult. While some attacks can be linked to specific threat actors, others remain anonymous.
   • Bellingcat itself specializes in open-source intelligence (OSINT) investigations, which often involve attributing cyber attacks to specific entities.

Technical Analysis:

Stage 1: Malicious Zip Archive

SHA256:506A64C619580BC91A51BDE3A3C3F5ACED3ED1106413AC11A721C56817B04573

In the tweet referenced earlier, Bellingcat provided a comprehensive account of the infection chain associated with the malicious message they received.

We’ve recently been subjected to a phishing attack via email. The email was made to appear as if it came from USAID and encouraged readers to click a link which downloads a malicious file. We’ve reported it to @USAID. pic.twitter.com/SAsCjbZUe6

— Bellingcat (@bellingcat) December 22, 2023

Additionally, they highlighted the specific domain from which the email originated, which also served as the host for the malicious content. Notably, this domain, usaid[.]pm, is no longer active, as confirmed by subsequent investigations. However, due to limited exposure in online sandboxes and the absence of an enterprise-level VirusTotal license, the sample remains relatively unexplored.

Stage 2: .Lnk Masquerading as a PDF

SHA256: 86F504DEA07FD952253904C468D83D9014A290E1FF5F2D103059638E07D14B09

The malicious actors employ a .lnk file, which essentially serves as a shortcut to another file or executes specific commands. In this case, they disguise the .lnk file as a PDF document, enticing victims to click on it under the false pretense that they are about to access a USAID annual report. Notably, the .lnk extension may remain hidden depending on the victim’s computer settings, further enhancing the deception.

1. The .lnkfile initiates the following steps:
   • It runs exein the background.
   • Within the exesession, it executes the findstr command.
   • The findstrcommand performs a regex search for the string “CiRFcnJvckFjdGlvbl”.
   • The search results are redirected to a file named jpgin the temporary directory.
2. Next, the .lnkfile launches a hidden PowerShell session:
   • In this session, it runs a command to read the content of jpg.
   • The content is interpreted as a Base64
   • The Base64string is then converted to UTF8.
   • Finally, the converted string is executed using PowerShell.

This intricate sequence of steps allows the malicious actors to execute their payload while maintaining deception by disguising the initial .lnk file as a harmless PDF.

Stage 3: Reverse Shell

SHA256 (dumped to ps1 file): 615F7677613534FCD5E6548B4FEE48FBFC85AF0C5ECDAD5B2046495869D1A668

In the previous stage, we observed that the target of the .lnk file included the command findstr /R “CiRFcnJvckFjdGlvbl” 2023_Annual_Report.pdf.lnk. This command effectively dumps the output to a .jpg file, decodes its content, and subsequently executes it using PowerShell. However, the content executed by PowerShell can be extracted by simply running the aforementioned findstr command.

Upon base64 decoding the content ourselves, we are left with a reverse shell. Notably, analysis conducted by the team indicates that the reverse shell corresponds to an open-source penetration testing tool called “HTTP-Shell.” It’s worth noting that while the shell is based on the project, it is not a direc

t copy-paste implementation.

Inspecting the shell reveals several obviously malicious functionalities and configuration details that the threat actors hard-coded into the script.

1. Decoy PDF Creation:
   • The .lnkfile executes the findstr command, searching for the string “JVBERi0xLjcNJeLjz9” against the .lnk file itself.
   • This action results in the creation of a decoy PDF named “pdf.”
   • The purpose of this decoy PDF is to act as a diversion, leading victims to believe they have clicked on a legitimate PDF document.
   • In this specific case, the decoy PDF contains interview instructions for USAID, which are ostensibly meant for media contacts.
2. C2 (Command and Control) Domain:
   • The threat actors hard-code the domain “pdf-online[.]top” as the C2 for the shell.
   • This domain serves as the central point for communication and control between the victim’s compromised system and the attackers.
3. C2 Endpoints:
   • The following endpoints are utilized in requests to the C2:
     • api/v1/Client/Info
     • api/v1/Client/Token
     • api/v1/Client/Debug
   • These endpoints facilitate communication and data exchange between the victim’s machine and the C2 server.
4. Data Exchange and Encoding:
   • The malware sends victim computer information to the C2.
   • Additionally, data uploaded and downloaded from the victim’s device is encoded to obfuscate its content.

The combination of these actions allows the threat actors to maintain control over the compromised system while employing various deceptive tactics to avoid detection.

Conclusion

The Bellingcat Malware Investigation sheds light on the ongoing battle between cyber attackers and defenders. As journalists and organizations continue to face threats, robust security practices, user awareness, and timely incident response remain crucial.

IOC’s