Threat video1:00
UNC5142 and UNC5342 EtherHiding C2: Detection & IOCs
UNC5142 and UNC5342 store C2 addresses in Ethereum smart contracts, beyond takedown reach. Hunt with 9 detection rules, 30 IOCs and a free Splunk SPL rule.
Read the full threat intel for Evolution of C2 Infrastructure: Blockchain-Based (On-Chain) C2 and… →
Chapters
- 0:00The hookSmart contracts hide command centers.
- 0:04The storyFourteen thousand WordPress sites injected.
- 0:10Attack pathSmart contracts deployed as C2.
- 0:23AttributionAttributed to UNC5142.
- 0:29Indicators of compromise24 indicators to hunt: 9 IPs, 10 domains and 2 URLs, and more.
- 0:36MITRE ATT&CK techniques16 ATT&CK techniques, from resource development to command and control.
- 0:41Remediation5 steps now: Block or alert on JSON-RPC egress to Ethereum/BSC RPC providers.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Smart contracts hide command centers.
0:05Fourteen thousand WordPress sites injected.
0:07Trojanized extensions followed.
0:11Smart contracts deployed as C2.
0:13Queries cost nothing.
0:15ClickFix lures trigger malware.
0:17Malware steals credentials.
0:23Attributed to UNC5142. Confidence: medium.
0:2924 indicators to hunt: 9 IPs, 10 domains and 2 URLs, and more.
0:3616 ATT&CK techniques, from resource development to command and control.
0:425 steps now: Block or alert on JSON-RPC egress to Ethereum/BSC RPC providers.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.