Deadglyph: New Advanced Backdoor with Distinctive Malware Tactics
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-8611 | Local Privilege Escalation in Microsoft Windows Kernel Exploited in the Wild CVE-2018-8611 is an elevation-of-privilege vulnerability in the Microsoft Windows kernel caused by improper handling of objects in memory (recorded as CWE-404, improper resource shutdown/release). It is a local flaw: an attacker who can already run code with limited privileges on a target machine can trigger it with a specially crafted application, with no user interaction required. Successful exploitation executes code in kernel context, elevating the attacker to SYSTEM/administrator and giving full control of the host, a typical post-initial-access step in ransomware chains. Nearly every Windows client and server version in support at disclosure is affected: Windows 7, 8.1, RT 8.1 and Windows 10 (1607 through 1809), plus Windows Server 2008 through 2019. The flaw is confirmed exploited in the wild, with CISA adding it to the KEV catalog on 2022-05-24 and an EPSS of 4.2% (90th percentile); the KEV record lists ransomware use as unknown, though public reporting ties a family of Windows kernel EoP exploits including this one to ransomware operators. Do: Apply Microsoft's December 2018 security update for CVE-2018-8611 on all affected Windows 7, 8.1, RT 8.1, 10 and Server 2008-2019 hosts; there is no known workaround and patching is the required CISA KEV action, so verify the December 2018 (or later) monthly rollup is installed. Prioritize servers and workstations where limited-privilege users or untrusted workloads run (RDS, application servers, shared endpoints), and treat any remaining unpatched Windows 7/8.1/legacy-Server machine as high risk because ransomware operators have been observed chaining Windows kernel EoP exploits like this one after initial access. | 7.8 | 4% | KEV |
| masshundreds of millions of Windows endpoints at time of disclosure (~700M active Windows 10 devices plus hundreds of millions of Windows 7 PCs), with residual… | |
| CVE-2019-0797 | Win32k Elevation of Privilege in Microsoft Windows (Exploited as Zero-Day) CVE-2019-0797 is an elevation of privilege flaw in the Windows Win32k kernel component, which fails to properly handle objects in memory. A local attacker who can already execute code on an affected machine can trigger the bug with a specially crafted application and escalate from a low-privileged user account to SYSTEM-level privileges, gaining full control of the host; this flaw is distinct from the related CVE-2019-0808 fixed the same month. Any system running an affected Windows release is exposed: Windows 10 versions 1507 through 1809, Windows 8.1 and RT 8.1, and Windows Server 2012, 2016, 1709 and 1803. The bug was a zero-day when Microsoft patched it in March 2019, having been used in targeted attacks attributed to the FruityArmor and SandCat groups, and it is listed in CISA's Known Exploited Vulnerabilities catalog, so in-the-wild exploitation is confirmed even though no public proof-of-concept is known. Do: Apply Microsoft's March 2019 cumulative updates (or monthly rollups for Windows 8.1/RT 8.1 and Server 2012) on every affected Windows 10, 8.1, and Server build, and confirm installation by checking the OS build/update level via winver or systeminfo. Because the flaw was used as a zero-day by FruityArmor and SandCat in targeted attacks, review endpoint telemetry for signs of those campaigns and treat the CISA KEV patching requirement as binding. Prioritize systems where low-privileged users run untrusted code, since exploitation requires only local code execution and then yields full SYSTEM-level control. | 7.8 | 2% | KEV |
| mass≈hundreds of millions of Windows devices (affected versions spanned nearly the entire Windows 10 installed base of roughly 800M devices, plus Windows 8.1/RT… |
Full article776 words · extracted from thehackernews.com · click to collapse
Cybersecurity researchers have discovered a previously undocumented advanced backdoor dubbed Deadglyph employed by a threat actor known as Stealth Falcon as part of a cyber espionage campaign.
"Deadglyph's architecture is unusual as it consists of cooperating components – one a native x64 binary, the other a .NET assembly," ESET said in a new report shared with The Hacker News.
