Pages

Subscribe:

Sunday, 4 June 2023

New Malware Used By SolarWinds Attackers Went Undetected For Years

 


The threat actor behind the supply chain compromise of SolarWinds has continued to expand its malware arsenal with new tools and techniques that were deployed in attacks as early as 2019, once indicative of the elusive nature of the campaigns and the adversary's ability to maintain persistent access for years.

According to cybersecurity firm CrowdStrike, which detailed the novel tactics adopted by the Nobelium hacking group last week, two sophisticated malware families were placed on victim systems — a Linux variant of GoldMax and a new implant dubbed TrailBlazer — long before the scale of the attacks came to light.

Nobelium, the Microsoft-assigned moniker for the SolarWinds intrusion in December 2020, is also tracked by the wider cybersecurity community under the names UNC2452 (FireEye), SolarStorm (Unit 42), StellarParticle (CrowdStrike), Dark Halo (Volexity), and Iron Ritual (Secureworks).

The malicious activities have since been attributed to a Russian state-sponsored actor called APT29 (also known as The Dukes and Cozy Bear), a cyber espionage operation associated with the country's Foreign Intelligence Service that's known to be active since at least 2008.

GoldMax (aka SUNSHUTTLE), which was discovered by Microsoft and FireEye (now Mandiant) in March 2021, is a Golang-based malware that acts as a command-and-control backdoor, establishing a secure connection with a remote server to execute arbitrary commands on the compromised machine.

Mandiant also pointed out that Dark Halo actors had used the malware in attacks going back to at least August 2020, or four months before SolarWinds discovered its Orion updates had been tampered with malware designed to drop post-compromise implants against thousands of its customers.

In September 2021, Kaspersky revealed details of a second variant of the GoldMax backdoor called Tomiris that was deployed against several government organizations in an unnamed CIS member state in December 2020 and January 2021.

The latest iteration is a previously undocumented but functionally identical Linux implementation of the second-stage malware that was installed in victim environments in mid-2019, predating all other identified samples built for the Windows platform to date.


Also delivered around the same timeframe was TrailBlazer, a modular backdoor that offers attackers a path to cyber espionage, while sharing commonalities with GoldMax in the way it masquerades its command-and-control (C2) traffic as legitimate Google Notifications HTTP requests.

Other uncommon channels used by the actor to facilitate the attacks include —

  • Credential hopping for obscuring lateral movement
  • Office 365 (O365) Service Principal and Application hijacking, impersonation, and manipulation, and
  • Theft of browser cookies for bypassing multi-factor authentication

Additionally, the operators carried out multiple instances of domain credential theft months apart, each time leveraging a different technique, one among them being the use of Mimikatz password stealer in-memory, from an already compromised host to ensure access for extended periods of time.

"The StellarParticle campaign, associated with the Cozy Bear adversary group, demonstrates this threat actor's extensive knowledge of Windows and Linux operating systems, Microsoft Azure, O365, and Active Directory, and their patience and covert skill set to stay undetected for months — and in some cases, years," the researchers said.

