Ketrum Backdoor

Ketrum is a newly observed backdoor developed by the Ke3chang advanced persistent threat group for use in their own campaigns. Believed to be created from two of the older tools, Ketrican and Okrum, it has been used attacks against European government organisations.

Threat ID:: CC-3473
Category:: Backdoor
Threat Severity:: Medium
Threat Vector:
Published:: 28 May 2020 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Affected platforms

The following platforms are known to be affected:

Microsoft Windows

Microsoft Windows - All versions

Threat details

As with other Ke3chang tools, there is little evidence detailing how Ketrum is delivered, with unconfirmed reports suggesting it may be delivered in drive-by downloads attacks after a period of extensive target profiling.

At the time of publication, there are two known variants of Ketrum, with one having more functionality. Ketrum 1 is able to spoof User Account Control settings and take screenshots, as well as create copies of cmd.exe to avoid detection. Ketrum 2 is appears to have no additional functionality beyond acting as a basis backdoor. Both variants are able to upload, download, or execute files and commands

Remediation steps

Type	Step
	To prevent and detect an infection, NHS Digital advises that: Secure configurations are applied to all devices. Security updates are applied at the earliest opportunity. Tamper protection settings in security products are enabled where available. Obsolete platforms are segregated from the rest of the network. IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments. Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts. Administrative accounts are only used for necessary purposes. Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations. Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible. Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.

Type

Step

To prevent and detect an infection, NHS Digital advises that:

Secure configurations are applied to all devices.
Security updates are applied at the earliest opportunity.
Tamper protection settings in security products are enabled where available.
Obsolete platforms are segregated from the rest of the network.
IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
Administrative accounts are only used for necessary purposes.
Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.

Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.

Indicators of compromise

Main indicators

IP Addresses

45.56.84[.]25

URLs

thehuguardian[.]com

SHA256 File Hashes

271384a078f2a2f58e14d7703febae8a28c6e2d7ddb00a3c8d3eead4ea87a0c0
aacaf0d4729dd6fda2e452be763d209f92d107ecf24d8a341947c545de9b7311
a142625512e5372a1728595be19dbee23eea50524b4827cb64ed5aaeaaa0270b

Last edited: 29 June 2021 12:01 pm