CRYSTALRAY

Executive Summary

CRYSTALRAY is a threat actor known for leveraging open-source tools like zmap and SSH-Snake to conduct widespread vulnerability scanning and exploitation. Their primary activities include credential theft, deploying cryptominers, and maintaining persistence in compromised environments. CRYSTALRAY uses multiple backdoors for control and spreads through networks using SSH-Snake, with a focus on collecting and selling credentials.

Goals & Targeting

CRYSTALRAY targets victims primarily to steal credentials, which are then sold in underground markets, and to deploy cryptominers for financial gain. The actor's targeting strategy appears to be relatively broad, with a focus on identifying vulnerable systems across sectors such as technology, healthcare, and energy. CRYSTALRAY's campaigns are not limited by geography, likely due to the global nature of their attack methods. Their victims include Linux-based systems, which are often less secured than Windows environments, making them an attractive target.

CRYSTALRAY operates with a notable preference for open-source tools such as zmap and SSH-Snake, which they employ for large-scale scanning and exploitation activities. The actor's main objectives are to compromise systems to gather sensitive data, deploy cryptominers for financial gain, and maintain persistent access to victim networks. CRYSTALRAY has been observed using tools like Platypus to manage their victims and extract sensitive information, indicating a systematic approach to managing compromised environments. Their modus operandi involves multiple stages of attack, starting with scanning vulnerable systems, exploiting them, and then using backdoors to maintain control. The actor's use of SSH-Snake for lateral movement suggests a focus on internal network expansion once initial access is achieved. CRYSTALRAY has a broad targeting scope across various sectors, with no specific region or industry appearing to be their primary focus.

Key Capabilities

• Vulnerability scanning with zmap
• Exploitation via SSH protocol
• Credential theft
• Cryptocurrency mining deployment
• Network persistence and lateral movement using SSH-Snake
• Victim management with Platypus

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

CRYSTALRAY has consistently demonstrated a focus on compromising systems for credential theft and cryptomining. Their campaigns are characterized by large-scale scanning, suggesting a high volume of activity often targeting unpatched or poorly secured systems. Notable patterns include the use of SSH-based attacks, multiple backdoors for long-term persistence, and lateral movement within networks. Victims have been observed across various industries, with no apparent limitation on sector or geography.

IOC Patterns

• SSH brute-force attempts using commonly known credentials
• Suspicious dropped binaries from known C2 servers
• Unusual network scanning activity consistent with zmap usage
• Anomalous SSH session persistence
• Known malware signatures of SSH-Snake and Platypus tools

Recommended Actions

• Implement multi-factor authentication (MFA) for SSH access
• Monitor network traffic for signs of large-scale scanning or unauthorized SSH connections
• Patch systems regularly to address vulnerabilities
• Use endpoint detection and response (EDR) solutions to identify suspicious activity
• Segment networks to limit lateral movement potential
• Educate users about phishing attempts that may lead to credential exposure

Suggested Tags