New Malware Used By SolarWinds Attackers Went Undetected For Years

 

The threat actor behind the supply chain compromise of SolarWinds has continued to expand its malware arsenal with new tools and techniques that were deployed in attacks as early as 2019, once indicative of the elusive nature of the campaigns and the adversary's ability to maintain persistent access for years.

According to cybersecurity firm CrowdStrike, which detailed the novel tactics adopted by the Nobelium hacking group last week, two sophisticated malware families were placed on victim systems — a Linux variant of GoldMax and a new implant dubbed TrailBlazer — long before the scale of the attacks came to light.

Nobelium, the Microsoft-assigned moniker for the SolarWinds intrusion in December 2020, is also tracked by the wider cybersecurity community under the names UNC2452 (FireEye), SolarStorm (Unit 42), StellarParticle (CrowdStrike), Dark Halo (Volexity), and Iron Ritual (Secureworks).

The malicious activities have since been attributed to a Russian state-sponsored actor called APT29 (also known as The Dukes and Cozy Bear), a cyber espionage operation associated with the country's Foreign Intelligence Service that's known to be active since at least 2008.

GoldMax (aka SUNSHUTTLE), which was discovered by Microsoft and FireEye (now Mandiant) in March 2021, is a Golang-based malware that acts as a command-and-control backdoor, establishing a secure connection with a remote server to execute arbitrary commands on the compromised machine.

Mandiant also pointed out that Dark Halo actors had used the malware in attacks going back to at least August 2020, or four months before SolarWinds discovered its Orion updates had been tampered with malware designed to drop post-compromise implants against thousands of its customers.

In September 2021, Kaspersky revealed details of a second variant of the GoldMax backdoor called Tomiris that was deployed against several government organizations in an unnamed CIS member state in December 2020 and January 2021.

The latest iteration is a previously undocumented but functionally identical Linux implementation of the second-stage malware that was installed in victim environments in mid-2019, predating all other identified samples built for the Windows platform to date.

Also delivered around the same timeframe was TrailBlazer, a modular backdoor that offers attackers a path to cyber espionage, while sharing commonalities with GoldMax in the way it masquerades its command-and-control (C2) traffic as legitimate Google Notifications HTTP requests.

Other uncommon channels used by the actor to facilitate the attacks include —

• Credential hopping for obscuring lateral movement
• Office 365 (O365) Service Principal and Application hijacking, impersonation, and manipulation, and
• Theft of browser cookies for bypassing multi-factor authentication

Additionally, the operators carried out multiple instances of domain credential theft months apart, each time leveraging a different technique, one among them being the use of Mimikatz password stealer in-memory, from an already compromised host to ensure access for extended periods of time.

"The StellarParticle campaign, associated with the Cozy Bear adversary group, demonstrates this threat actor's extensive knowledge of Windows and Linux operating systems, Microsoft Azure, O365, and Active Directory, and their patience and covert skill set to stay undetected for months — and in some cases, years," the researchers said.

More info

1. Pentest Tools Windows
2. Pentest Recon Tools
3. Hack And Tools
4. Hacking Tools Windows 10
5. Hacking Tools For Windows 7
6. Pentest Tools Nmap
7. Hacking Tools For Beginners
8. Pentest Tools Port Scanner
9. Black Hat Hacker Tools
10. Hacking App
11. Hacking Tools Online
12. Hack Tools 2019
13. Github Hacking Tools
14. Hacking Tools Free Download
15. Hacker Tools 2019
16. Hacker Tools List
17. Pentest Tools Android
18. Pentest Tools Website
19. Hacker Tools For Ios
20. Hacker Tools Software
21. Hacker Tools Apk Download
22. Hacker Search Tools
23. Pentest Tools Url Fuzzer
24. Hacking Tools And Software
25. Hackrf Tools
26. Hack Tools Github
27. Hacking Tools For Mac
28. Hack Tools
29. Hacking Apps
30. What Is Hacking Tools
31. Pentest Reporting Tools
32. Termux Hacking Tools 2019
33. Hack Rom Tools
34. Pentest Tools Website
35. Nsa Hack Tools Download
36. Hacker Tools Linux
37. Hacking Tools 2019
38. Tools Used For Hacking
39. Pentest Tools
40. Hacking Apps
41. Pentest Tools Android
42. Hacker Security Tools
43. Pentest Tools Kali Linux
44. Pentest Tools Framework
45. Computer Hacker
46. Hacking Tools For Beginners
47. Hack Tools Pc
48. Easy Hack Tools
49. Hacking Tools Download
50. Hacker Tools Free
51. Hacking Apps
52. Hacking App
53. Hack Tools Download
54. Free Pentest Tools For Windows
55. Hacking Tools And Software
56. Pentest Tools Url Fuzzer
57. Pentest Tools Website
58. Hack Tools 2019
59. Hack Tools 2019
60. Hacking Tools For Windows 7
61. Tools 4 Hack
62. Hacker Tool Kit
63. How To Make Hacking Tools
64. Pentest Tools Port Scanner
65. Usb Pentest Tools
66. Hacker Tools Mac
67. Ethical Hacker Tools
68. Pentest Tools Subdomain
69. Hack Tools
70. Pentest Tools Github
71. What Are Hacking Tools
72. Hack Tools Mac
73. Hacking Tools Windows 10
74. Pentest Tools Alternative
75. Hacker Tools Apk Download
76. Hacking Tools Download
77. Hacker Tools Mac