A recent rise in the number of Truebot infections has been attributed to a threat actor known as the Silence Group. The Silence Group is an initial access broker (IAB) that frequently changes tools and tactics to stay on top of the game. An IAB's primary task is to find a weakness or vulnerability, create a foothold in a network, and do some exploratory work to find out how attractive the target is. Once this is done they can sell the access to another threat actor, like a ransomware group. For these tasks Truebot is the tool of choice in the Silence Group.

The Silence Group seems to have a strong relation with the group behind Clop ransomware, often referenced as TA505. Which, in turn, has a large overlap with the FIN11 group.

Truebot

The researchers identified two separate Truebot botnets. One of which appears to be focused on the US, while the other is predominantly focused at Mexico, Pakistan, and Brazil.

We touched on the second one when we wrote about the recent activities of the Raspberry Robin worm. The use of this worm, in combination with an attack vector leveraging a Netwrix vulnerability, seems the have laid the ground work for the creation of a botnet of over 1,000 systems that is distributed worldwide.

The other botnet is almost exclusively composed of Windows servers, directly connected to the internet, and exposes several Windows services such as SMB, RDP, and WinRM. The attack vector that was used to establish this botnet has not yet been identified, although the researchers are confident that it is different from those used for the other botnet, Raspberry Robin and the Netwrix vulnerability (CVE-2022-31199).

New version

At its core, Truebot is a Trojan.Downloader. As such, it is an ideal malware for IAB groups that want to plant a backdoor on a system and do some basic reconnaissance of the network. For those purposes, this new version of Truebot collects this information: a screenshot, the computer name, the local network name, and active directory trust relations. Active Directory trust relations allow organizations to share users and resources across domains.

What’s also new is that this version is now capable of loading and executing additional modules and shellcodes in memory, making the payloads fileless malware which is less likely to be detected.

Exfiltration

Besides the usual suspects designed to act as a backdoor, Cobalt Strike and Grace, the researchers also found a new data exfiltration tool. Finding Grace as a payload seems to confirm the close ties between the Silence Group and TA505 since Grace was almost exclusively used by TA505.

The exfiltration tool, dubbed Teleport, was used extensively by the attackers to steal information from the network. It seems to be a custom data exfiltration tool built in C++ , containing several features that make the process of data exfiltration easier and stealthier. It has some features that are not commonly found in remote copying tools but which make it very useful to an attacker stealthily exfiltrating data.

• It limits the upload speed, which can make the transmission go undetected by tools that monitor for large data exfiltration and avoids slowing down the network.
• The communication is encrypted to hide what information is being transmitted.
• Limiting the file size, which can maximize the number of stolen files by avoiding lengthy copies of files that may not be interesting.
• The ability to delete itself after use, which is ideal to keep it as unknown as possible.

Clop

Ransom.Clop was first seen in February of 2019. Besides encrypting systems, the Clop ransomware also exfiltrates data that will be published on a leak site if the victim refuses to pay the ransom. In February of 2021, the group made headlines by targeting executives' systems specifically to find sensitive data.

Mitigation

The tools that are used by Silence are versatile, but there are a few logical steps you can take to protect yourself and your organization:

• Do not insert USB drives of unknown or unreliable origin into your systems. 
• In Windows, the autorun of USB drives is disabled by default. However, many organizations have widely enabled it through legacy Group Policy changes. If you enabled it, this is a policy worth re-thinking.
• Install patches as soon as possible, especially for internet facing devices.
• Run an anti-virus/anti-malware solution that actively monitors and scans your systems.

Malwarebytes blocks the download URLs and detects Truebot as Malware.AI.{id.nr.}. Clop ransomware is detected as Malware.Ransom.Agent.Generic.

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.