{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/multiple-malware-families/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["Multiple malware families"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["reconnaissance","malware","windows"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThis brief focuses on the technique of malware and related tools querying public IP check services to identify the external IP address of a compromised host. This activity is typically performed early in the infection lifecycle to give the attacker situational awareness of the victim's network. This information can be used to tailor attacks, identify the victim's geographic location, and potentially identify the organization to which the victim belongs. This technique is used by a wide variety of malware families, including Trickbot, Azorult, and many others, to perform reconnaissance on the compromised host. This behavior is identified using Sysmon EventCode 22 logs, specifically monitoring DNS queries to services.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eA user unknowingly executes a malicious executable (e.g., via drive-by download or opening a malicious attachment).\u003c/li\u003e\n\u003cli\u003eThe malicious executable starts on the host, typically with user-level privileges.\u003c/li\u003e\n\u003cli\u003eThe malware initiates a DNS query to a known IP check service (e.g., \u003ccode\u003ewtfismyip.com\u003c/code\u003e, \u003ccode\u003eipinfo.io\u003c/code\u003e, \u003ccode\u003eicanhazip.com\u003c/code\u003e) using the \u003ccode\u003eQueryName\u003c/code\u003e field in Sysmon Event ID 22.\u003c/li\u003e\n\u003cli\u003eThe DNS query is resolved, and the malware receives the external IP address of the compromised host.\u003c/li\u003e\n\u003cli\u003eThe malware may then use this IP address for further reconnaissance, such as geolocation lookups or identifying the organization to which the IP address belongs.\u003c/li\u003e\n\u003cli\u003eThe gathered information is sent back to the attacker-controlled command-and-control (C2) server.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the gathered information to tailor subsequent attacks, such as lateral movement or data exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful execution of this reconnaissance technique provides attackers with valuable information about the victim's network. This information can be used to tailor subsequent attacks, increasing the likelihood of success. In the case of ransomware attacks, knowing the victim's organization can allow the attacker to demand a larger ransom. The use of IP check services has been observed across a diverse range of malware families and impacts organizations across all sectors.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnable Sysmon Event ID 22 logging to capture DNS query events.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rules in this brief to your SIEM and tune for your environment.\u003c/li\u003e\n\u003cli\u003eBlock the C2 domains listed in the IOC table at the DNS resolver.\u003c/li\u003e\n\u003cli\u003eInvestigate any unusual process making DNS queries to IP check services, as highlighted by the detection rules.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-02T12:00:00Z","date_published":"2024-01-02T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-02-ip-check-recon/","summary":"Malware and related tools use public IP check services to enumerate victim external IP addresses for reconnaissance and situational awareness.","title":"Malware Gathering Victim Network Information via Public IP Check Services","url":"https://feed.craftedsignal.io/briefs/2024-01-02-ip-check-recon/"}],"language":"en","title":"CraftedSignal Threat Feed - Multiple Malware Families","version":"https://jsonfeed.org/version/1.1"}