Analysing XeGroup’s Arsenal Of Cyberattack Methods

Uploaded on 2023-06-15 in TECHNOLOGY--Hackers, NEWS-Cybersecurity News, FREE TO VIEW

In an era when cybercrime is becoming increasingly unpredictable, it is hard to truly say what is coming around the corner. However, at the end of last year, we did make several key predictions for 2023.

After continuing to see an uptick in Highly Evasive Adaptive Threat (HEAT) techniques, a new class of cyber threats that have emerged - these have been tailored to evade protective tools such as firewalls, secure web gateways, and malware analysis technologies, and we expect to see more of this in the future.

At the same time, we anticipated that basic security failures would continue to plague companies, with simple and proven methods such as social engineering techniques often providing open doors to attackers. We also identified browser-based attacks as a key area of concern, with attackers exploiting both new and old vulnerabilities.

Ultimately, the truth of the matter is that threat actors are continuing to adapt and evolve their techniques. And as a result, we are seeing a combination of novel threats and proven attack methods that together are creating an increasingly volatile threat landscape.

Of course, some attack groups have developed a track record for primarily focusing their efforts on exploiting one vulnerability or using one technique. However, others have demonstrated an appetite for deploying a range of threat methods to target their victims.

With regards to the latter category, XeGroup stands as a prime example.

Believed to have been established and active since at least 2013, this threat group that is likely to be based in Vietnam has been responsible for a number of nefarious activities, including:

Supply chain attacks that inject credit card skimmers into web pages.

Creating fake websites to deceive users into revealing their personal information.

Selling stolen data on the dark web.

XeGroup’s Track Record

Security research group, Volexity detailed the specific tactics, techniques, and procedures (TTPs) used by XeGroup in a recent report, this suggesting that the group may be associated with both other cybercriminal organisations and state-sponsored hacking groups.

The group was first identified in 2013 when it successfully exploited retail point-of-sale (PoS) systems globally through its malware called “Snipr”, which was created specifically for this purpose.

Indeed, it is estimated that the threat outfit has stolen more than $30 million from US-based corporations, as well as compromising several websites and mobile applications with malicious code designed to steal payment card data from unsuspecting customers.

Arguably, the most prevalent technique used by XeGroup is the injection of malicious JavaScript into web pages, previously used to successfully exploit vulnerabilities in Magento e-commerce platforms and Adobe ColdFusion server software.

Further, in addition to stealing financial information directly, XeGroup has also demonstrated a track record for attempting to gain access to corporate networks through the deployment of phishing emails sent out using fake domains impersonating legitimate companies, such as PayPal and eBay.

Such activities continued for seven years until August 2020, when XeGroup was said to have been taken down after Volexity’s researchers reported their findings to law enforcement agencies, resulting in several key arrests across multiple countries.

Adapted Attack Methods

Unfortunately, however, it seems that XeGroup has once again reappeared, and is now actively attempting to exploit the CVE-2019-18935 vulnerability.

If done so successfully, this can enable threat actors to execute arbitrary code remotely on a vulnerable server by exploiting a deserialisation vulnerability in the Telerik.Web.UI assembly.

These efforts were flagged by the US Cybersecurity and Infrastructure Security Agency (CISA) in an advisory published back in 15 March 2023. Further research from the Menlo Labs threat intel team affirms that XeGroup actors are targeting government agencies, construction firms, and healthcare organisations across our customer base.

Further, XeGroup is also now associated with the use of ASPXSPY web shells – scripts that are intentionally designed to be malicious, allowing threat actors to gain unauthorised access to web servers and carry out further attacks.

Protecting Against Varied Threats

XeGroup’s diverse array of threat techniques highlight just how imperative it is for organisations to enhance their defences to combat today’s HEAT attacks and other security threats.

No longer can companies rely on outdated detect and remediate solutions. Today, they must also adopt preventative security measures to ensure any attempts from threat actors can be thwarted in the first instance.

One straightforward way to achieve this is through isolation technology. Designed to support organisations in achieving zero trust in the truest sense, it a solution that creates a ‘digital air gap’ that ensures all active code - be it malicious or not - is executed in isolated cloud containers, removing any risk from common web and email attack vectors.

Brett Raybould is EMEA Solutions Architect at Menlo Security

You Might Also Read:

Highly Evasive Adaptive Threats & Advanced Persistent Threats:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.