Hello, welcome to the Friday, July 1st, 2022 edition of the Sansonet Storms and StormCast. My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

Nice case study today by Brad who looked at a quackbot infection that then resulted in Cobalt Strike being used for command and control.

Nothing really all that exciting or new here.

But one thing that Brad points out in this particular example is that the Cobalt Strike

connection kept on working even after the domain used to actually direct the victim to the particular Cobalt Strike server

had been suspended. The simple reason for this is that, well, a Cobalt Strike fell back to the

IP address. Typically, you will find a host name as well as an IP address that can be configured as a command control server.

Yes, the certificate was no longer any good, of course, for the IP address.

It just contained the host name, but still good enough for Cobalt Strike to maintain the connection.

And Brad discovered that sort of a week after the original domain was removed.

Little side note here on this, getting domains suspended often depends a lot on the registrar that is being used here.

Just big kudos to NameChip. The register NameChip has

been very responsive in revoking domains used for malicious purposes. So if you are attempting

to do something malicious with your domain, please make it easier for us to take your domain

down and register it with NameChief. Back in April,

Soho did publish an update for Manage Engine 80 Audit Plus. This update fixed vulnerability

CVE 2022, 28, 2019 and cost a lot of excitement in part because, well, Manage Engine 80 Audit

Plus, it used to manage active directory and a compromise of the system could potentially

compromise active directory. Horizon 3 AI, the company that found this vulnerability, now published a blog post

showing how this particular vulnerability can actually be exploited, and it goes in quite a bit of

detail how to essentially end up with a complete domain compromise and remote code execution.

It sort of all starts out with an unauthenticated XML external entity injection.

...