C0014: Operation Wocao

During Operation Wocao, the threat actors executed `/c cd /d c:\windows\temp\ & reg query HKEY_CURRENT_USER\Software\\PuTTY\Sessions\` to detect recent PuTTY sessions, likely to further lateral movement.[1]

During Operation Wocao, threat actors used ProcDump to dump credentials from memory.[1]

During Operation Wocao, threat actors obtained the password for the victim's password manager via a custom keylogger.[1]

During Operation Wocao, threat actors used scripts to detect security software.[1]

During Operation Wocao, threat actors used `nbtscan` and `ping` to discover remote systems, as well as `dsquery subnet` on a domain controller to retrieve all subnets in the Active Directory.[1]

During Operation Wocao, threat actors' proxy implementation "Agent" upgraded the socket in use to a TLS socket.[1]

During Operation Wocao, threat actors developed their own custom webshells to upload to compromised servers.[1]

During Operation Wocao, threat actors spawned a new `cmd.exe` process to execute commands.[1]

During Operation Wocao, threat actors accessed and collected credentials from password managers.[1]

During Operation Wocao, threat actors used Mimikatz to dump certificates and private keys from the Windows certificate store.[1]

During Operation Wocao, threat actors used a script to collect information about the infected system.[1]

During Operation Wocao, threat actors collected a list of open connections on the infected system using `netstat` and checks whether it has an internet connection.[1]

For Operation Wocao, the threat actors registered email accounts to use during the campaign.[1]

During Operation Wocao, threat actors used the `time` command to retrieve the current time of a compromised system.[1]

During Operation Wocao, the threat actors used uncommon high ports for its backdoor C2, including ports 25667 and 47000.[1]

During Operation Wocao, threat actors used PowerShell to add and delete rules in the Windows firewall.[1]

During Operation Wocao, threat actors used a custom collection method to intercept two-factor authentication soft tokens.[1]

During Operation Wocao, threat actors gained initial access by exploiting vulnerabilities in JBoss webservers.[1]

During Operation Wocao, threat actors executed commands through the installed web shell via Tor exit nodes.[1]

During Operation Wocao, threat actors staged archived files in a temporary directory prior to exfiltration.[1]

During Operation Wocao, threat actors enumerated sessions and users on a remote host, and identified privileged users logged into a targeted system.[1]

During Operation Wocao, threat actors’ XServer tool communicated using HTTP and HTTPS.[1]

During Operation Wocao, threat actors created services on remote systems for execution purposes.[1]

During Operation Wocao, threat actors exfiltrated files and directories of interest from the targeted system.[1]

During Operation Wocao, threat actors collected clipboard data in plaintext.[1]

For Operation Wocao, the threat actors purchased servers with Bitcoin to use during the operation.[1]

During Operation Wocao, threat actors archived collected files with WinRAR, prior to exfiltration.[1]

During Operation Wocao, threat actors used the `CreateProcessA` and `ShellExecute` API functions to launch commands after being injected into a selected process.[1]

During Operation Wocao, threat actors used the command `net localgroup administrators` to list all administrators part of a local group.[1]

During Operation Wocao, threat actors used valid VPN credentials to gain initial access.[1]

During Operation Wocao, threat actors discovered network disks mounted to the system using netstat.[1]

During Operation Wocao, the threat actors consistently removed traces of their activity by first overwriting a file using `/c cd /d c:\windows\temp\ & copy \\\c$\windows\system32\devmgr.dll \\\c$\windows\temp\LMAKSW.ps1 /y` and then deleting the overwritten file using `/c cd /d c:\windows\temp\ & del \\\c$\windows\temp\LMAKSW.ps1`.[1]

During Operation Wocao, the threat actors deleted all Windows system and security event logs using `/Q /c wevtutil cl system` and `/Q /c wevtutil cl security`.[1]

During Operation Wocao, threat actors encrypted IP addresses used for "Agent" proxy hops with RC4.[1]

For Operation Wocao, the threat actors obtained a variety of open source tools, including JexBoss, KeeThief, and BloodHound.[1]

During Operation Wocao, threat actors used PowerSploit's `Invoke-Kerberoast` module to request encrypted service tickets and bruteforce the passwords of Windows service accounts offline.[1]

During Operation Wocao, threat actors used Impacket's smbexec.py as well as accessing the C$ and IPC$ shares to move laterally.[1]

During Operation Wocao, threat actors used SMB to copy files to and from target systems.[1]

During Operation Wocao, threat actors used VBScript to conduct reconnaissance on targeted systems.[1]

During Operation Wocao, threat actors used a Visual Basic script that checked for internet connectivity.[1]

During Operation Wocao, threat actors used the `net` command to retrieve information about domain accounts.[1]

During Operation Wocao, threat actors used domain credentials, including domain admin, for lateral movement and privilege escalation.[1]

During Operation Wocao, threat actors injected code into a selected process, which in turn launches a command as a child process of the original.[1]

During Operation Wocao, threat actors gathered a recursive directory listing to find files and directories of interest.[1]

During Operation Wocao, threat actors targeted people based on their organizational roles and privileges.[1]

During Operation Wocao, threat actors' backdoors were written in Python and compiled with py2exe.[1]

During Operation Wocao, the threat actors enabled Wdigest by changing the `HKLM\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\WDigest` registry value from 0 (disabled) to 1 (enabled).[1]

During Operation Wocao, threat actors proxied traffic through multiple infected systems.[1]

During Operation Wocao, threat actors used a custom proxy tool called "Agent" which has support for multiple hops.[1]

During Operation Wocao, threat actors used the XServer backdoor to exfiltrate data.[1]

During Operation Wocao, the threat actors renamed some tools and executables to appear as legitimate programs.[1]

During Operation Wocao, threat actors used the `tasklist` command to search for one of its backdoors.[1]

During Operation Wocao, threat actors discovered removable disks attached to a system.[1]

During Operation Wocao, threat actors used Mimikatz's DCSync to dump credentials from the memory of the targeted system.[1]

During Operation Wocao, threat actors edited variable names within the Impacket suite to avoid automated detection.[1]

During Operation Wocao, threat actors used scheduled tasks to execute malicious PowerShell code on remote systems.[1]

During Operation Wocao, threat actors discovered the OS versions of systems connected to a targeted network.[1]

During Operation Wocao, threat actors executed PowerShell commands which were encoded or compressed using Base64, zlib, and XOR.[1]

During Operation Wocao, threat actors used PowerShell on compromised systems.[1]

During Operation Wocao, threat actors has used WMI to execute commands.[1]

During Operation Wocao, threat actors scanned for open ports and used nbtscan to find NETBIOS nameservers.[1]

During Operation Wocao, threat actors used a custom protocol for command and control.[1]

During Operation Wocao, threat actors discovered the local network configuration with `ipconfig`.[1]

During Operation Wocao, threat actors used stolen credentials to connect to the victim's network via VPN.[1]

During Operation Wocao, threat actors used their own web shells, as well as those previously placed on target systems by other threat actors, for reconnaissance and lateral movement.[1]

During Operation Wocao, threat actors collected a list of installed software on the infected system.[1]

During Operation Wocao, threat actors discovered the local disks attached to the system and their hardware information including manufacturer and model.[1]

During Operation Wocao, threat actors downloaded additional files to the infected system.[1]

During Operation Wocao, threat actors used local account credentials found during the intrusion for lateral movement and privilege escalation.[1]

During Operation Wocao, the threat actors used `tasklist` to collect a list of running processes on an infected system.[1]