"This combination is unusual because malware typically uses only one programming language for its components. This difference might indicate separate development of those two components while also taking advantage of unique features of the distinct programming languages they utilize."
It's also suspected that the use of different programming languages is a deliberate tactic to hinder analysis, making it a lot more challenging to navigate and debug.
Unlike other traditional backdoors of its kind, the commands are received from an actor-controlled server in the form of additional modules that allow it to create new processes, read files, and collect information from the compromised systems.
Stealth Falcon (aka FruityArmor) was first exposed by the Citizen Lab in 2016, linking it to a set of targeted spyware attacks in the Middle East aimed at journalists, activists, and dissidents in the U.A.E. using spear-phishing lures embedding booby-trapped links pointing to macro-laced documents to deliver a custom implant capable of executing arbitrary commands.
A subsequent investigation undertaken by Reuters in 2019 revealed a clandestine operation called Project Raven that involved a group of former U.S. intelligence operatives who were recruited by a cybersecurity firm named DarkMatter to spy on targets critical of the Arab monarchy.
Stealth Falcon and Project Raven are believed to be the same group based on the overlaps in tactics and targeting.
The group has since been linked to the zero-day exploitation of Windows flaws such as CVE-2018-8611 and CVE-2019-0797, with Mandiant noting in April 2020 that the espionage actor "used more zero-days than any other group" from 2016 to 2019.
Around the same time, ESET detailed the adversary's use of a backdoor named Win32/StealthFalcon that was found to use the Windows Background Intelligent Transfer Service (BITS) for command-and-control (C2) communications and to gain complete control of an endpoint.
Deadglyph is the latest addition to Stealth Falcon's arsenal, according to the Slovak cybersecurity firm, which analyzed an intrusion at an unnamed governmental entity in the Middle East.
The exact method used to deliver the implant is currently unknown, but the initial component that activates its execution is a shellcode loader that extracts and loads shellcode from the Windows Registry, which subsequently launches Deadglyph's native x64 module, referred to as the Executor.
The Executor then proceeds with loading a .NET component known as the Orchestrator that, in turn, communicates with the command-and-control (C2) server to await further instructions. The malware also engages in a series of evasive maneuvers to fly under the radar, counting the ability to uninstall itself.
The commands received from the server are queued for execution and can fall into one of three categories: Orchestrator tasks, Executor tasks, and Upload tasks.
"Executor tasks offer the ability to manage the backdoor and execute additional modules," ESET said. "Orchestrator tasks offer the ability to manage the configuration of the Network and Timer modules, and also to cancel pending tasks."
Some of the identified Executor tasks comprise process creation, file access, and system metadata collection. The Timer module is used to poll the C2 server periodically in combination with the Network module, which implements the C2 communications using HTTPS POST requests.
Upload tasks, as the name implies, allow the backdoor to upload the output of commands and errors.
ESET said it also identified a control panel (CPL) file that was uploaded to VirusTotal from Qatar, which is said to have functioned as a starting point for a multi-stage chain that paves the way for a shellcode downloader that shares some code resemblances with Deadglyph.
While the nature of the shellcode retrieved from the C2 server remains unclear, it has been theorized that the content could potentially serve as the installer for the Deadglyph malware.
Deadglyph gets its name from artifacts found in the backdoor (hexadecimal IDs 0xDEADB001 and 0xDEADB101 for the Timer module and its configuration), coupled with the presence of a homoglyph attack impersonating Microsoft ("Ϻicrоsоft Corpоratiоn") in the Registry shellcode loader's VERSIONINFO resource.
"Deadglyph boasts a range of counter-detection mechanisms, including continuous monitoring of system processes and the implementation of randomized network patterns," the company said. "Furthermore, the backdoor is capable of uninstalling itself to minimize the likelihood of its detection in certain cases."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/09/deadglyph-new-advanced-backdoor-with.html