#threatreport #LowCompleteness
Tangerine Turkey mines cryptocurrency in global campaign | 24-01-2025
Source:Key details below ↓

🧑‍💻Actors/Campaigns:
Universal_mining

💀Threats:
Universal_miner, Dll_sideloading_technique, Xmrig_miner, Dll_hijacking_technique, Zephyrus, Dllsearchorder_hijacking_technique, 
🌐Geo: Azerbaijan, Turkey

🤖LLM extracted TTPs:`
T1027, T1091, T1036, T1574.002

🧨IOCs:
 - File: 3
 - Command: 1
 - Path: 2
 - Domain: 1

💽Software: PostgreSQL

📜Programming Languages: visual_basic, powershell

#threatreport:
Tangerine Turkey is a VBS worm identified by Red Canary that spreads through USB drives and drops a cryptomining payload. The worm's execution chain involves a VBS file with a filename starting with 'x' and six random digits executed from a USB folder named rootdir, followed by a BAT file with a similar naming convention executed via a CMD child process from wscript. The malware creates a deceptive folder named C:\Windows \System32 with a leading space after '\Windows' and uses xcopy to move a copy of the legitimate printui.exe binary to the malicious directory for DLL side-loading. Additionally, DAT and printui.dll files are generated in the malicious System32 folder for further malicious activities.

Tangerine Turkey was first detected in November 2024 and was ranked #8 in threat rankings by Red Canary in December 2024. The malware is linked to a global cryptocurrency mining campaign, possibly connected to the Universal Mining operation. The malware is associated with a Turkish-language tech forum post from February 2024, indicating its earlier existence. Quick Heal also published information on a similar activity called "Zephyr Miner" in early December 2024, which led to the mining of Zephyr cryptocurrency.

Analysis of Tangerine Turkey samples on VirusTotal revealed a correlation with XMRig rules, suggesting the worm drops XMRig for mining purposes. The malware operators are required to configure XMRig, but no obvious configuration files were observed in the studied samples. Investigation into printui.dll led to the discovery of connections to netconns, domains, and IP addresses, particularly highlighting the report by Azerbaijan CERT's Malware Research Lab on the Universal Mining operation unveiled in October 2024. Universal Mining, like Tangerine Turkey, utilizes VBS files for execution and shares behavioral similarities, indicating a potential overlap in operations.

Azerbaijan's CERT revealed that Universal Mining infected 270,741 computers across 135 countries by October 2024. Security researcher Will Thomas created rules for "UniversalMiner" based on this information. The YARA and Sigma rules developed by Thomas assisted in identifying 600 malware samples through a VT retrohunt in late November 2024. Tangerine Turkey's use of printui.exe in suspicious locations sparked initial detection opportunities. Red Canary developed a detection method to identify instances of printui.exe outside of the expected Windows\System32 location, enabling the detection of threats like Tangerine Turkey utilizing vulnerable DLLs for malicious activities. Red Canary shared insights on profiling System32 binaries for detection and published a guide on building detection analytics to enhance threat detection capabilities.

In summary, Tangerine Turkey is a persistent threat with connections to a global cryptocurrency mining campaign, potentially intersecting with the Universal Mining operation. The malware's utilization of deceptive tactics, file movements, and DLL side-loading underscores the importance of proactive threat detection and mitigation strategies to safeguard against evolving cyber threats.
#threatreport #LowCompleteness