This report page covers the UNC1549 MINIBUS backdoor. CERT-EU, the EU institutions’ cybersecurity service, describes UNC1549 as a suspected Iranian threat actor targeting aerospace and defense sectors in the Middle East, including Israel and the UAE. MINIBUS is the backdoor the report analyses, including its technical details, detections and IoCs.
What You Will Find In This Report?
Learn Technical Method of Operation Details
The technical details of the MINIBUS Backdoor and more about UNC1549 threat actor. The report will show many points about the its technical details, detections, and IoCs.
Gain Knowledge About Future Attacks
By understanding its attack model, you can make more informed predictions about the future of cybersecurity. Stay up-to-date with the latest trends and keep your business from potential threats.
Response & Mitigation Tactics From Experts
Brandefense analysts share practical response and mitigation advice on this topic. Backdoors are getting sophisticated, so this is making them more difficult for companies to protect themselves.
What Does the UNC1549 MINIBUS Backdoor Report Cover?
The report is a technical analysis of the MINIBUS backdoor. It is dated 10.07.2024 and its chapters are Summary, Scope, Technical Analysis, Indicators of Compromise, YARA Rule, MITRE ATT&CK Threat Matrix, Mitigation Strategies and Conclusion.
Key Technical Findings the Report States
- The report says UNC1549 has been active since at least June 2022.
- MINIBUS arrives in a ZIP archive and uses the Search Order Hijacking technique. The archive carries two modified libraries, secur32.dll and CoreUIComponent.dll.
- The installer copies files into a OneDrive cache folder and sets a Registry Run Key so FileCoAuth.exe keeps running.
- The backdoor has a switch structure with commands numbered 1 to 7. They collect system and user details, list processes, end a process and set the sleep time.
- Collected data is put in JSON and encrypted with a single byte XOR before it is sent to the server. The key in the sample was 2Ah.
- The authors could not see the server replies, because the C2 addresses were no longer active when they tested.
Indicators, Rules and ATT&CK Mapping
The report lists two MINIBUS backdoor DLL hashes, four C2 addresses and a YARA rule. It maps the activity to four ATT&CK tactics: Initial Access (T1566 Phishing), Execution (T1204.002 Malicious File), Persistence (T1547) and Command And Control (T1071 and T1132).
How the Report Suggests Defending
- Check for the OneDrive cache logger folder and the files copied into it.
- Search for FileCoAuth.exe as a Registry Run Key persistence entry.
- Watch the HTTP header information that the malware generates in web requests.
- Use email scanning and regular phishing awareness training, and apply strict access control.