Humour In Verse

From The warped mind of Emac

Friday, January 19, 2024

New Malware Used By SolarWinds Attackers Went Undetected For Years

 


The threat actor behind the supply chain compromise of SolarWinds has continued to expand its malware arsenal with new tools and techniques that were deployed in attacks as early as 2019, once indicative of the elusive nature of the campaigns and the adversary's ability to maintain persistent access for years.

According to cybersecurity firm CrowdStrike, which detailed the novel tactics adopted by the Nobelium hacking group last week, two sophisticated malware families were placed on victim systems — a Linux variant of GoldMax and a new implant dubbed TrailBlazer — long before the scale of the attacks came to light.

Nobelium, the Microsoft-assigned moniker for the SolarWinds intrusion in December 2020, is also tracked by the wider cybersecurity community under the names UNC2452 (FireEye), SolarStorm (Unit 42), StellarParticle (CrowdStrike), Dark Halo (Volexity), and Iron Ritual (Secureworks).

The malicious activities have since been attributed to a Russian state-sponsored actor called APT29 (also known as The Dukes and Cozy Bear), a cyber espionage operation associated with the country's Foreign Intelligence Service that's known to be active since at least 2008.

GoldMax (aka SUNSHUTTLE), which was discovered by Microsoft and FireEye (now Mandiant) in March 2021, is a Golang-based malware that acts as a command-and-control backdoor, establishing a secure connection with a remote server to execute arbitrary commands on the compromised machine.

Mandiant also pointed out that Dark Halo actors had used the malware in attacks going back to at least August 2020, or four months before SolarWinds discovered its Orion updates had been tampered with malware designed to drop post-compromise implants against thousands of its customers.

In September 2021, Kaspersky revealed details of a second variant of the GoldMax backdoor called Tomiris that was deployed against several government organizations in an unnamed CIS member state in December 2020 and January 2021.

The latest iteration is a previously undocumented but functionally identical Linux implementation of the second-stage malware that was installed in victim environments in mid-2019, predating all other identified samples built for the Windows platform to date.


Also delivered around the same timeframe was TrailBlazer, a modular backdoor that offers attackers a path to cyber espionage, while sharing commonalities with GoldMax in the way it masquerades its command-and-control (C2) traffic as legitimate Google Notifications HTTP requests.

Other uncommon channels used by the actor to facilitate the attacks include —

  • Credential hopping for obscuring lateral movement
  • Office 365 (O365) Service Principal and Application hijacking, impersonation, and manipulation, and
  • Theft of browser cookies for bypassing multi-factor authentication

Additionally, the operators carried out multiple instances of domain credential theft months apart, each time leveraging a different technique, one among them being the use of Mimikatz password stealer in-memory, from an already compromised host to ensure access for extended periods of time.

"The StellarParticle campaign, associated with the Cozy Bear adversary group, demonstrates this threat actor's extensive knowledge of Windows and Linux operating systems, Microsoft Azure, O365, and Active Directory, and their patience and covert skill set to stay undetected for months — and in some cases, years," the researchers said.

