Big airline heist

UPDATE: This blog post was updated on August 12, 2021 at the request of a third party.

Executive summary

In late May, Air India reported a massive passenger data breach. The announcement was preceded by data breaches in various airline companies, including Singapore Airlines and Malaysia Airlines. According to the public source data, these airlines use services of the same IT service provider. The media suggested the airline industry was facing “a coordinated supply chain attack”. Air India was the first carrier to reveal more details about its security breach.

The data revealed by Air India suggested that the massive data breach that affected multiple carriers was a result of the compromise of the airline’s IT service provider. That announcement prompted Group-IB Threat Intelligence analysts to look closer at the attack.

Using its external threat hunting tools, Group-IB’s Threat Intelligence team then discovered and attributed another previously unknown cyberattack on Air India with moderate confidence to the Chinese nation-state threat actor known as APT41. The campaign was codenamed ColunmTK.

In this blog post you will find:

• Previously unknown details about the ColunmTK campaign
• Evidence of compromised workstations and exfiltration of 200 MB of data from Air India’s network
• Descriptions of TTPs used during the ColunmTK campaign
• Connections between APT41 and the infrastructure used during the ColunmTK campaign

The potential ramifications of this incident for the entire airline industry and carriers that might yet discover traces of ColunmTK in their networks are significant. To help companies detect and hunt for ColunmTK, we have provided a full list of indicators of compromise (IOCs) that we retrieved. MITRE ATT&CK, MITRE Shield, and recommendations are available at the end of this blog post.

Group-IB’s Threat Intelligence team informed CERT India and Air India of its findings so that they can take the necessary steps to mitigate the threat.

Background

On May 21, Air India, India’s flag carrier, published an official statement on their website about a data breach. The announcement revealed that the breach was caused by a February incident at the airline’s IT service provider, which is responsible for processing customers’ personally identifiable information (PII). However, that statement has since been corrected. It came to light that the cyberattack on this IT service provider affected 4,500,000 data subjects globally, including data related to Air India’s customers.

Shortly after Air India’s public announcement, the database allegedly related to their security breach was put up for sale on an underground market at USD 3,000.

According to Group-IB’s Threat Intelligence system, the alleged database was published on a fraudulent resource known for reselling data that has been published on various data-leak websites. Because the database had never surfaced anywhere on the dark web, nor in the public domain, Group-IB researchers considered it fake and decided to instead look deeper and discovered that the post about Air India’s alleged data had nothing to do with what happened in reality. Group-IB’s Threat Intelligence team soon realized that in this other attack on Air India they were dealing with a sophisticated nation-state threat actor, rather than another financially motivated cybercriminal group.

Compromise of Air India’s network

In mid-February 2021, Group-IB’s Threat Intelligence system detected infected devices that were part of Air India’s computer network. Starting from at least February 23, 2021, a device inside the company’s network communicated with a server with the IP address 185[.]118[.]166[.]66. According to Group-IB’s Network Graph, this server has hosted Cobalt Strike, a popular post-exploitation framework, since December 11, 2020 (we will come back to it a little later).

Lifetime of a Cobalt Strike tag in Group-IB’s Network Graph

The patient zero that started communicating with the C&C server was a device named «SITASERVER4» with the local IP address 172[.]16[.]11[.]103 and managed by AirIndia.

After the attackers established persistence in the network and obtained passwords, they began moving laterally. The threat actor collected information inside the local network, including names of network resources and their addresses.

Below are examples of commands that were used for lateral movement:

The results of some commands:

The attackers exfiltrated NTLM hashes and plain-text passwords from local workstations using hashdump and mimikatz. The attackers tried to escalate local privileges with the help of BadPotato malware. BadPotatoNet4.exe was uploaded to one of the devices inside the victim’s network under the name SecurityHealthSystray.exe. According to our data, at least 20 devices from Air India’s network were compromised during the lateral movement stage. The attackers used DNS-txt requests to connect the bots to the C&C server. The following domains were used for DNS tunneling.

• ns2[.]colunm[.]tk;
• ns1[.]colunm[.]tk.

The name of the campaign, ColunmTK, is derived from these initially discovered domains.

