As an example of this technique, below is a print screen from a GitHub page that has been used by an unknown threat actor to leverage this method. This is an example that when conducting incident response, among other things, you need to have visibility into the tools and techniques the attacker is using so you could properly scope the incident and perform effective and efficient containment and eradication steps. In case the organization was not able to scope the incident and understand the TTP’s (Tools, Tactics and Procedures) then the attacker would still maintain persistence in the environment. However, the attacker could just change the C2 string and point it to a different system. In case the C2 is discovered, the impacted organization could block the IP or URL on the existing boundary security controls as a normal reaction to the concerns of having an attacker inside the network. Why do I say this technique would allow an attacker to have more control? Consider the case that an organization was compromised by a threat actor that use this PlugX technique. The following diagram illustrates how the “Web Online” technique works. This method allows the operator to have more control over the campaign. The other method, is the “Web Online”, which allows the operator to tell the payload from where it should fetch the C2 address. One is using the “DNS Online” technique which allows the operator to define the C2 address e.g, an URL or IP address, that will be used by the payload to speak with the C2. In the PlugX controller, English version from Q3 2013, an operator can build the payload using two techniques. I will use the PlugX controller to accomplish this scenario and observe how an attacker would operate within a compromised environment.Īs we saw previously, the PlugX controller interface allows an operator to build payloads, set campaigns and define the preferred method for the compromised hosts to check-in and communicate with the controller. Following that, the attacker moved laterally to a Windows Domain Controller. For sake of brevity I will skip most of the steps and will focus on the lateral movement.I will use the PlugX controller and C2 functionality to simulate an attacker that established a foothold inside an environment and obtained admin access to a workstation.

As you know the traditional steps of an attack lifecycle follow, normally, a predictable sequence of events i.e., Reconnaissance, initial compromise, establish foothold, escalate privileges, internal reconnaissance, move laterally, maintain persistence, complete mission. Following my previous article on PlugX, I would like to continue the analysis but now use the PlugX controller to mimic some of the steps that might be executed by an attacker.

Ida pro 6.9 leak