Dalbit's Ingenuity

Indicators of Compromise

Notes

<div>Dalbit is the name given to a threat actor group that has been active in South Korea since 2015. This group is known for its sophisticated and persistent attacks against various organizations in the country, including government agencies, universities, and private companies. The name "Dalbit" is Korean for "moonlight," which reflects the group's covert and stealthy nature.</div><div><br></div><div>Dalbit's modus operandi involves using a combination of advanced hacking tools, social engineering, and customized malware to gain access to the target's network. Once inside, the group uses various techniques such as privilege escalation, lateral movement, and data exfiltration to achieve their objectives. The group's ultimate goal is usually to steal sensitive information, disrupt operations, or cause other forms of damage to the target.</div><div><br></div><div>One of the most notable aspects of Dalbit's attacks is their use of web shells. These are small pieces of code that are uploaded to compromised web servers and provide a backdoor into the system for the attackers. Web shells can be used to execute commands, upload/download files, and access the underlying database. Dalbit has been known to use various web shell variants, including China Chopper and AntSword.</div><div><br></div><div>Another hallmark of Dalbit's attacks is their use of proxy tools to hide their activities. The group has been known to use tools like FRP and LCX to create a tunnel between the compromised system and their command-and-control server. This allows them to communicate with the target's network without being detected by network security systems.</div><div><br></div><div>Dalbit has also been observed using various privilege escalation tools to gain higher levels of access within the target's network. These tools include Potato, JuicyPotato, and SweetPotato. Once they have gained administrative access, the group can carry out a range of actions such as adding new user accounts, disabling security features, and installing additional malware.</div><div><br></div><div>One of the most concerning aspects of Dalbit's activities is their persistence. The group has been known to maintain access to a compromised network for extended periods, sometimes years, without being detected. They achieve this by using various techniques to remain hidden, such as deleting logs and masking their activities as legitimate traffic.</div><div><br></div><div>In conclusion, Dalbit is a highly sophisticated and persistent threat actor group that poses a significant risk to organizations in South Korea. Their use of advanced hacking tools, customized malware, and social engineering techniques make them a formidable adversary. To defend against their attacks, organizations need to implement comprehensive security measures and remain vigilant to detect and respond to any potential breaches.</div>

Mitigation

<table style="border-collapse: collapse; border-spacing: 0px; margin-bottom: 0px; border: 1px solid rgb(230, 230, 230); width: 1796.6px;"><thead style="border-bottom: 3px solid;"><tr><td style="padding: 10px 13.3333px; border: 1px solid rgb(230, 230, 230);"><strong>Execution</strong></td><td style="padding: 10px 13.3333px; border: 1px solid rgb(230, 230, 230);"><strong>Persistence</strong></td><td style="padding: 10px 13.3333px; border: 1px solid rgb(230, 230, 230);"><strong>Privilege Escalation</strong></td><td style="padding: 10px 13.3333px; border: 1px solid rgb(230, 230, 230);"><strong>Credential Access</strong></td><td style="padding: 10px 13.3333px; border: 1px solid rgb(230, 230, 230);"><strong>Discovery</strong></td><td style="padding: 10px 13.3333px; border: 1px solid rgb(230, 230, 230);"><strong>Defense Evasion</strong></td><td style="padding: 10px 13.3333px; border: 1px solid rgb(230, 230, 230);"><strong>Lateral Movement</strong></td><td style="padding: 10px 13.3333px; border: 1px solid rgb(230, 230, 230);"><strong>Collection</strong></td><td style="padding: 10px 13.3333px; border: 1px solid rgb(230, 230, 230);"><strong>Exfiltration</strong></td><td style="padding: 10px 13.3333px; border: 1px solid rgb(230, 230, 230);"><strong>Command and Control</strong></td><td style="padding: 10px 13.3333px; border: 1px solid rgb(230, 230, 230);"><strong>Impact</strong></td><td style="padding: 10px 13.3333px; border: 1px solid rgb(230, 230, 230);"><strong>Resource Development</strong></td></tr></thead><tbody><tr><td style="padding: 10px 13.3333px; border: 1px solid rgb(230, 230, 230);">– Command and Scripting Interpreter(T1059)<br><br>– Windows Management Instrumentation(T1047)<br><br>– System Service(T1569)</td><td style="padding: 10px 13.3333px; border: 1px solid rgb(230, 230, 230);">– Scheduled Task/Job(T1053)<br><br>– Create Account(T1136)<br><br>– Server Software Component(T1505)<br><br>– Account Manipulation(T1098)</td><td style="padding: 10px 13.3333px; border: 1px solid rgb(230, 230, 230);">– Access Token Manipulation(T1134)<br><br>– Exploitation for Privilege Escalation(T1068)</td><td style="padding: 10px 13.3333px; border: 1px solid rgb(230, 230, 230);">– OS Credential Dumping (T1003)</td><td style="padding: 10px 13.3333px; border: 1px solid rgb(230, 230, 230);">– Remote System Discovery(T1018)<br><br>– Network Service Discovery(T1046)</td><td style="padding: 10px 13.3333px; border: 1px solid rgb(230, 230, 230);">– Impair Defenses(T1562)<br><br>– Indicator Removal(T1070)</td><td style="padding: 10px 13.3333px; border: 1px solid rgb(230, 230, 230);">– Remote Services(T1021)<br><br>– Lateral Tool Transfer(T1570)</td><td style="padding: 10px 13.3333px; border: 1px solid rgb(230, 230, 230);">– Data from Local System(T1005)<br><br>– Account Discovery: Email Account(1087.003)<br><br>– Email Collection(T1114)<br><br>– Screen Capture(T1113)</td><td style="padding: 10px 13.3333px; border: 1px solid rgb(230, 230, 230);">–&nbsp;Exfiltration Over Web Service(T1567)</td><td style="padding: 10px 13.3333px; border: 1px solid rgb(230, 230, 230);">– Proxy(T1090)<br><br>– Ingress Tool Transfer(T1105)</td><td style="padding: 10px 13.3333px; border: 1px solid rgb(230, 230, 230);">– Data Encrypted for Impact(T1486)</td><td style="padding: 10px 13.3333px; border: 1px solid rgb(230, 230, 230);">– Stage Capabilities: Upload Malware(T1608.001)</td></tr></tbody></table>