The threat actors used Cobalt Strike to run additional discovery tasks using Microsoft utilities like net, ping, systeminfo, and taskmanager. After this activity, the host went quiet for about one hour before downloading and executing a Cobalt Strike beacon DLL. Upon initial execution on the beachhead, the malware made an initial connection to command and control, and then a few minutes later it performed discovery tasks on the host using Microsoft utilities like Net and Nltest to discover the domain and users of interest. In this case we observed the initial activity beginning with a BazarLoader DLL. However BazarLoader has also been used with Word and Excel documents as well.

At the time of the intrusion, the group was favoring zip attachments with malicious javascript files to download the BazarLoader malware. For this intrusion we don’t know the initial campaign that deployed the malware but based on previous information, we can assess with high confidence that the delivery vector was a malicious email campaign.

Case SummaryīazarLoader has continued to be one of the preeminent initial access brokers for ransomware threat actor access. In July we witnessed a BazarLoader campaign that deployed Cobalt Strike and ended with domain wide encryption using Conti ransomware. Despite the group having it’s affiliate guide leaked, which revealed many techniques already covered in previous reports, the group’s using the ransomware are unlikely to let up any time soon. The groups deploying this RaaS have only grown more prevalent. Conti is a top player in the ransomware ecosystem, being listed as 2nd overall in the Q2 2021 Coveware ransomware report.

Antares autotune 5 crack