Regeorg

Regeorg is a threat actor known for its malicious activities in the cyber landscape. Notably, operators of LuckyMouse initiated an attack by dropping the Nbtscan tool in C:\programdata\, followed by installing a variant of the ReGeorg webshell and issuing a GET request using curl. They then tried to install their SysUpdate (also known as Soldier) modular backdoor, which uses the specified IP address as its Command and Control (C&C) server. In addition, Mandiant observed instances where UNC3542 used timestomping to alter the Standard Information timestamps of the REGEORG web shell to match other files in the same directory. Furthermore, this threat actor was also found to have placed a REGEORG web shell on a DMZ web server as an alternate access point. Regeorg has been identified using basic and publicly available tools like remote desktop protocol (RDP) for lateral movement and the reGeorg Web shell for targeting an organization's files. The cybersecurity firm Unit42 discovered three web shells used in these attacks: reGeorg, China Chopper, and AspxSpy. Incident response investigations conducted by ANSSI confirmed the use of Mimikatz and reGeorg tools by APT28, with Mimikatz being a popular collector of sensitive information and reGeorg serving as a tunnel creation tool. This group is known to follow up with commodity web shells, tunneling tools, attack frameworks, and living-off-the-land binaries. The threat actor leveraged several web shells for initial access to a compromised web server, including reGeorg, China Chopper, and the AspxSpy web shell. An interesting aspect of UNC3524’s use of REGEORG was that it matched identically with the version publicly reported by the NSA as used by APT28. This suggests a possible connection or shared tactics between these groups. With the continuous evolution of Regeorg's tactics and its use of publicly available tools, it poses a significant threat to organizations and warrants continuous monitoring and robust cybersecurity measures.