MirrorFace Campaign: Exploiting Windows Sandbox for Cyber Attacks

The cybersecurity landscape has once again been rattled by a sophisticated attack campaign, this time orchestrated by the threat group known as MirrorFace. By exploiting inherent design gaps in a trusted Windows feature and leveraging a familiar developer environment, the attackers have demonstrated how legitimate functionalities can be weaponized. In a security advisory released by Japan’s National Police Agency (NPA) and the National Center of Incident Readiness and Strategy for Cybersecurity (NISC) on January 8, 2025, researchers uncovered details that call for heightened vigilance among IT security professionals.

---

Overview of the Threat Landscape​

MirrorFace, reportedly a subgroup incorporated within the broader APT10 umbrella, has emerged with an innovative methodology. Their campaign targets organizations in Japan by turning built-in Windows features into a launchpad for malicious activity. The group cleverly manipulates the Windows Sandbox environment and, intriguingly, Visual Studio Code, to hide their operations from traditional monitoring tools.
The attackers’ modus operandi relies on an intricate understanding of Windows’ virtualization capabilities. By leveraging technical nuances in these systems, they have managed to conduct operations that effectively slip under the radar of conventional detection mechanisms. This campaign not only exemplifies the increasing creativity in attack techniques but also highlights potential blind spots in the security framework of Windows systems.

---

Windows Sandbox: A Double-Edged Sword​

Windows Sandbox is designed as a lightweight, virtualized environment introduced in Windows 10 (Build 18342 onwards) and further refined in Windows 11. Its primary function is to allow users to run potentially unsafe applications without risking permanent changes to the host system. However, under this veil of isolation lie inherent design choices that, if misused, can become significant security liabilities.

Key Characteristics of Windows Sandbox:​

• Isolation with a Catch:
  • Provides a temporary desktop environment where applications are sandboxed away from the host.
  • Runs under a default user account named WDAGUtilityAccount, which paradoxically is part of the Administrators group.
• Technical Underpinnings:
  • Utilizes Virtual Hard Disk (VHDX) technology with differential disks stored in directories like C:\ProgramData\Microsoft\Windows\Containers.
  • Operates with Windows Defender disabled by default, leaving a window for malware execution.
• Configurable via WSB Files:
  • Sandbox behavior can be fine-tuned through XML-based WSB files that dictate network access, folder sharing, resource allocation, and automatic command execution.
  • Recent updates (as of KB5044384 released on October 24, 2024) introduced the wsb.exe command-line control, enabling background execution and persistent data storage until explicitly terminated.

While these advancements improve usability, they also expose new vectors for exploitation. By operating in a no-surveillance, high-privilege mode, malicious actors can effectively utilize the sandbox to launch attacks with minimal interference.

---

How MirrorFace Exploited Windows Sandbox​

MirrorFace’s modus operandi is a masterclass in leveraging trusted system mechanisms to hide nefarious activity. Here’s a closer look at their attack flow:

• Initial Compromise and Activation:
  • After gaining initial entry, attackers enable Windows Sandbox—a process that demands administrative privileges and even forces a system restart.
  • They plant three core elements: a batch file, an archiver utility (often 7-Zip), and an archive containing the malware payload.
• Crafting the Environment:
  • A specially crafted WSB configuration file is executed, which:
  • Establishes folder sharing between the host and sandbox.
  • Enables network connectivity.
  • Allocates memory and automatically triggers the batch file once the sandbox starts.
  • The batch file’s responsibilities include extracting the payload, creating a scheduled task to run the malware with SYSTEM-level privileges, and executing this task—all while operating covertly in the background.
• Malware and C2 Communication:
  • The malicious payload is a customized variant of LilimRAT (deriving from the open-source Lilith RAT). Notably, it contains checks for the WDAGUtilityAccount folder. If absent, the malware terminates, indicating its design is finely tuned to operate only within the Windows Sandbox.
  • Once active, the malware communicates with its command and control (C2) servers via the Tor network, encrypting and anonymizing its traffic to obscure its origins.

This sophisticated interplay between Windows Sandbox’s inherent design and the attackers’ custom tools highlights a concerning trend: using privileged environments not as a defensive tool, but as an enabler for stealthy operations.

