Discovery of Alchimist C2 tool, revealed a new attack framework
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-4034 | Out-of-Bounds Read/Write Local Privilege Escalation in polkit pkexec (PwnKit) CVE-2021-4034 ('PwnKit') is an out-of-bounds read and write (CWE-125/CWE-787) in polkit's setuid-root pkexec utility, which mishandles the calling parameter count and ends up trying to execute environment variables as commands. A local attacker who runs pkexec with crafted environment variables can induce it to execute arbitrary code, gaining administrative (root) rights on the target machine. Because polkit is installed by default on mainstream Linux distributions — including Red Hat Enterprise Linux and its many variants, with the flaw also tracked against Canonical, SUSE, Oracle, Siemens, and StarWind Software products — essentially every standard Linux installation was exposed. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-06-27 with known ransomware use, and EPSS assigns a 94.9% probability of exploitation (100th percentile). Public proof-of-concept exploits are widely available, making exploitation trivial for any user with local access to an unpatched host. Do: Apply the polkit/pkexec updates from each distribution vendor immediately per vendor instructions, as required by the CISA KEV catalog. If patching must be delayed, removing the setuid bit from pkexec (e.g., chmod 0755 /usr/bin/pkexec) is a widely documented interim mitigation, though it may affect functionality that relies on pkexec. Prioritize hosts where untrusted or low-privilege users can log in, and hunt for prior exploitation given known ransomware use. | 7.8 | 95% | KEV ransomware PoC ×4 |
| masstens of millions of Linux servers and workstations (polkit/pkexec ships by default on virtually all mainstream distributions) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | cmd.exe | file sizes. Get OS information. Run arbitrary commands via cmd[.]exe. Upgrade the current Insekt implant. Run arbitrary comman |
Full article669 words · extracted from securityaffairs.com · click to collapse
Experts discovered a new attack framework, including a C2 tool dubbed Alchimist, used in attacks against Windows, macOS, and Linux systems.
Researchers from Cisco Talos discovered a new, previously undocumented attack framework that included a C2 dubbed Alchimist. The framework is likely being used in attacks aimed at Windows, macOS, and Linux systems.
The experts also spotted a new GoLang malware dubbed Insekt supporting remote administration capabilities.
The Alchimist has a web interface in Simplified Chinese, Talos researchers found it on a server that had a file listing active on the root directory along with a set of post-exploitation tools.
The Alchimist C2 can generate a configured payload, establish remote sessions, deploy payload to the remote machines, capture screenshots, perform remote shellcode execution and run arbitrary commands.
The security form also found additional tools, such as a Mach-O dropper embedded with an exploit for the PwnKit CVE-2021-4034) flaw and a Mach-O bind shell backdoor.
The server hosting the C2 also contained dual-use tools like psexec and netcat, along with a scanning tool called “fscan.”
In August, Talos observed a Chinese threat actor using a new offensive framework called Manjusaka (which can be translated to “cow flower” from the Simplified Chinese writing) that is similar to Sliver and Cobalt Strike tools.
The attack framework is advertised as an imitation of the Cobalt Strike framework, the experts reported that the implants for the new malware family are written in the Rust language for Windows and Linux.
Experts highlight that both Manjusaka and Alchimist support similar functionalities, despite they differ in the implementation of the web interfaces.
“However, Manjusaka and Alchimist have virtually the same set of features. They both have been designed and implemented to operate as standalone GoLang-based executables that can be distributed with relative ease to operators. The frameworks inside carry the implants and the whole web user interface.” reads the analysis published by the experts. “The implant configuration is defined using the Web UI (Web User Interface), which in both cases is completely written in Simplified Chinese. Also, they both mention the uncommon protocol SNI in one case already supported (Alchimist), with plans to support it in the other (Manjusaka).”
The Alchimist C2 panel stands out for its ability to generate PowerShell and wget code snippets for Windows and Linux. Threat actors could use these commands to build their infection chain for distributing the Insekt RAT. An attacker can embed these commands in a malicious script that could be embedded in a maldoc attachment and deliver it to the victims by various means.
The analysis of the Insekt RAT revealed it it a 64-bit implant written in GoLang, compiled for both Windows and Linux environments. The malicious code supports a variety of RAT capabilities that can be requested by the Alchimist C2.
During initialization, the implant will set up multiple handlers for seven primary capabilities:
- Get file sizes.
- Get OS information.
- Run arbitrary commands via cmd[.]exe.
- Upgrade the current Insekt implant.
- Run arbitrary commands as a different user.
- Sleep for periods of time defined by the C2.
- Start/stop taking screenshots.
“The Linux variant of Insekt also has the functionality to list the contents of “.ssh” directory in the victim’s home directory and adds new SSH keys to the authorised_Keys file. Using this feature, the attacker can communicate with the victim’s machine from the C2 over SSH.” continues the analysis.
Insekt also includes a module that implements the different commands, including interactive shells based on PowerShell, bash and cmd[.]exe.
“Our discovery of Alchimist is yet another indication that threat actors are rapidly adopting off-the-shelf C2 frameworks to carry out their operations.” concludes the report. “A threat actor gaining privileged shell access on a victim’s machine is like having a Swiss Army knife, enabling the execution of arbitrary commands or shellcodes in the victim’s environment, resulting in significant effects on the target organization,” the researchers said.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, attack framework)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/137046/hacking/alchimist-c2-tool.html