BEYOND THE BOMB: WHEN ADVERSARIES BRING THEIR OWN VIRTUAL MACHINE FOR PERSISTENCE

Summary from the TLDR InfoSec newsletter

Red Canary detected a novel attack where adversaries deployed spam bombing followed by fake tech support calls leveraging Quick Assist to introduce a QEMU virtual machine (Windows 7 SP1) running Sliver C2 implants, QDoor backdoor, and ScreenConnect for redundant persistence. The VM was configured for internal network reconnaissance via SRV record queries and external C2 communications to marnyonline[.]com and 45[.]61[.]169[.]127. Forensic analysis of the 8GB disk image revealed the adversary's toolkit through prefetch data, browser history, persistence mechanisms in start.txt, and volume shadow copies containing deleted artifacts. Defenders should monitor for anomalous QEMU execution on standard endpoints, implement strict Quick Assist controls, detect internal SRV record enumeration and ping sweeps with single-packet patterns, hunt for Sliver team server SSL certificates with CN=multiplayer and O=operators fingerprints, and deploy behavioral analytics to identify VM deployment following remote assistance sessions.