Welcome to the next chapter of “APT Drama,” starring none other than Awaken Likho—the hackers who truly embody the phrase “if it ain’t broke, keep breaking it.” In case you haven’t been keeping up with their riveting series of cyber-attacks, these folks are showing off their adaptability yet again. Their latest choice in tactics? The legitimate yet ever-so-convenient MeshCentral platform, which is, let’s be real, an unlikely partner for an advanced persistent threat (APT) group. So buckle up, because we’re going to explore how these cyber miscreants have spiced things up, swapped out tools, and why you should probably never open an unexpected email attachment again.
Who or What is Awaken Likho?
To set the scene, let’s introduce our mischievous protagonist: the Awaken Likho APT group, also known in some circles as “Core Werewolf” (because what’s scarier than werewolves, right?). Awaken Likho has been on the radar for quite some time, targeting Russian government agencies and industrial enterprises with their unique brand of digital mayhem. Their story has evolved with new tools and improved tricks—a dynamic shift from previous campaigns that makes you wonder if they’re attending hacker upskilling seminars on the weekends.
Initially, Awaken Likho relied on UltraVNC, a commonly abused remote desktop module. However, in their latest campaign, launched between June and August 2024, they’ve moved away from UltraVNC to embrace MeshCentral. I know what you’re thinking—isn’t MeshCentral, like, totally legit? Why yes, it is. And Awaken Likho’s flair for irony is evidently alive and well as they turn this open-source remote management tool into an instrument of chaos. Bravo, Awaken Likho.
A Fresh Tool in the Arsenal: MeshCentral Becomes MeshDanger
Let’s talk about this transition. MeshCentral is typically used for remote management of devices—you know, for all those well-meaning IT departments wanting to assist employees with printer problems. But Awaken Likho has seen potential for something much more sinister. They’ve swapped out the UltraVNC module for MeshAgent, the legitimate agent used by MeshCentral, taking advantage of the tool’s open-source nature to fly under the radar.
Why the change, you ask? Simple: UltraVNC had probably overstayed its welcome—a bit like that one friend who lingers at a party long after everyone else has left. MeshCentral, on the other hand, offers a sleeker, newer way to gain remote access. The switch to MeshAgent not only provides a wider range of functionality, but it’s also much less likely to raise the alarm when detected on an endpoint. Clever, but deeply aggravating if you’re in the business of trying to stop these attacks.
The MeshAgent Implant – How They Got In
So how exactly did Awaken Likho sneak their way onto these systems? Classic phishing, naturally. There’s nothing like a malicious URL delivered to your inbox to make your Monday complete. The implant, delivered via a URL likely embedded in a very convincing email, would have been installed without fanfare—if, of course, the poor target happened to click it. Once installed, the implant leveraged MeshAgent to gain and maintain access.
MeshAgent is the legit agent for MeshCentral, making it an excellent candidate for exploitation. You see, when an attacker uses legitimate software, defenders often have a tougher time distinguishing malicious activity from authorized admin functions. Talk about blurring the lines between good and evil.
The implant is a UPX-packed PE32 executable, just waiting to be unpacked to reveal its nasty surprises. Think of it as a particularly unpleasant present wrapped in layers of deceptive holiday cheer—the first impression is innocent, but inside it’s anything but. And, of course, this implant didn’t come alone: it was part of a self-extracting archive, containing multiple files disguised as legitimate system services.
It’s All in the Execution: The AutoIt Obfuscation Show
After unpacking, what did we find? A compiled AutoIt script. Yes, they went with AutoIt, because if you’re going to automate some system tasks, why not do it in a scripting language that’s easy to obfuscate? Obfuscation is key here. The script itself was hidden, packed, and compressed, all to make reverse engineering a huge headache. When we finally deobfuscated the script, it became apparent that the implant was designed to maintain persistence by running commands that would ensure the infected system remained accessible.
The attackers used “MicrosoftStores.exe,” “NetworkDrivers.exe,” and “EdgeBrowser.cmd”—totally innocuous-sounding names, right? The payload, a modified version of MeshAgent, allowed for remote management capabilities, connecting to a MeshCentral server that the attackers controlled. Think of it as the IT guy from hell, popping up to fix your “network drivers” but actually plotting something a tad more nefarious.
