Hackers Using a Windows OS Feature to Evade Firewall and Gain Persistence

A novel technique adopted by attackers finds ways to use
Microsoft’s Background Intelligent Transfer Service (BITS) so as to
deploy malicious payloads on Windows machines stealthily.

In 2020, hospitals, retirement communities, and medical centers
bore the brunt of an ever-shifting phishing campaign^[1] that distributed custom
backdoors such as KEGTAP, which ultimately paved the way for RYUK
ransomware attacks.

But new research^[2]
by FireEye’s Mandiant cyber forensics arm has now revealed a
previously unknown persistence mechanism that shows the adversaries
made use of BITS to launch the backdoor.

Introduced in Windows XP, BITS^[3]
is a component of Microsoft Windows, which makes use of idle
network bandwidth to facilitate the asynchronous transfer of files
between machines. This is achieved by creating a job — a container
that includes the files to download or upload.

BITS is commonly used to deliver operating system updates to
clients as well as by Windows Defender antivirus scanner to fetch
malware signature updates. Besides Microsoft’s own products, the
service is also put to use by other applications such as Mozilla Firefox^[4]
to enable downloads to continue in the background even when the
browser is closed.

“When malicious applications create BITS jobs, files are
downloaded or uploaded in the context of the service host process,”
FireEye researchers said. “This can be useful for evading firewalls
that may block malicious or unknown processes, and it helps to
obscure which application requested the transfer.”

Specifically, the post-compromise incidents involving Ryuk
infections were found to leverage the BITS service to create a new
job as a “System update” that was configured to launch an
executable named “mail.exe,” which in turn triggered the KEGTAP
backdoor, after attempting to download an invalid URL.

“The malicious BITS job was set to attempt an HTTP transfer of a
nonexistent file from the localhost, the researchers noted. “As
this file would never exist, BITS would trigger the error state and
launch the notify command, which in this case was KEGTAP.”

The new mechanism is yet another reminder of how a useful tool
like BITS can be repurposed by attackers to their own advantage. To
aid incident response and forensic investigations, the researchers
have also made available a Python utility called BitsParser^[5]
that aims to parse BITS database files and extract job and file
information for additional analysis.