Thread by @juanandres_gs

Ok, a delayed connecting flight is finally giving me some time to reflect on the madness of the past few days. Let’s talk about the #3CX software supply chain attack campaign we dubbed SmoothOperator. A brief recap of timeline and salient points…

First of all, let me say I’m shocked at how unfamiliar people are with Sade. You’re breaking @MigoKed’s heart as he continues to play with musical classics for campaign namings. (Looking at you @SecurePeacock :P )

This ‘balagan’ really begins w a series of behavioral detections, the mass of which start on March 22nd and get reported on 3CX’s support forums. As our detections ramp up, so do Palo Alto’s and Crowdstrike’s. There’s a lot of confusion in the forums, w some suggesting exclusions

For those unfamiliar w malware triage at scale, trojanized apps are a pain to figure out (particularly w a 100mb installer package), more so when the file comes from the legit source and is signed w their cert. in most cases, you’re dealing w a false positive and angry customers.

Even our early support struggled to figure this out in the first couple of days. UNTIL, @asaf_gilboa + David Acs latch onto this and realize we are dealing w a five alarm fire. Their early efforts enable us greater visibility and power to act as we figure out what’s happening.

I’m living my blissful existence having a cinnamon danish at @Lachmanina when folks start pinging about 3CX (shoutout to @likethecoins for always being on the ball). I thought there may be something fun… then looked at our support side and realized the planet was on fire.

Jumping on Asaf and David’s early analysis, we were able to latch onto the two most important pieces for early triage imo. The dedicated GitHub repo being used to signal C&C servers and the next-stage infostealer payload. Shoutout to @github for responding quickly—

The repo had a series of ICO files w appended encrypted data. Eventually, the brilliant @jaydinbas was able to decrypt that data to reveal the full URIs being used for C&C by the malware.

Thankfully, we had our hands on the infostealer early and @milenkowski joined the analysis efforts. @TomHegel and @spiderspiders_ went to town profiling associated infra and the spread of the trojanized software.

In 8-10 hours, we were able to produce something more or less comprehensive to provide guidance widely and hopefully support folks needing to do remediation. s1.ai/smoothoperator

On the Mac side, @philofishal got to analyzing Mac deployments on our end. @patrickwardle had confirmed that the MacOS installer too was trojanized but the next stage was missing. We could see the execution of something called UpdateAgent and a hash but it had self-deleted.

https://twitter.com/patrickwardle/status/1641561786829922306

Someone was kind enough to share the sample w Patrick leading to the following analysis👇🏻
(Would love a copy of the sample too if a kind stranger would like to DM ;) )

https://twitter.com/patrickwardle/status/1641687764046585856

Since then, we got more detail from the amazing folks at @Volexity, referring to the malware as ICONIC—
(Shoutout to @stevenadair, Sir @tlansec, and @r00tbsd)
volexity.com/blog/2023/03/3…

We have also heard that @NickGalea3cx has hired the fine folks at Mandiant to conduct a proper DFIR and secure their build pipeline, good things to come there :)

W benefit of some sleep and some hindsight, I’ll say that I’m really grateful that @SentinelOne continue to invest into behavioral engines and dynamic detections. IMO, they’re the *only way* to deal w software supply chain attacks ITW. Many unsung heroes at all of our companies.

I also have to recognize that this isn’t the next ‘SolarWinds’… BECAUSE it was seen this early on. Had this gone on for another month or so, we’d be at a fullblown CCleaner- or SolarWinds-style broad enabler op (“Fishing with Dynamite”, as I like to call them)

That’s up to say, the attacker gets thousands of victims, collects everything they need for future compromises, profiles their haul, and decides how to maximize that access. Think— trojanizing CCleaner suspected of leading to @ASUS LiveUpdate compromise. securelist.com/operation-shad…

As always, I appreciate the sense of shared purpose, helpful-sharing, and relentless sleepless altruism that permeates this community. We all have our affiliations but what happens behind the scenes to help in these cases should give us all faith in humanity against bad odds.

Finally, the GOAT @silascutler has put a checker in place that compares public IPs with volunteer data sources to check for potential infection. It’s not 100% visibility but it’s enough to alert some folks who may otherwise not know they were infected, please amplify—

https://twitter.com/silascutler/status/1641911912022589440

Thank you all, and as always— Happy hunting ;)

I hit send, and of course @pancakeufo had already pointed me at the answer :) Go @vxunderground!

https://twitter.com/pancakeufo/status/1642139901868093440

Nvm, right back to asking for Stage 2 :)