ToddyCat APT Group Develops Umbrij Tool to Compromise Gmail Accounts
The ToddyCat APT group has been active in developing sophisticated techniques to compromise corporate email communications, particularly those hosted on Gmail. Their latest tool, Umbrij, represents a significant advancement in their attack methodology, allowing for automated access to Gmail accounts via the Google API. This tool utilizes the OAuth 2.0 protocol, which enables applications to obtain authorization tokens for accessing user resources.
Umbrij operates by connecting to a browser's management console in headless mode through a remote debugging port. By sending a series of requests, attackers can obtain an OAuth authorization code, which is then exchanged for an access token to access the target resources. This technique, referred to as Shadow Token via Remote Debug (STRD), is particularly effective on Chromium-based browsers, where active sessions can be exploited if users remain logged into their Gmail accounts.
During the investigation, multiple versions of Umbrij were identified, each equipped with various debugging and user account selection functions. Kaspersky's security solutions have flagged these tools under several verdicts, indicating their malicious nature. The discovery of Umbrij occurred during a proactive threat hunting operation, revealing that attackers were attempting to disguise their activities as legitimate processes.
The tool is designed to execute a series of steps to compromise Gmail accounts. Initially, it checks for available ports for browser debugging and retrieves user context by duplicating the token of the explorer.exe process. This allows Umbrij to operate within the context of the current user, enhancing its stealth capabilities. The tool then constructs paths to the browser application folders, searching for user profiles that indicate authenticated sessions with Google services.
Once the necessary user files are copied, Umbrij launches the browser in headless mode, utilizing the copied user profile to bypass authentication prompts. It connects to the remote debugging port and sends a request to the Google authorization endpoint, manipulating the parameters to gain access to the user's account. This process includes simulating user interactions to approve permissions, ultimately capturing the OAuth authorization code needed for further access.
To defend against such attacks, security teams are advised to monitor for unusual DLL loading events and browser launches with remote debugging enabled. Organizations should also regularly review the list of applications with access to their Google accounts and revoke permissions for any suspicious applications. Additionally, users should be encouraged to log out of their accounts after use to minimize the risk of unauthorized access. The ongoing evolution of the ToddyCat group’s tactics underscores the importance of vigilance and proactive security measures in protecting sensitive corporate communications.
