|
| |
| |
| |
| |
| |
| |
| MeshAgent
PurpleInk
InkBox
InkLoader |
Overview
The advanced persistent threat actor known as LilacSquid has emerged as a sophisticated and stealthy player in the world of cyber espionage. Active since at least 2021, LilacSquid has been attributed with a series of complex and targeted data theft campaigns. This threat actor demonstrates a high level of versatility and adaptability, employing a mix of open-source tools and custom malware to compromise and control a wide range of victim organizations.
The sophistication of LilacSquid’s attacks is underscored by their use of advanced techniques and tools to evade detection and maintain access. Their operations bear similarities to those of North Korean APT groups, such as Andariel and Lazarus, particularly in their use of remote management tools and tunneling mechanisms. This connection highlights the advanced nature of LilacSquid’s tactics and their strategic approach to cyber espionage.
Defensive Measures
Organizations can detect and mitigate threats from LilacSquid’s campaign using various tools and strategies. Cisco Secure Endpoint, Secure Web Appliance, and Secure Email can block and detect malicious activities associated with this campaign. Additionally, Cisco Secure Firewall, Umbrella, and Secure Malware Analytics provide comprehensive protection against the malicious tools and techniques used by LilacSquid. For updated detection rules, open-source Snort users can refer to the latest rule packs available on Snort.org.
Common targets
Their operations span across various industries, including information technology, energy, and pharmaceuticals, with notable activity in the United States, Europe, and Asia.
Attack vectors
Exploitation of Public-Facing Applications
Compromised Remote Desktop Protocol (RDP) Credentials
Phishing Emails
Malicious Attachments or Links
Exploitation of Vulnerabilities in Internet-Exposed Servers
How they operate
Infection and Initial Access
LilacSquid employs several techniques to gain initial access to their targets. The first vector involves exploiting vulnerabilities in public-facing applications. These applications, often accessible via the internet, are susceptible to various exploits, which LilacSquid utilizes to deploy their malware. Another significant attack vector is the use of compromised Remote Desktop Protocol (RDP) credentials. By leveraging stolen RDP credentials, the threat actor gains direct access to the target systems, bypassing many conventional security defenses.
Upon successful infiltration, LilacSquid deploys a suite of tools designed to establish control and facilitate further attacks. The initial stage of their infection chain commonly involves the deployment of MeshAgent, an open-source remote management tool. MeshAgent is utilized to establish persistent access, allowing the threat actor to conduct reconnaissance and deploy additional malware. This tool’s integration is crucial, as it facilitates the management and manipulation of compromised systems remotely.
Deployment of Custom Malware
The primary tool in LilacSquid’s arsenal is PurpleInk, a highly customized variant of the QuasarRAT. PurpleInk is a versatile Remote Access Trojan (RAT) with extensive capabilities, including system enumeration, file manipulation, and process management. This malware enables LilacSquid to gather a wide range of information from the infected hosts, execute commands, and maintain a robust foothold within the compromised network. PurpleInk is often accompanied by configuration files that are base64-decoded and decrypted to provide the necessary parameters for communication with command-and-control (C2) servers.
Another critical component in LilacSquid’s toolkit is InkLoader, a .NET-based malware loader designed to run hardcoded executables or commands. InkLoader serves as a persistence mechanism, ensuring that the malware remains operational across system reboots. This loader typically works in tandem with PurpleInk, enhancing its deployment and execution capabilities.
Advanced Techniques and Tactics
LilacSquid’s operations are marked by their sophisticated use of additional tools such as Secure Socket Funneling (SSF). SSF is employed for proxying and tunneling multiple sockets through a single secure TLS tunnel, which helps obfuscate the network traffic and further evades detection. The deployment of SSF, alongside other tools, allows LilacSquid to create multiple channels for data exfiltration and secondary access.
In terms of persistence and further exploitation, LilacSquid utilizes InkBox, an older custom malware loader. InkBox reads and decrypts files from the disk, executing the secondary payload, which in this case is often PurpleInk. This modular approach to infection ensures that the malware is both versatile and resilient against detection.
MITRE Tactics and Techniques
Exploitation of Public-Facing Application – Exploiting vulnerabilities in web applications (T1190)
Compromised Remote Desktop Protocol (RDP) Credentials – Using stolen RDP credentials for initial access (T1076)
Execution – Running scripts and binaries for malware execution (T1059, T1203)
Remote Access Tools (RATs) – Deploying and utilizing RATs like PurpleInk for persistent access (T1219, T1021)
Data Staged – Collecting and staging data for exfiltration (T1074)
Command and Control – Using MeshAgent for command and control (T1071, T1105)
Credential Dumping – Gathering credentials from compromised systems (T1003)
Lateral Movement – Moving through network using legitimate credentials or remote tools (T1075, T1210)
Exfiltration Over Command and Control Channel – Sending stolen data through established C2 channels (T1041)
Impact / Significant Attacks
Pharmaceutical Industry Breach (Asia, 2021–2024): LilacSquid targeted organizations within the pharmaceutical sector in Asia. The group’s sophisticated malware and exploitation techniques aimed at stealing sensitive research and development data.
Energy Sector Attack (Europe, 2022–2024): In this campaign, LilacSquid breached organizations in the European energy sector. The attack involved exploiting vulnerabilities in public-facing applications and compromised RDP credentials to gain unauthorized access and siphon critical operational data.
IT Sector Breach (United States, 2021–2024): LilacSquid’s activities in the U.S. involved targeting IT organizations that build software for research and industrial applications. The group exploited these organizations to gain insights into software development and potentially affect software supply chains.
References:
