he attack path used to breach US federal networks.
After this VMware Horizon server was detected, the threat actors utilized the following malicious IP address to create a connection: 82.54.217[.] 2
The actors included an exclusion rule for Windows Defender in the exploit payloads, which was activated by the following PowerShell command:
This exclusion rule permitted the inclusion of the full drive c:/ on the exclusion list. Using this strategy, threat actors can download tools to the c:/drive without being identified by virus scans.
Following the download, a file.zip is extracted from 182.54.217[.]2, and the mde.ps1 is deleted from the disk.
That file was discovered by researchers. When the researchers probed deep into the zip file, they discovered crypto-mining software. The following utilities were also downloaded in a volume of roughly 30 megabytes from a site called transfer[.]sh.
Following the execution of Mimikatz on VDI-KMS, a rogue domain administrator account was established using the credentials obtained.
The actors utilized RDP to disseminate the newly established account to a number of machines on the network.
Threat actors have to conduct the following PowerShell command on Active Directory in order to get a footing in the network:
Powershell.exe get-adcomputer -filter * -properties * | select name,operatingsystem,ipv4address >
While the primary goal is to eventually get access to the domain controller, threat actors have modified the local administrator password as a backup in case the rogue domain admin access is identified and revoked.