CVEs That Deserve the Spotlight
While no specific CVEs were called out in this latest campaign, MeshCentral has had its vulnerabilities in the past. For anyone who loves a good vulnerability story, take a peek at CVE-2020-10148, which involves an authentication bypass flaw. Although not directly mentioned here, it’s a good reminder that every tool—no matter how legitimate—has potential cracks to exploit. You can almost hear Awaken Likho’s evil chuckle echoing in the background.
Who Are the Targets?
This campaign zeroed in on Russian government agencies and their contractors, as well as industrial enterprises. The Awaken Likho gang seems to love keeping it consistent with targets who have serious national importance. These guys are not after your grandma’s Facebook password; they’re setting their sights on critical infrastructure, high-value contracts, and systems integral to government operations.
Stealth Mode Activated: Maintaining Persistence
Persistence is the name of the game here. Once Awaken Likho gets in, they’re keen to stay in. And who can blame them, considering all the effort it took to craft convincing phishing emails, lure targets into clicking, and get everything in place? The attack flow was designed to ensure that the systems would remain compromised without easy detection.
The command files contained in the self-extracting archive were bloated with obfuscation, designed to confuse anyone investigating. The “GOTO” commands in particular were used to direct flow throughout the script, while large blocks of filler text were inserted to throw analysts off the scent. The obfuscation here isn’t groundbreaking, but it’s annoying—and sometimes that’s all it takes to buy an attacker a little more time on an infected network.
The Bigger Picture: What This Means for Cybersecurity
There’s an irony in watching APTs like Awaken Likho repurpose legitimate software like MeshCentral for their campaigns. MeshCentral is widely used by IT teams for device management—it’s a tool for the good guys, meant to make life easier. But, as we’ve seen countless times before, anything that can help IT departments can also, sadly, help cyber attackers. Attackers are nothing if not pragmatic, and they’ll exploit whatever they can to get what they want.
As we wrap our heads around this MeshCentral pivot, it’s a reminder that defenders can never get too comfortable. Tools once regarded as harmless can quickly turn hostile, and attackers always seem to find a way to turn conveniences into vulnerabilities. And let’s face it, it’s not like the APT groups will send us an FYI when they decide to change tactics.
FAQs
What is Awaken Likho known for?
Awaken Likho is an advanced persistent threat (APT) group that targets high-value organizations, such as government agencies and industrial enterprises. They’re known for their stealthy campaigns, sophisticated phishing techniques, and willingness to adapt their approach based on their needs.
What is MeshCentral and why did Awaken Likho use it?
MeshCentral is an open-source remote device management platform, often used by IT teams to manage computers and devices remotely. Awaken Likho exploited MeshCentral’s legitimate capabilities by using the MeshAgent to gain and maintain remote access, making their activities blend in with legitimate system operations.
How did Awaken Likho distribute their implant?
The implant was distributed through phishing campaigns that included malicious URLs. Once the URL was accessed, the implant was installed onto the victim’s system, allowing Awaken Likho to execute further commands.
What makes MeshAgent a good tool for attackers?
MeshAgent provides remote access capabilities, which means attackers can control infected systems as though they were IT administrators. The legitimate nature of MeshAgent makes it harder for security teams to identify the activity as malicious, especially in environments that already use similar tools for remote management.
How can organizations protect themselves?
Organizations should focus on phishing awareness training, network segmentation, and multi-factor authentication (MFA). It’s also essential to monitor network activity closely and implement endpoint detection and response (EDR) solutions that can catch anomalies—even if they look like regular admin tasks.
Wrapping It Up: The Game of Cat and Mouse Continues
Awaken Likho has once again shown us that creativity in cyber warfare knows no bounds. By co-opting legitimate remote management tools like MeshCentral, they blur the lines between typical IT operations and malicious activity—and that makes detecting them all the trickier. So, let’s stay sharp out there, folks. Next time your IT team wants to remotely fix your printer, maybe double-check they aren’t secretly an APT in disguise.
Feel free to drop your thoughts in the comments below, and don’t forget to subscribe to stay updated on the latest in the chaotic world of cyber threats. Because remember—APT groups may keep you guessing, but at least we can be well-informed together.
