The MonPass Certificate Authority Client Backdoor

What happened

Attackers broke into the public web server of MonPass and replaced the client installer with a backdoored build. The Avast report found eight different webshells and backdoors on the server. This points to repeated intrusions.

The poisoned installer downloaded a bitmap image from an attacker server. The code took every fourth byte of the image data, starting from the third byte, and turned the resulting hex text into binary. It then decrypted the result with the XOR key miat_mg and ran a Cobalt Strike beacon. The malware also checked processor count, memory, and disk size, and stopped if the values looked like an analysis machine.

Avast could not attribute the attack with confidence. It reports circumstantial evidence of a China-based espionage group, based on similar campaigns against government bodies and certificate authorities in Asia. The Record also covered it.

The timeline from the Avast report: first contact with MonPass through MN CERT/CC on 8 April 2021, a forensic image of the server shared on 20 April, and findings sent on 22 April.

Affected versions

MonPass did not publish version numbers in the sources used here. The affected file is the MonPass client installer that visitors could download from the MonPass website between 8 February and 3 March 2021. Anyone who downloaded the client in that period is affected. A clean installer had been on the same page before.

Indicators of compromise

• SHA-256 hashes listed by Avast: e2596f015378234d9308549f08bcdca8eadbf69e488355cddc9c2425f77b7535, f21a9c69bfca6f0633ba1e669e5cf86bd8fc55b2529cd9b064ff9e2e129525e8, 4a43fa8a3305c2a17f6a383fb68f02515f589ba112c6e95f570ce421cc690910, and others in the Avast IoC repository.
• Files named DNS.exe, Browser_plugin.exe, and Silverlight_ins.exe.
• Payload URLs on download.google-images.ml:8880, micsoftin.us:2086, 37.61.205.212:8880, and jquery-code.ml.
• The PDB path C:\Users\test\Desktop\fishmaster\x64\Release\fishmaster.pdb and the string Bidenhappyhappyhappy in the samples.

The full list is at github.com/avast/ioc.

How to check

Hash the installer you saved and compare it with the Avast list. On macOS or Linux:

shasum -a 256 MonPass-installer.exe

On Windows, use Get-FileHash in PowerShell. Search proxy and DNS logs for the listed domains.

Get-FileHash .\MonPass-installer.exe -Algorithm SHA256

What to do now

1. Find every machine that installed the MonPass client between 8 February and 3 March 2021.
2. Compare hashes and logs with the Avast indicators.
3. If a match exists, treat the machine as compromised. A Cobalt Strike beacon gives the operator remote control.
4. Reinstall the client from the current MonPass site and reset credentials used on the machine.
5. Contact MonPass or MN CERT/CC if you were a customer. MonPass reports that it notified affected customers.

What Vigilance showed

Vigilance compares the version you trust with the new one and names the file that gained a new capability. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 76

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

CHANGED    MonPass.exe
           It now downloads from the internet, reads saved passwords and access keys and runs other programs. It did not before.

Sources

1. decoded.avast.io/luigicamastra/backdoored-client-from-mongolian-ca-monpass/
2. gendigital.com/blog/insights/research/backdoored-client-from-mongolian-ca-monpass
3. therecord.media/mongolian-certificate-authority-hacked-eight-times-compromised-with-malware