Threat Signal ReportNewly Identified Green Stone Malware Leveraging Malicious Macros in Global Campaign
Description
FortiGuard Labs is aware of a campaign targeting Iranian interests, specifically in the energy sector. Dubbed Green Stone, this malware is delivered through Microsoft Excel spreadsheets containing malicious macros. The Green Stone malware is obfuscated in Base64, where the macro code contains instructions to unpack Green Stone into a temporary directory where it is then executed.
What is Green Stone?
Green Stone is classified as an infostealer, is persistent and will steal information from the affected machine. It will look for specific registry entries in \Microsoft\Internet Explorer\TypedURLs to look for websites that the targeted machine recently visited. Besides containing basic infostealer functionality, Green Stone also connects to Telegram to send C2 traffic through, which is likely a way to evade detection.
The threat has the ability to collect information about the victim machine, take screenshots and send it to a predetermined URI. Green Stone can do the following:
Scan directory hierarchies
Delete files and folders
Run commands
Locate files
Rename files and directories
Copy files
and Unzip
Based on our data, connections to the C2 server reveal the United States accounts for 30 percent, Brazil 15 percent and Argentina, Korea and Germany accounting for less than 2 percent of connections to the 185.162.235[.]184 IP address of the attacker.
Who is Behind Green Stone?
There is not enough information at this time to determine attribution.
Any Other Suggested Mitigation?
As it has been observed that Green Stone threat actors have used malicious Microsoft Office files, likely through social engineering and phishing techniques, it is recommended to never enable macro based documents, especially from a sender that is not recognized.
Due to the ease of disruption and damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc. it is important to keep all AV and IPS signatures up to date.
It is also important to ensure that all known vendor vulnerabilities are addressed, and updated to protect from attackers having a foothold within a network. Attackers are well aware of the difficulty of patching and if it is determined that patching is not feasible at this time, an assessment should be conducted to determine risk.
Also - organizations are encouraged to conduct ongoing training sessions to educate and inform personnel about the latest phishing/spear phishing attacks. They also need to encourage employees to never open attachments from someone they don't know, and to always treat emails from unrecognized/untrusted senders with caution. Since it has been reported that various phishing and spear phishing attacks have been delivered via social engineering distribution mechanisms, it is crucial that end users within an organization be made aware of the various types of attacks being delivered. This can be accomplished through regular training sessions and impromptu tests using predetermined templates by an organizations' internal security department. Simple user awareness training on how to spot emails with malicious attachments or links could also help prevent initial access into the network.
What is the Status of Coverage?
Fortinet customers running the latest definitions are protected by the following (AV) signatures:
WM/Agent!tr (Malicious Macro)
W32/Agent.665F!tr (Green Stone)
All network IOC's are blocked by the WebFiltering Client.