It was also found that the attackers extracted 233,390,032 bytes of data from the following devices:

• SITASERVER4
• AILCCUALHSV001
• AILDELCCPOSCE01
• AILDELCCPDB01
• WEBSERVER3

According to Group-IB’s Threat Intelligence data, the compromised devices were located in different subnets, which may indicate that the compromise affected various segments of Air India’s network.

While the initial attack vector remains unknown, according to Group-IB’s records, the attack on Air India lasted for at least 2 months and 26 days. It took the attackers 24 hours and 5 minutes to spread Cobalt Strike beacons to other devices in the airline’s network.

ColunmTK Timeline

Connections with APT41

Group-IB researchers believe with moderate confidence that the ColunmTK campaign was carried out by APT41, a prolific Chinese-speaking nation-state threat actor. APT41, also known as WICKED SPIDER (PANDA), Winnti Umbrella, and BARIUM, is believed to have been engaging in state-sponsored espionage in China’s interests as well as committing financially motivated cybercrimes. According to Group-IB’s Threat Intelligence system, the threat actor has been active since at least 2007.

APT41 is known for stealing digital certificates for its cyber espionage operations. India is a frequent target of Chinese nation-state adversaries.

When analyzing the network infrastructure of the C&C-server involved in the cyberattack against Air India, Group-IB’s Threat Intelligence system revealed that the threat actor used a specific SSL certificate, which was detected on five hosts only.

Network relations between hosts with a specific fingerprint presented in Group-IB’s Threat Intelligence system

Let’s take a closer look at these five IP addresses.

One of them, 45[.]61[.]136[.]199, was attributed to APT41(aka Barium) by Microsoft in their recent research.

It is worth looking at another IP address from the list: 104[.]224[.]169[.]214. This IP address was used as an A record for two domains: server04[.]dns04[.]com and service04[.]dns04[.]com. The IP address was also used to host the Cobalt Strike framework and shared an SSL certificate, b3038101fd0e8b11c519f739f12c7e9b60234d3b, with ColunmTK’s IP address 185[.]118[.]166[.]66. When analyzing the dns04[.]com subdomains, we found that these domains were parked at the IP address 127.0.0.1 on the same date: April 15, 2021. According to Group-IB researchers, APT41 usually parks their domains for some time at 127.0.0.1 after their campaigns are over.

Network relations between hosts parked at 127.0.0.1. Source: Group-IB Threat Intelligence

Another interesting domain is service[.]dns22[.]ml. This domain shared the SSL certificate b3038101fd0e8b11c519f739f12c7e9b60234d3b with ColunmTK’s IP address and was parked at 127.0.0.1 on January 15, 2021. Security researchers found that the IP address 104[.]224[.]169[.]214 was used as the IP address for a shellcode loader in APT41’s earlier campaigns, in which the domain service[.]dns22[.]ml was also used.

Group-IB researchers discovered a file named “Install.bat” (SHA1-7185bb6f1dddca0e6b5a07b357529e2397cdee44). The file was uploaded by the attackers to some of the compromised devices inside Air India’s network as part of the ColunmTK campaign. The file is very similar to one used by APT41 in a different campaign described by FireEye researchers.

In both cases, the files were used to establish persistence in the network. The files are very similar in the way they launch a DLL file as a service and create keys in the registry.

The contents of the file “install.bat” from APT41’s This is Not a Test campaign:

Group-IB researchers believe with moderate confidence that the ColunmTK campaign against Air India was carried out by the Chinese nation-state threat actor APT41.

Attribution of the ColunmTK campaign against Air India to APT41.

ColunmTK MITRE ATT&CK and MITRE SHIELD

Below are indicators that were used in this campaign as well as MITRE ATT&CK mapping and a corresponding list of mitigation solutions. Companies should use MITRE ATT&CK to better prepare for attacks and know what techniques are needed to mitigate security risks associated with this threat actor.

Indicators of compromise

Below are indicators that were used in this campaign as well as MITRE ATT&CK mapping and a corresponding list of mitigation solutions. Companies should use MITRE ATT&CK to better prepare for attacks and know what techniques are needed to mitigate security risks associated with this threat actor.

Network indicators:

• 185.118.164[.]198;
• 104.224.169[.]214;
• 45.61.136[.]199;
• 185.118.166[.]66;
• 149.28.134[.]209;
• colunm[.]tk.

Beacon configuration from 185.118.166[.]66

Beacon configuration from 149.28.134[.]209