Related links
  1. Hacker Tools List
  2. Top Pentest Tools
  3. Hacker Tools Software
  4. Tools 4 Hack
  5. Hacking Tools Download
  6. Pentest Reporting Tools
  7. Hacking Tools Windows 10
  8. Pentest Tools Framework
  9. Pentest Tools Linux
  10. Hackers Toolbox
  11. Pentest Tools For Ubuntu
  12. Top Pentest Tools
  13. Github Hacking Tools
  14. Hacking Tools For Windows 7
  15. Hacker Security Tools
  16. Hacking Tools Kit
  17. Hack And Tools
  18. Pentest Automation Tools
  19. Termux Hacking Tools 2019
  20. Hacking Tools Online
  21. Pentest Tools Tcp Port Scanner
  22. Pentest Tools Nmap
  23. Pentest Tools Review
  24. What Is Hacking Tools
  25. Pentest Tools Download
  26. Pentest Tools For Windows
  27. Hack Tool Apk
  28. Pentest Tools Bluekeep
  29. Hack Tools For Pc
  30. Pentest Tools Subdomain
  31. How To Make Hacking Tools
  32. Hacker Tools Software
  33. Pentest Tools Website
  34. Pentest Tools
  35. Pentest Tools Free
  36. Pentest Tools Online
  37. Pentest Tools Github
  38. Usb Pentest Tools
  39. Nsa Hack Tools Download
  40. Hack Tools Mac
  41. Best Hacking Tools 2019
  42. Hack Tools 2019
  43. Hacker Tools For Mac
  44. Black Hat Hacker Tools
  45. Hacker Tools For Ios
  46. Hack Tools 2019
  47. Hack Tools For Games
  48. Pentest Tools Open Source
  49. Easy Hack Tools
  50. Hacking Tools Windows
  51. Hacking Tools 2019
  52. Game Hacking
  53. Hacker Tools Apk
  54. What Are Hacking Tools
  55. Beginner Hacker Tools
  56. Hacking Tools Free Download
  57. Hacker Tools Linux
  58. Hacker Tools Apk
  59. Hacker Tools 2019
  60. Hacker Tools
  61. Hacking Tools
  62. Blackhat Hacker Tools
  63. Top Pentest Tools
  64. Pentest Tools Android
  65. Hacking Tools For Windows Free Download
  66. Hack Tools For Ubuntu
  67. Hacking Tools Windows
  68. Pentest Automation Tools
  69. Pentest Tools Framework
  70. Pentest Box Tools Download
  71. Pentest Tools Url Fuzzer
  72. Hacking Tools For Windows 7
  73. Hack Website Online Tool
  74. Hackers Toolbox
  75. Hacking Tools For Beginners
  76. Hacking Tools For Games
  77. What Are Hacking Tools
  78. Nsa Hacker Tools
  79. Pentest Tools Download
  80. Hacking Tools Mac
  81. Pentest Tools Bluekeep
  82. Beginner Hacker Tools
  83. Hack Tools
  84. Hacker Tools Github
  85. Ethical Hacker Tools
  86. Pentest Tools Tcp Port Scanner
  87. Pentest Box Tools Download
  88. Hacking Tools 2019
  89. How To Hack
  90. Hacking Tools For Windows Free Download
  91. Pentest Tools For Ubuntu
  92. Hacker Tools Free
  93. Pentest Tools Online
  94. Hacking Tools 2019
  95. Best Pentesting Tools 2018
  96. Hacking Tools Online
  97. Hacking Tools Pc
  98. Hacking Tools Pc
  99. Tools For Hacker
  100. Pentest Automation Tools
  101. Pentest Tools For Mac
  102. Hacker Tools Mac
  103. Computer Hacker
  104. Pentest Tools Free
  105. Growth Hacker Tools
  106. Hak5 Tools
  107. Hacking Tools Windows 10
  108. Hacker Tools Mac
  109. Hack Tools Pc
  110. Pentest Tools Review
  111. Hacking Tools Github
  112. Hack Tools Pc
  113. Pentest Tools Online
  114. Pentest Tools For Windows
  115. Hacker Tools Free Download
  116. Beginner Hacker Tools
  117. Top Pentest Tools
  118. Hack Tool Apk No Root
  119. Hack Tools For Games
  120. Tools 4 Hack
  121. Hacker Tools Online
  122. Hacking Tools Pc
  123. Hack Tools For Windows
  124. Pentest Tools For Ubuntu
  125. Top Pentest Tools
  126. Install Pentest Tools Ubuntu
  127. Hack Tools For Games
  128. Pentest Tools
  129. Hack Tools
  130. Hacker Tools
  131. Hackers Toolbox
  132. Hacking Tools Mac
  133. Hacking Tools
  134. Hacker Tools Free Download
  135. Hackers Toolbox
  136. Tools 4 Hack
  137. Pentest Tools Review
  138. Hacker Tools Apk

0 Comments:

Post a Comment

<< Home