APT35 Automates Initial Access Using ProxyShell

The threat actors activity occurred in two bursts within a 3 day time frame. As with the previous case, they started by uploading their web shell and disabling antivirus services. Soon after, they established two persistence methods. The first was through scheduled tasks, and the second, was via a newly created account. The account was then added to the "remote desktop users" and "local administrators users" groups. Like in the prior case involving ProxyShell,The DFIR Report observed a file masquerading as dllhost.exe that exhibited similarities to a proxy tool call Fast Reverse Proxy (with modifications) downloaded from the same IP as observed in the prior case and connecting to suspect domains. After establishing alternative ways of re-entering the targeted host, they enumerated the environment using Windows native programs such as net and ipconfig. At the end of their first visit, they disabled LSA protection, enabled WDigest for access to plain text credentials later, dumped the LSASS process memory, and downloaded the results via the web shell. All of this activity occurred over a time frame of around 2 minutes, leading to assess that the entire attack was likely scripted out. The user agent strings of python-requests/2.26.0 and python-urllib3/1.26.7 also point to the use of scripts. Two days later, The DFIR Report saw the threat actors reappear. It was expected of them to pick up where they left off, however, they repeated all previous actions. Due to the similarity between the commands and the sequential order they ran, this is additional evidence the threat actors employed automated scripts to execute these activities. No further activity was observed as the threat actors were evicted from the network.