SLUB Backdoor leverages GitHub and Slack in targeted attacks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2015-1701 | Local Privilege Escalation in Microsoft Windows Win32k.sys Kernel-Mode Driver CVE-2015-1701 is a local elevation-of-privilege vulnerability in Win32k.sys, the Windows kernel-mode driver, that allows a local attacker to execute arbitrary code with kernel-level (SYSTEM) privileges. It is triggered by running a specially crafted application on an affected Windows system, where mishandled user-mode objects in the kernel let the attacker escape a limited user context. An attacker who already has a normal user foothold can escalate to full system rights, enabling persistence and lateral movement; in documented campaigns it was chained with other exploits to move from remote code execution to complete system compromise. Any unpatched Microsoft Windows installation carrying the vulnerable Win32k.sys is affected; the CISA description explicitly cites Microsoft Windows Server, and this kernel-mode driver ships with Microsoft's Windows server and client releases. Exploitation is confirmed in the wild: CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2022-03-03 with known ransomware use, and the 56.2% EPSS (99th percentile) indicates a high probability of exploitation in the next 30 days; no public PoC is known. Do: Apply Microsoft's Windows security update for this CVE (bulletin MS15-051, released with the April 2015 Patch Tuesday) on all Windows client and server systems, prioritizing servers, terminal services hosts, and any machine where untrusted users can execute code, and audit the estate for legacy systems still missing the fix. As an interim control where patching is delayed, restrict local code execution to trusted accounts, and hunt for post-compromise indicators given the flaw's use as a 2015 APT28 zero-day and its documented use in ransomware chains per the CISA KEV entry. | — | 56% | KEV ransomware |
| massmillions of unpatched legacy Windows systems (subset of the >1 billion Windows devices in use) | |
| CVE-2018-8174 | Out-of-Bounds Write RCE in Microsoft Windows VBScript Engine CVE-2018-8174 is an out-of-bounds write (CWE-787) in the Microsoft Windows VBScript engine, caused by the way it handles objects in memory. An attacker triggers it by convincing a user to visit a specially crafted website or open crafted content that invokes the VBScript engine (for example via Internet Explorer or a document preview), requiring user interaction. Successful exploitation yields remote code execution with the privileges of the logged-on user, enabling program installation, data theft and account takeover. All listed Windows client and server releases are affected: Windows 7, 8.1, RT 8.1, Windows 10 (1607-1803), and Windows Server 2008/2008 R2, 2012/2012 R2, 2016. Exploitation is in the wild: the flaw was fixed in the May 2018 Patch Tuesday, is listed in CISA KEV with known ransomware use, and public PoCs (0patch, ExploitDB 44741) and exploit kit usage have been documented; EPSS puts its 30-day exploitation probability at 88.5%. Do: Apply Microsoft's May 2018 security updates (and any later cumulative or Extended Security Updates) to every listed Windows client and server release, as required by the CISA KEV listing, prioritizing internet-reachable and user-facing systems given known ransomware use. Upgrade out-of-support platforms (Windows 7/8.1/RT 8.1, Server 2008/2008 R2, 2012/2012 R2) to supported builds or ensure ESU coverage. As interim mitigation, block VBScript execution in Internet Explorer web zones using Microsoft's documented Group Policy/registry settings, and hunt for prior exploitation on legacy systems. | 7.5 | 88% | KEV ransomware PoC ×2 |
| masshundreds of millions of Windows PCs and servers (affected desktop releases dominated the ~1B+ device Windows install base at disclosure) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | kancc.org | ks observed by Trend Micro used as watering hole domain the kancc.org, a legitimate website of the Korean American National Coord |
Full article563 words · extracted from securityaffairs.com · click to collapse
Malware researchers from Trend Micro have spotted a new piece of malware dubbed SLUB that leverages GitHub and Slack for C&C communications.
Malware researchers at Trend Micro have spotted a new backdoor dubbed
SLUB that abuse GitHub and Slack for command and control (C&C) communications.
According to the experts, the SLUB backdoor (Backdoor.Win32.SLUB.A) was only used in targeted attacks by sophisticated threat actors.
SLUB is the first piece of malware to actually leverage Slack for C2 communications.
Attackers carried out watering hole attacks to deliver the malware, the attacks observed by Trend Micro used as watering hole domain the kancc.org, a legitimate website of the Korean American National Coordinating Council. Attackers exploit the CVE-2018-8174 flaw, a VBScript engine vulnerability that was patched by Microsoft in May 2018.
The exploit code delivers a DLL file and runs it using PowerShell (first stage), it fetches and executes another file containing the actual backdoor.
The first stage code checks for the presence of various antivirus solutions (i.e. Avast, AVG, Bitdefender, Norton, ESTsoft, AhnLab and Qihoo 360) — and halt its execution if any of them are found. The downloader also exploits the CVE-2015-1701 Windows flaw to escalate privileges.
Once SLUB malware was installed on the target system, it checks specific GitHub pages to retrieve commands. When the malware executes commands, the results are posted to a private Slack channel under the control of the attackers. Experts discovered two hardcoded authentication tokens into the code of malware that allows controlling the Slack channel.
“we quickly noticed that the malware was connecting to the Slack platform, a collaborative messaging system that lets users create and use their own workspaces through the use of channels, similar to the IRC chatting system. We found this quite interesting, since we haven’t observed any malware to date that communicates using Slack.” reads the analysis published by the experts.
“Our technical investigation and analysis of the attacker’s tools, techniques, and procedures (TTP) lead us to think that this threat is actually a stealthy targeted attack run by capable actors, and not a typical cybercriminal scheme.”
Trend Micro shared its findings with GitHub and Slack, both companies have taken action to remove the related files and channels.
SLUB supports several commands, including downloading and uploading files, listing files on the system, creating and removing folders, obtaining system information, taking screenshots, and performing registry operations.
Experts pointed out that the commands supported by the malware show a strong interest in person-related information of the attackers, with a special focus on communication software.
Experts at Trend Micro did not associate the malware with previously documented threat groups.
Evidence suggests the attackers were interested in targeting South Korean users (based on the watering hole domain), experts noticed that attackers appear to be particularly interested in files with the extension HWP, which are associated with a popular Korean word processor.
“Perhaps the most unique aspect of this campaign is that it makes use of three different online services to issue commands, get the results, and retrieve files from compromised hosts.” concludes the experts.
“Our investigation makes us believe with strong confidence that it was part of a possible targeted attack campaign. So far, we have not been able to find related attacks, and have not spotted the custom backdoor elsewhere.”
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – Slub malware, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/82172/malware/slub-backdoor.html