TTP Tuesday: GTsST: Iron Viking
Linux SSH worm and wiper
Theme Overview
Our last release for GTsST we looked at GTsST: Sandworm Team. That chain highlighted both a privilege escalation and persistence technique.
For this week’s TTP Tuesday, we’re releasing a new GTsST themed chain centered around Iron Viking in cooperation with Sandworm, both sub teams of GTsST, and their destructive attack against Ukraine on April 8th, 2022. This attack was split into two, one on the IT network and the other on the ICS network. We focused on the IT Network attack which consisted of AWFULSHRED, ORCSHRED, and SOLOSHRED. AWFULSHRED is a Linux worm that installs either ORCSHRED or SOLOSHRED. The main difference between the two is the operating system.
Intentions
As we know, GTsST is a destructive APT group. They tend to attempt highly destructive malware with no hopes of exfiltrating data or ransoming their victims. This was no different, as this attack was a Linux worm with its main purpose of being a wiper. The machines would be wiped in order to cause disruptions to the Ukrainian defensive cyber teams especially during a time of war against Russia.
SSH Worm
The Iron Viking team constructed an SSH worm. This worm had multiple parts. First, it checks if the script was run with the "owner" flag. If the owner flag exists, then it won't infect the current machine and will instead attempt to spread right away using SSH credentials that ESET and CERT-UA believed they had prior to the attack. In the Prelude developed chain, we decided against a word list and instead we will enumerate the machine for SSH keys and spread the worm using those specific keys. This proves to be more impactful as most networks disable password authentication and use private-key authentication instead.
Wiper
After infecting the machine, we deploy the original defanged wiper used by GTsST. This wiper goes by the name ORCSHRED and is lightly obfuscated. Many variables and values are replaced with meaningless 8-character values. The script ultimately destroys the drives using the `shred` utility or `dd` if shred is not available. If there are multiple drives it will run in parallel. Depending on the size, it may take hours for the full disk to be completely erased. To render the system inoperable faster, it first tries to stop and disable HTTP and SSH services then proceeds with the wiping the drives.
Impact
Ukraine is once again at the center of cyberattacks targeting their critical infrastructure. Ukraine has suffered multiple waves of wipers that have been targeting various sectors. ESET and CERT-UA will continue to monitor for more activity as this is a major attack against critical infrastructure.
Thanks for reading!
Check it out on the Prelude chains website.
Watch a demonstration:
Staying up to date
Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!
There are several ways to follow us and learn more about Prelude and our team members:
Get our products
Download Prelude Operator: https://www.prelude.org/download
See the latest kill chain and TTP Releases: https://chains.prelude.org/
See our open-source repositories: https://github.com/preludeorg
Join our community
Discord: https://discord.gg/gzUv4XNquu
Reddit: https://www.reddit.com/r/preludeorg/
Twitter: https://twitter.com/preludeorg
Read, watch, and listen
Listen to our Podcast: https://anchor.fm/preludeorg
Read our blog: https://feed.prelude.org
Watch our live streams: https://www.twitch.tv/preludeorg
Watch our pre-recorded content: https://www.youtube.com/c/preludeorg
Follow our team
David: https://twitter.com/privateducky
Alex: https://twitter.com/khyberspache
Kris: https://twitter.com/Xanthonus
Octavia: https://twitter.com/VV_X_7
Sam: https://twitter.com/wasupwithuman