IronShade
An APTs and Backdoor Shenanigans
Disclaimer: The “IronShade” TryHackMe room is an existing cybersecurity challenge with a predefined scenario. For the sake of fun and creativity, I’ve added a humorous twist to the original storyline. This modification is purely for entertainment and does not reflect the official content or intent of the TryHackMe creators, https://tryhackme.com/r/room/ironshade
Incident Scenario
There I was, seated with a Caffè Latte and cold server dump, while my team successfully lured IronShade-one of the world’s most renowned APT groups-into our honeypot using exposed SSH ports with weak credentials. Of course, sure enough, they pounced like moths to a flame. The fun part would then be trying to piece every single one of their moves together-like some sort of Sherlock in cybersecurity.The mission? To investigate the compromised Linux server, find the attack footprints, and maybe poke a little fun at the audacity of the “subtle” moves of IronShade Lab Incident
When Hackers Get Too Cocky
According to the threat intel report, IronShade loves persistence-so do we all. They are supposed to have created backdoor accounts, cronjobs, and even installed their shady services. Think about your very own malicious startup operating on your infrastructure. But enough chit-chat; let’s dive in. Here is the juicy investigative breakdown.
Step 1: Machine ID — Every Story Has a Beginning
First, identify the Machine ID. This is like figuring out the name of the crime scene:
cat /etc/machine-id
Turns out, IronShade picked a rather ordinary server-not a secret agent.
Step 2: Who Let the Backdoor In?
A look into /etc/passwd exposed the mysterious user account mircoservice. Yeah, it is misspelled. Typical newbie mistake.
cat /etc/passwd
This “mircoservice” was their Tickenator to persistence. IronShade’s hackers might be cool but spellcheck wasn’t part of the training.
Step 3: Persistence via Cronjobs
Now things get creative: setting up cronjob. List of cronjobs running with:
sudo crontab -l
we find an entry for mircoservice running some script at odd hours. Maybe it’s their attempt to sync files, exfiltrate data, or just schedule their midnight snacks.
Step 4: Spot the Hidden Process
Hidden processes? More like badly hidden Easter eggs. Using:
ps aux | grep mircoservice
we find a process running under the backdoor account’s directory. It’s hard to miss when it practically screams, “I’m malicious!”
Step 5: Files in Memory? Found You!
A listing in the root directory presents one very suspicious hidden file. The command:
ls -lah /
reveals a file which shouldn’t be there. Really, IronShade thought the secret wouldn’t come up.
Get Iram Jack’s stories in your inbox
Join Medium for free to get updates from this writer.
Step 6: Suspicious Services Installed
Every APT leave a scent of bad choices, including shady services. The listing of all services:
systemctl list-units --type=service --all
we highlight a few peculiar entries like pscanner and cronservice. In alphabetical order, my friends, for IronShade likes to tidy up.
Step 7: The Birth of the Backdoor
A grep through the logs with:
grep -a 'useradd' /var/log/auth.log
gives us the exact timestamp of the creation of the user mircoservice. Well, this is when the attackers planted their flag in the server.
Step 8: SSH Shenanigans
Checking for SSH connections and their origins, we see the attackers spammed the backdoor account.
grep -a 'sshd' /var/log/auth.log
presents multiple SSH logins from one suspicious IP address.And for the cherry on top:
cat /var/log/auth.log | grep -a "ssh" | grep -a "mircoservice" | grep -a "Fail"
presents eight failed login attempts. Why eight? Because IronShade hackers don’t know when to quit LOL.
Step 9: Malicious Packages? Installed with Care
The logs give them away in their spree of package installations:
grep 'install ' /var/log/dpkg.log
which discloses that the malicious package of choice was pscanner.
Pro tip, hackers: If your malware package is in the logs, you are not as sneaky as you think.
Step 10: The Secret Code
Pièce de résistance-what metadata from the suspicious package had in store for us to reveal a certain secret code:
apt show pscanner
And what do we find? A string of characters that might as well read “Caught ya!”
Conclusion
IronShade’s shenanigans may have gained some attention, but their trail certainly wasn’t cold. From typo-laden usernames to unoriginal cronjobs and detectable malicious packages, their every move screamed “rookie mistake.”
This exercise certainly underlined the importance of log analysis, metadata scrutiny, and always double-checking for suspicious accounts and processes.Thus, to all those sysadmins and security analysts who are looking: Keep your coffee strong and your logs stronger.
#LinuxSecurity #CyberThreats #APTGroup #IncidentResponse #CompromiseAssessment #CyberForensics #IronShade #LinuxLogs #Rootkits #PersistenceDetected
