The threat actor behind the supply chain compromise of SolarWinds has continued to expand its malware arsenal with new tools and techniques that were deployed in attacks as early as 2019, once indicative of the elusive nature of the campaigns and the adversary's ability to maintain persistent access for years.
According to cybersecurity firm CrowdStrike, which detailed the novel tactics adopted by the Nobelium hacking group last week, two sophisticated malware families were placed on victim systems — a Linux variant of GoldMax and a new implant dubbed TrailBlazer — long before the scale of the attacks came to light.
Nobelium, the Microsoft-assigned moniker for the SolarWinds intrusion in December 2020, is also tracked by the wider cybersecurity community under the names UNC2452 (FireEye), SolarStorm (Unit 42), StellarParticle (CrowdStrike), Dark Halo (Volexity), and Iron Ritual (Secureworks).
The malicious activities have since been attributed to a Russian state-sponsored actor called APT29 (also known as The Dukes and Cozy Bear), a cyber espionage operation associated with the country's Foreign Intelligence Service that's known to be active since at least 2008.
GoldMax (aka SUNSHUTTLE), which was discovered by Microsoft and FireEye (now Mandiant) in March 2021, is a Golang-based malware that acts as a command-and-control backdoor, establishing a secure connection with a remote server to execute arbitrary commands on the compromised machine.
Mandiant also pointed out that Dark Halo actors had used the malware in attacks going back to at least August 2020, or four months before SolarWinds discovered its Orion updates had been tampered with malware designed to drop post-compromise implants against thousands of its customers.
In September 2021, Kaspersky revealed details of a second variant of the GoldMax backdoor called Tomiris that was deployed against several government organizations in an unnamed CIS member state in December 2020 and January 2021.
The latest iteration is a previously undocumented but functionally identical Linux implementation of the second-stage malware that was installed in victim environments in mid-2019, predating all other identified samples built for the Windows platform to date.
Also delivered around the same timeframe was TrailBlazer, a modular backdoor that offers attackers a path to cyber espionage, while sharing commonalities with GoldMax in the way it masquerades its command-and-control (C2) traffic as legitimate Google Notifications HTTP requests.
Other uncommon channels used by the actor to facilitate the attacks include —
- Credential hopping for obscuring lateral movement
- Office 365 (O365) Service Principal and Application hijacking, impersonation, and manipulation, and
- Theft of browser cookies for bypassing multi-factor authentication
Additionally, the operators carried out multiple instances of domain credential theft months apart, each time leveraging a different technique, one among them being the use of Mimikatz password stealer in-memory, from an already compromised host to ensure access for extended periods of time.
"The StellarParticle campaign, associated with the Cozy Bear adversary group, demonstrates this threat actor's extensive knowledge of Windows and Linux operating systems, Microsoft Azure, O365, and Active Directory, and their patience and covert skill set to stay undetected for months — and in some cases, years," the researchers said.