---

The Visual Studio Code Connection​

While Windows Sandbox forms the crux of the attack vector, the role of Visual Studio Code should not be overlooked. The integration of Visual Studio Code into the campaign signals a new frontier in threat sophistication:

• Developer Tools as Attack Vectors:
  • Visual Studio Code, a popular integrated development environment (IDE), may have been exploited to manage and execute payload scripts.
  • Given the tool’s widespread use among developers, embedding malicious tasks within a trusted, well-known environment can effectively mask nefarious activities.
• Operational Synergy:
  • The use of Visual Studio Code could facilitate rapid script development and debugging, enabling attackers to fine-tune their malware before deployment.
  • Such tactics blur the lines between legitimate development processes and malicious operations, making detection a challenge for security teams with limited visibility into code repositories and IDE environments.

Even though the details on the Visual Studio Code exploitation are less elaborated, the inclusion of this tool in the attack chain signals that threat actors are increasingly looking to canonical development platforms to obscure their activities.

---

Forensic Artifacts and Detection Strategies​

Detecting an attack that utilizes legitimate Windows functionalities demands a multi-layered forensic approach. Security professionals can look for several key indicators:

Monitoring Indicators:​

• Sandbox-Specific Processes:
  • Monitor for the activation of processes such as WindowsSandbox.exe, WindowsSandboxClient.exe, and in newer Windows 11 builds, WindowsSandboxServer.exe, WindowsSandboxRemoteSession.exe, and wsb.exe.
• Network Behavior:
  • Windows Sandbox ties into the host’s network adapter. Standard network monitoring, supplemented with tools to detect anomalous Tor traffic, is crucial.

Forensic Artifacts to Investigate:​

• File System Artifacts:
  • Evidence of WSB file creation in the Master File Table ($MFT) and the Update Sequence Number Journal ($UsnJrnl) can indicate sandbox usage.
  • The creation and modification of VHDX files under C:\ProgramData\Microsoft\Windows\Containers may also serve as critical footprints.
• Registry and Prefetch Data:
  • Changes in the Windows Registry related to sandbox application associations or spawned processes.
  • Prefetch files and event logs might contain records of executed WSB configurations or differential VHDX files.
• Memory Analysis:
  • Since sandbox processes run within the host’s memory space (look for indicators in the vmmem process on Windows 10 or the updated vmmemWindowsSandbox process on Windows 11), scanning these memory regions for malicious strings or artifacts is advised.

By combining real-time monitoring of these indicators with retrospective forensic investigations, organizations can improve their chances of detecting and curtailing such sophisticated intrusions.

---

Preventive Measures and Best Practices​

Given the highlighted vulnerabilities, it is imperative for IT and security teams to adopt stringent countermeasures. Here’s a concise checklist for preventing similar intrusions:

• Restrict Windows Sandbox Usage:
  • Keep Windows Sandbox disabled by default unless explicitly needed.
  • Limit administrative privileges to reduce the risk of unauthorized activation.
• Implement Application Control Policies:
  • Deploy AppLocker policies to block the execution of Windows Sandbox, particularly in environments where its use is unwarranted.
  • Monitor and log attempts to enable or run sandbox processes.
• Enhance Network and Memory Monitoring:
  • Set up network monitoring to detect unusual traffic, such as encrypted communications via the Tor network.
  • Utilize advanced memory scanning tools to inspect processes like vmmem for hidden malware indicators.
• Educate End-Users and Administrators:
  • Regularly update and train IT staff on the latest threat vectors and the importance of privilege management.
  • Promote a security-first mindset when enabling features like Windows Sandbox or using developer tools like Visual Studio Code.

These best practices, combined with a proactive security monitoring strategy, can dramatically reduce the risk of similar attacks taking hold within an organization.

---

Conclusion​

The MirrorFace APT campaign is a stark reminder that attackers are continuously evolving their methodologies, often weaponizing trusted system features to launch covert operations. By exploiting Windows Sandbox—an environment initially designed to enhance security—along with leveraging familiar tools like Visual Studio Code, the threat actors have added a new layer of complexity to cyber defense challenges.
For security professionals, the key takeaways include:

• Understanding the dual-use nature of powerful system tools.
• Monitoring both conventional and non-traditional indicators of compromise.
• Implementing layered security measures that encompass application control, privilege management, and network monitoring.

In this ever-evolving threat landscape, staying one step ahead demands not only technological vigilance but also an ongoing reassessment of how legitimate features can be subverted by those with malicious intent. By adapting to these emerging challenges, organizations can better safeguard their systems against even the most sophisticated adversaries.

---

Source: GBHackers MirrorFace APT Using Custom Malware To Exploited Windows Sandbox & Visual Studio Code