Between May and June , Unit 42 observed previously unknown tools used in the targeting of transportation and shipping organizations based in Kuwait. The first known attack in this campaign targeted a Kuwait transportation and shipping company in which the actors installed a backdoor tool named Hisoka. Several custom tools were later downloaded to the system in order to carry out post-exploitation activities.
All of these tools appear to have been created by the same developer. We were able to collect several variations of these tools including one dating back to July These tools not only use HTTP for their command and control C2 channels, but certain variants of these tools use DNS tunneling or emails to communicate with their C2 as well. While DNS tunneling as a C2 channel is fairly common, the specific method in which this group used email to facilitate C2 communications has not been observed by Unit 42 in quite some time.
In addition to the aforementioned backdoor tools, we also observed tools referred to as Gon and EYE, which provide the backdoor access and the ability to carry out post-exploitation activities. While there are no direct infrastructure overlaps between the two campaigns, historical analysis shows that the and activities are likely related.
On May 19, , we observed a malicious binary named inetinfo. The file inetinfo. Unfortunately, we do not have telemetry on how the actor gained initial access to the system to install the Hisoka backdoor. Within two hours of gaining access to the system through Hisoka, the actor deployed two additional tools named Gon and EYE, whose names were based on the filenames Gon.
At a high level, the Gon tool allows the actor to scan for open ports on remote systems, upload and download files, take screenshots, find other systems on the network, run commands on remote systems and create a Remote Desktop Protocol RDP session.
