Unmasking VEILDrive: Threat Actors Exploit Microsoft Services for C2

• By Team Axon

35 minutes to read

TL;DR

• Hunters’ Team AXON has identified and is currently monitoring an ongoing threat campaign, dubbed “ VEILDrive”
• The campaign was originally identified as part of an AXON engagement to address a malicious activity identified in one of our customers' infrastructure.
• Team AXON reported its findings to Microsoft to assist in shutting down the actor’s infrastructure.

Executive Summary

Hunters’ Team AXON has uncovered and is actively monitoring an ongoing threat campaign dubbed "VEILDrive”. Initially discovered during an investigation of malicious activity in a customer's infrastructure, VEILDrive leverages Microsoft’s SaaS suite—particularly Teams, SharePoint, Quick Assist, and OneDrive—to execute its tactics.

This report provides insights into VEILDrive's methodologies and the limitations of current detection approaches to better equip the cybersecurity community against evolving threats.

Background

In September 2024, Team AXON responded to an incident targeting a critical infrastructure company in the United States. This investigation revealed a unique threat campaign, "VEILDrive” which displayed unusual tactics, techniques, and procedures (TTPs).

Team AXON has shared its findings with Microsoft and impacted organizations, offering actionable intelligence to mitigate this ongoing threat.

The VEILDrive Attack Path

In early September 2024, one of Hunters' customers, referred to below as "Org C”, engaged Team AXON for support in handling an active incident. The attack sequence unfolded through a series of sophisticated techniques focused on social engineering and exploitation of Microsoft services.

Attack Diagram

.png?width=1094&height=788&name=VIELdrive%20attack%20diagram%20(13).png)

Steps Involved in the Attack:

1. Initial Access: The malicious actor used Microsoft Teams to message employees at Org C, impersonating an IT team member.
2. Exploitation: They successfully lured the victim of Org C to execute the Quick Assist tool for remote access.
3. Malware Deployment: The attacker shared download links containing malicious files hosted on SharePoint.
4. Persistence: They executed commands through scheduled tasks to maintain access.
5. Final Execution: The attacker executed the main malware using the downloaded JAR file.

Summary of Microsoft Services Used:

Indicators of Compromise (IOCS)

• Known Entra ID tenants: C5f077f6-5f7e-41a3-8354-8e31d50ee4d
• File IOCs (SHA256):
  • ROMServer.exe:a515634efa79685970e0930332233aee74ec95aed94271e674445712549dd254

Hunting Queries

HUNTING QUERY 1: Javaw Spawning Powershell with Specific Flags

SELECT EVENT_TIME,
       AGENT_ID,
       PARENT_PROCESS_NAME,
       PARENT_PROCESS_COMMANDLINE,
       INITIATING_PROCESS_NAME,
       TARGET_PROCESS_NAME,
       TARGET_PROCESS_COMMANDLINE
  FROM INVESTIGATION.EDR_PROCESS_CREATION_EVENTS
 WHERE PARENT_PROCESS_NAME ILIKE '%javaw%'
   AND INITIATING_PROCESS_NAME ILIKE '%cmd%'
   AND TARGET_PROCESS_NAME ILIKE '%powershell%'
   AND EVENT_TIME > CURRENT_TIMESTAMP - interval '60d'

HUNTING QUERY 2: ROM Tool Persistence via Scheduled Tasks

SELECT EVENT_TIME                   AS EVENT_TIME,
       AID                          AS AGENT_ID,
       EVENT_SIMPLE_NAME            AS EVENT_NAME,
       RAW:TaskExecCommand          AS TASK_EXEC_COMMAND
  FROM RAW.CROWDSTRIKE_RAW_EVENTS
 WHERE EVENT_SIMPLE_NAME = 'ScheduledTaskRegistered'
  AND TASK_EXEC_COMMAND ILIKE '%romserver%'
  AND EVENT_TIME > CURRENT_TIMESTAMP - interval '60d'

Hygiene Nuggets

1. Reduce Phishing Risk: Disable external access in Microsoft Teams unless necessary.
2. Restrict Remote Tools: Limit remote administration tools and restrict their usage to essential personnel only.
3. Security Awareness Training: Educate employees on recognizing phishing attempts through communication platforms.

Conclusion

• VEILDrive combines simplicity and sophistication, relying heavily on Microsoft services to carry out its operations effectively.
• Continuous monitoring and proactive threat-hunting measures are crucial.

To stay updated on threat-hunting research, follow Team Axon’s account ( @team__axon).