Continue reading- Hacking Tools For Pc
- Pentest Recon Tools
- Tools 4 Hack
- Pentest Tools Url Fuzzer
- Hack Tools For Pc
- Termux Hacking Tools 2019
- Pentest Tools Review
- Physical Pentest Tools
- Growth Hacker Tools
- Hacking Tools Windows 10
- Pentest Tools Subdomain
- New Hacker Tools
- Hack App
- Hack Tools 2019
- Hacker Hardware Tools
- Hacker Tools Linux
- Pentest Recon Tools
- Hacking Tools Usb
- Hacker Tools Windows
- Hacker Tools 2020
- Bluetooth Hacking Tools Kali
- Pentest Tools Bluekeep
- Hacker
- Pentest Tools Github
- How To Make Hacking Tools
- Hacking Tools Download
- Hacker Tools For Mac
- Pentest Reporting Tools
- Pentest Tools For Ubuntu
- Underground Hacker Sites
- Kik Hack Tools
- Pentest Tools Kali Linux
- Android Hack Tools Github
- Hack Tool Apk No Root
- Beginner Hacker Tools
- Pentest Tools Online
- How To Hack
- Hacking Tools Software
- Pentest Tools Android
- Hacker Tools Windows
- Pentest Tools Subdomain
- Hacker Tools Mac
- New Hack Tools
- Pentest Recon Tools
- Hack Tools 2019
- Pentest Tools Online
- Hackers Toolbox
- Top Pentest Tools
- Install Pentest Tools Ubuntu
- Pentest Tools For Mac
- How To Make Hacking Tools
- Hacker Tools For Pc
- Hack Tools For Pc
- Best Pentesting Tools 2018
- Hacking Tools For Mac
- Hackrf Tools
- Hack Tools For Games
- Hack Tools For Pc
- Pentest Tools Apk
- Pentest Tools Github
- Best Pentesting Tools 2018
- Hack Tools
- Hacking Tools Hardware
- Hacking Tools For Windows Free Download
- Hack Tools
- Hacking Tools For Beginners
- Termux Hacking Tools 2019
- Hacking Tools For Games
- Hacker Tools Free
- Hacking Tools Online
- Hacker Tools Apk
- Hacking Tools For Windows 7
- Hacker Tools Windows
- Pentest Tools Alternative
- Pentest Tools For Mac
- Hack Apps
- What Are Hacking Tools
- Hacker Tools For Ios
- Hacker Tools Windows
- Hackers Toolbox
- Pentest Tools Framework
- How To Hack
- Best Hacking Tools 2019
- Github Hacking Tools
- Hack Tools For Pc
- Pentest Tools Windows
- Hacker Tools For Pc
- Install Pentest Tools Ubuntu
- Pentest Tools Url Fuzzer
- Pentest Reporting Tools
- Pentest Automation Tools
- Hacking Tools Download
- Hacker Tools For Windows
- Hacking Tools Name
- Blackhat Hacker Tools
- Hacker Search Tools
- Hacker Tools
- Hack Tools For Games
- Hacking Tools For Pc
- Beginner Hacker Tools
- Hacker Tools Free Download
- Hack Tools For Windows
- Pentest Tools For Android
- Nsa Hack Tools Download
- Hacker Hardware Tools
- Bluetooth Hacking Tools Kali
- Pentest Tools Apk
- Hacker Tools For Windows
- Hacking Tools Usb
- Hacker Tools 2019
- Pentest Tools Review
- Hack Tools Mac
- Hack Tools
- Hacker Tools Windows
- How To Install Pentest Tools In Ubuntu
- Hacker Tools Windows
- Pentest Tools Framework
- Hack Tools
- Hacker Tools Apk Download
- Hacker Tools Free Download
- Computer Hacker
- Pentest Recon Tools
- Hacker Tools 2020
- Hacker Tools Linux
- Hack And Tools
- Bluetooth Hacking Tools Kali
- Hack Tools For Mac
- Pentest Tools Apk
- Pentest Tools Review
- Hacking Tools And Software
- Hacking Tools For Beginners
- Hackers Toolbox
- Hacker Tools List
- Beginner Hacker Tools
- Wifi Hacker Tools For Windows
- Growth Hacker Tools
- Hack Tools For Windows
- Hacking Tools Windows
- Hacking Tools Online
- Pentest Tools Website
- Underground Hacker Sites
- Hacking Tools Github
- Game Hacking
- World No 1 Hacker Software
- How To Hack
- Pentest Tools Find Subdomains
- Hacking Tools For Windows
- Tools For Hacker
- Pentest Tools
- Hacking Tools Download
- Hacker Tools Software
- Hack Tools For Games
- Pentest Tools Windows
- Hack Tools Github
- Pentest Tools Url Fuzzer
- Ethical Hacker Tools
- Hacking Tools Mac
- Hacking Tools And Software
- Hacking Tools Kit
- Top Pentest Tools
- Github Hacking Tools
- Hack Tools
- Hacker Tools List
- Termux Hacking Tools 2019
- New Hack Tools
- Hack Tools Github
- Hacking Tools Software
- Best Hacking Tools 2019
- Hacker Tools 2020
- Hacking Tools Software
- Pentest Tools Bluekeep
- Github Hacking Tools
- Hacking Tools And Software
- Hacker Tools Github
No comments:
Post a Comment