CRYSTALRAY (Cybercriminals) – Threat Actor

Overview

Scanning for Vulnerabilities

One of CRYSTALRAY’s primary tactics is exploiting weaknesses in publicly accessible infrastructure through a systematic vulnerability scanning process. The group relies on tools such as zmap, an open-source network scanner used to map large networks rapidly, and nuclei, a fast vulnerability scanner. These tools allow CRYSTALRAY to identify exploitable vulnerabilities across thousands of servers and devices. Once vulnerabilities are found, particularly in services like Secure Shell (SSH), the attackers quickly deploy other exploits to gain access. One tool that CRYSTALRAY has been observed using is SSH-Snake, a post-exploitation framework designed to automate SSH credential attacks. By leveraging the SSH-Snake framework, CRYSTALRAY is able to brute-force credentials and infiltrate systems undetected. With SSH access, they pivot to more sensitive areas of the network, allowing for deeper compromise.

Deploying Cryptominers and Persistence Mechanisms

Once inside a compromised network, CRYSTALRAY deploys cryptominers to monetize their access. Cryptomining malware has become a common payload due to its ability to generate revenue for attackers while consuming system resources without immediate detection. CRYSTALRAY uses cryptominers tailored to target the specific capabilities of the compromised system, whether it is a Linux-based server or a cloud instance. A key feature of CRYSTALRAY’s operation is its ability to establish persistence. By using techniques such as SSH key installation, they ensure long-term access to compromised machines. In many cases, the attackers use OSS tools to automate this persistence, deploying scripts that generate SSH keys and modify user accounts to allow continued access. Additionally, CRYSTALRAY employs cron jobs to schedule periodic execution of malicious scripts, ensuring that their mining operations and control over the infected system remain intact even after reboot or updates.

Credential Theft and Data Exfiltration

Beyond cryptomining, CRYSTALRAY actively engages in credential theft and data exfiltration. The group often targets high-value credentials stored on compromised machines, including administrative passwords, API keys, and database credentials. By using proof-of-concept exploits readily available in the cybersecurity community, CRYSTALRAY is able to exfiltrate these credentials, which are later sold on underground forums or used to further infiltrate other networks. One of CRYSTALRAY’s favorite techniques is to scan for sensitive files, such as .bash_history and config files, where credentials may be stored or referenced. By extracting this information, CRYSTALRAY expands its attack surface, using stolen data to compromise other systems that share similar configurations or access points.

Exploiting Proof-of-Concept (PoC) Tools

Perhaps the most alarming aspect of CRYSTALRAY’s operations is its reliance on PoC tools. These are often developed and shared within the cybersecurity community to demonstrate vulnerabilities and aid in legitimate defense research. CRYSTALRAY repurposes these tools to automate its attacks. By using PoC exploits for known vulnerabilities—such as SQL injections, remote code execution flaws, or zero-day vulnerabilities—the threat actor quickly gains access to systems that have not yet been patched. The group’s rapid adoption of these PoC tools reflects a growing trend among threat actors to weaponize OSS for nefarious purposes. CRYSTALRAY’s approach highlights the risks associated with sharing exploit code openly, as malicious actors can exploit it long before organizations have a chance to patch or secure vulnerable systems.

Conclusion: A Growing Threat

CRYSTALRAY represents a new breed of threat actor that leverages the power of open-source tools to carry out highly effective cyberattacks. By using widely available software designed for legitimate testing, they evade traditional detection mechanisms and operate stealthily within compromised environments. Their operations, which range from cryptomining to credential theft and data exfiltration, underscore the growing complexity of modern cyber threats. As they continue to evolve, organizations must remain vigilant, adopting stronger detection mechanisms and ensuring timely patching of vulnerabilities to defend against this formidable group.

References:

• CRYSTALRAY: Inside the Operations of a Rising Threat Actor Exploiting OSS Tools