Read more
  1. Pentest Tools Subdomain
  2. Growth Hacker Tools
  3. Hacker Tools Github
  4. Bluetooth Hacking Tools Kali
  5. Hacking Tools Software
  6. Hacker Tools 2020
  7. Hacking Tools Pc
  8. Wifi Hacker Tools For Windows
  9. Hacking Tools For Pc
  10. Pentest Tools Download
  11. Pentest Tools List
  12. Top Pentest Tools
  13. Hack Tools
  14. Hacking Tools Windows
  15. Hacks And Tools
  16. Growth Hacker Tools
  17. Top Pentest Tools
  18. Pentest Tools Url Fuzzer
  19. Hack Rom Tools
  20. Hacker Tools Github
  21. Pentest Tools Apk
  22. Pentest Tools For Windows
  23. Computer Hacker
  24. Hacker Tools Online
  25. Pentest Tools Windows
  26. Hack Tools For Ubuntu
  27. Pentest Tools Find Subdomains
  28. Pentest Reporting Tools
  29. Hacker Tools Free
  30. Nsa Hacker Tools
  31. Nsa Hack Tools Download
  32. How To Install Pentest Tools In Ubuntu
  33. Nsa Hack Tools
  34. Pentest Tools Kali Linux
  35. Hacking Tools Download
  36. Hacking Tools Free Download
  37. Hacking Tools Software
  38. Hack Tool Apk No Root
  39. Pentest Tools For Android
  40. Hack Tools Github
  41. Hacker Tools
  42. Hack App
  43. Pentest Recon Tools
  44. Hacker Tools 2019
  45. Pentest Tools Download
  46. Pentest Tools Windows
  47. Hack Tools Online
  48. Hacking Tools Pc
  49. Hacker Tools List
  50. Hack Apps
  51. Blackhat Hacker Tools
  52. Pentest Recon Tools
  53. Hack Tools For Games
  54. Hacker Security Tools
  55. Install Pentest Tools Ubuntu
  56. Pentest Tools For Windows
  57. Hacking Tools For Mac
  58. Pentest Tools Framework
  59. Pentest Tools Subdomain
  60. Hack Tools Mac
  61. Pentest Tools Url Fuzzer
  62. Hacking App
  63. Hack Tools 2019
  64. Hacker Tools Apk Download
  65. Pentest Tools Nmap
  66. Nsa Hacker Tools
  67. Hacking App
  68. Hacker Tools For Mac
  69. Hacking Tools For Windows 7
  70. Wifi Hacker Tools For Windows
  71. Hacking Tools Download
  72. Hacking Apps
  73. Nsa Hack Tools
  74. Hack Tools Pc
  75. Black Hat Hacker Tools
  76. Android Hack Tools Github
  77. Hacking Tools For Windows Free Download
  78. Pentest Automation Tools
  79. Best Hacking Tools 2019
  80. Pentest Reporting Tools
  81. Termux Hacking Tools 2019
  82. New Hacker Tools
  83. Pentest Tools Apk
  84. Hacking Tools Software
  85. Termux Hacking Tools 2019
  86. Pentest Automation Tools
  87. Hack Tools Mac
  88. Hacking Tools Software
  89. Hacking Tools Hardware
  90. Hack Tools Online
  91. Physical Pentest Tools
  92. Hacker Tools Hardware
  93. Hacking Tools Software
  94. Pentest Tools For Windows
  95. Hacking Tools Mac
  96. Best Pentesting Tools 2018
  97. Pentest Tools Alternative
  98. Pentest Reporting Tools
  99. Top Pentest Tools
  100. Hack Tools For Pc
  101. Hacker Tools For Ios
  102. Underground Hacker Sites
  103. Pentest Tools For Ubuntu
  104. Termux Hacking Tools 2019
  105. Hak5 Tools
  106. Hack Tool Apk No Root
  107. Hacking Tools 2020
  108. Hacking Tools Hardware
  109. Physical Pentest Tools
  110. Best Pentesting Tools 2018
  111. Top Pentest Tools
  112. Hacker Tools 2020
  113. Hacking Tools For Kali Linux
  114. Hacking Tools 2019
  115. Hacker Tools For Mac
  116. Hacking Apps
  117. Hacker Tools Mac
  118. Hackrf Tools
  119. Hack Tools 2019
  120. Hacking Tools For Pc
  121. Hacker Tools Free Download
  122. Best Hacking Tools 2019
  123. Hack Tool Apk
  124. Hack Website Online Tool
  125. Game Hacking
  126. Usb Pentest Tools
  127. Hacker Tools Software
  128. Hack Tools
  129. Tools Used For Hacking
  130. Hacker Tools Hardware
  131. Wifi Hacker Tools For Windows
  132. Hacker Tools Online

No comments:

Post a Comment