Time Table

In recent years, we have observed multiple attacks that abuse the ManageEngine UEMS Agent — a case of legitimate Remote Monitoring and Management (RMM) tools being turned against defenders. Such attacks are troublesome for defenders because they evade detection by blending in with legitimate signatures and legitimate communications. In this talk, starting from an investigation into malware distributed against targets in Japan, we present a case study of infrastructure analysis in which multiple pieces of attack infrastructure are tied together using the unified management product ManageEngine as a “pivot point.” By investigating publicly exposed ManageEngine servers, we confirmed that on several of these hosts a ValleyRAT C2 was co-located. Through this analysis, we identified the use of a new AtlasRAT variant that differs from previously published analyses — a variant equipped with a relay capability to rdesk/quickdesk — and we also carried out analysis of the sample itself. The characteristics of the tooling, targeting, and language align in several respects with the China-based actor Silver Fox, and we assess with low-to-moderate confidence that this is attributable to Silver Fox’s operations.

<Talk Outline>

1.Investigation of ManageEngine servers

2.Co-location of ValleyRAT and AtlasRAT revealed through infrastructure analysis

3.New targets and C2 destinations uncovered by investigating the distribution servers

4.Sample analysis of AtlasRAT

Speakers:
Hiroshi Oshiba NEC Security, Ltd CTA unit CTI group
Takaaki Sugiu NEC Security, Ltd CTA unit CTI group
Daisuke Maeda NEC Corporation Cyber Intelligence Group