Hackers Targeting Myanmar Use Domain Fronting to Hide Malicious Activities

A malicious campaign has been found leveraging a technique
called domain fronting to hide command-and-control traffic by
leveraging a legitimate domain owned by the Myanmar government to
route communications to an attacker-controlled server with the goal
of evading detection.

The threat, which was observed in September 2021, deployed
Cobalt Strike payloads as a stepping stone for launching further
attacks, with the adversary using a domain associated with the
Myanmar Digital News network, a state-owned digital newspaper, as a
front for their Beacons.

“When the Beacon is launched, it will submit a DNS request for a
legitimate high-reputation domain hosted behind Cloudflare
infrastructure and modify the subsequent HTTPs requests header to
instruct the CDN to direct the traffic to an attacker-controlled
host,” Cisco Talos researchers Chetan Raghuprasad, Vanja Svajcer,
and Asheer Malhotra said^[1]
in a technical analysis published Tuesday.

Originally released in 2012 to address perceived shortcomings in
the popular Metasploit penetration-testing and hacking framework,
Cobalt Strike^[2]
is a popular red team software that’s used by penetration testers
to emulate threat actor activity in a network.

But as the utility simulates attacks by actually carrying out
these attacks, the software has increasingly emerged^[3]
as a formidable weapon in the hands of malware operators, who use
it as an initial access payload that enables the attackers to carry
out a diverse array of post-exploitation activities, including
lateral movement and deploy a wide range of malware.

Cobalt Strike beacon traffic

Although threat actors can obtain Cobalt Strike by purchasing
the tool directly from the vendor’s website for $3,500 per user for
a one-year license, it can also be bought^[4]
on the dark web via underground hacking forums, or, alternatively,
get their hands on cracked, illegitimate versions of the
software.

In the latest campaign observed by Talos, the execution of the
Beacon results in the victim machine sending the initial DNS
request to the government-owned host, while the actual
command-and-control (C2) traffic is stealthily redirected to an
attacker-controlled server, effectively mimicking legitimate
traffic patterns in an attempt to escape detection by security
solutions.

“While the default C2 domain was specified as
www[.]mdn[.]gov[.]mm, the beacon’s traffic was redirected to the
de-facto C2 test[.]softlemon[.]net via HTTP Get and POST metadata
specified in the beacon’s configuration,” the researchers said.
“The DNS request for the initial host resolves to a
Cloudflare-owned IP address that allows the attacker to employ
domain fronting and send the traffic to the actual C2 host
test[.]softlemon[.]net, also proxied by Cloudflare.”

The C2 server, however, is no longer active, according to the
researchers, who noted that it’s a Windows server running Internet
Information Services (IIS).

“Domain fronting can be achieved with a redirect between the
malicious server and the target. Malicious actors may misuse
various content delivery networks (CDNs) to set up redirects of
serving content to the content served by attacker-controlled C2
hosts,” the researchers said. “Defenders should monitor their
network traffic even to high reputation domains in order to
identify the potential domain fronting attacks with Cobalt Strike
and other offensive tools.”