ESET researchers uncover a malware household with instruments that present indicators they’re utilized in focused assaults
ESET researchers have found a beforehand unknown malware household that makes use of customized and well-designed modules, concentrating on techniques working Linux. Modules utilized by this malware household, which we dubbed FontOnLake, are always below growth and supply distant entry to the operators, gather credentials, and function a proxy server. On this blogpost, we summarize the findings revealed in full in our white paper.
To gather information (as an example ssh credentials) or conduct different malicious exercise, this malware household makes use of modified legit binaries which are adjusted to load additional parts. In actual fact, to hide its existence, FontOnLake’s presence is all the time accompanied by a rootkit. These binaries similar to cat, kill or sshd are generally used on Linux techniques and may moreover function a persistence mechanism.
The sneaky nature of FontOnLake’s instruments together with superior design and low prevalence counsel that they’re utilized in focused assaults.
The primary identified file of this malware household appeared on VirusTotal final Might and different samples had been uploaded all year long. The situation of the C&C server and the international locations from which the samples had been uploaded to VirusTotal may point out that its targets embrace Southeast Asia.
We consider that FontOnLake’s operators are notably cautious since virtually all samples seen use distinctive C&C servers with various non-standard ports. The authors use principally C/C++ and numerous third-party libraries similar to Increase, Poco, or Protobuf. Not one of the C&C servers utilized in samples uploaded to VirusTotal had been lively on the time of writing – which signifies that they may have been disabled because of the add.
Recognized parts of FontOnLake
FontOnLake’s at present identified parts will be divided into three following teams that work together with one another:
- Trojanized purposes – modified legit binaries which are adjusted to load additional parts, gather information, or conduct different malicious actions.
- Backdoors – person mode parts serving as the principle level of communication for its operators.
- Rootkits – kernel mode parts that principally cover and disguise their presence, help with updates, or present fallback backdoors.
We found a number of trojanized purposes; they’re used principally to load customized backdoor or rootkit modules. Other than that, they will additionally gather delicate information. Patches of the purposes are most probably utilized on the supply code degree, which signifies that the purposes should have been compiled and changed the unique ones.
All of the trojanized information are normal Linux utilities and every serves as a persistence technique as a result of they’re generally executed on system start-up. The preliminary means during which these trojanized purposes get to their victims isn’t identified.
Communication of a trojanized utility with its rootkit runs via a digital file, which is created and managed by the rootkit. As illustrated in Determine 1, information will be learn/written from/to the digital file and exported with its backdoor element upon the operator’s request.
The three totally different backdoors we found are written in C++ and all use, albeit in barely other ways, the identical Asio library from Increase for asynchronous community and low-level I/O. Poco, Protobuf, and options from STL similar to good pointers are used as properly. What’s uncommon for malware is the truth that these backdoors additionally function quite a few software program design patterns.
The performance that all of them have in frequent is that every exfiltrates collected credentials and its bash command historical past to its C&C.
Contemplating among the overlapping performance, most probably these totally different backdoors aren’t used collectively on one compromised system.
All of the backdoors moreover use customized heartbeat instructions despatched and acquired periodically to maintain the connection alive.
The general performance of those backdoors consists of the next strategies:
- Exfiltrating the collected information
- Making a bridge between a customized ssh server working domestically and its C&C
- Manipulating information (as an example, add/obtain, create/delete, listing itemizing, modify attributes, and so forth)
- Serving as a proxy
- Executing arbitrary shell instructions and python scripts
We found two marginally totally different variations of the rootkit, used solely one after the other, in every of the three backdoors. There are vital variations between these two rootkits, nonetheless, sure features of them overlap. Despite the fact that the rootkit variations are based mostly on the suterusu open-source challenge, they include a number of of their unique, customized methods.
Mixed performance of the 2 variations of the rootkit we found embrace:
- Course of hiding
- File hiding
- Hiding itself
- Hiding community connections
- Exposing the collected credentials to its backdoor
- Performing port forwarding
- Magic packets reception (magic packets are specifically crafted packets that may instruct the rootkit to obtain and execute one other backdoor)
Following our discovery whereas finalizing our white paper on this matter, distributors similar to Tencent Safety Response Heart, Avast and Lacework Labs revealed their analysis on what seems to be the identical malware.
All identified parts of FontOnLake are detected by ESET merchandise as Linux/FontOnLake. Firms or people who wish to shield their Linux endpoints or servers from this risk ought to use a multilayered safety product and an up to date model of their Linux distribution; among the samples we’ve got analyzed had been created particularly for CentOS and Debian.
Prior to now we described an operation that shared sure behavioral patterns with FontOnLake; nonetheless, its scale and influence had been a lot larger. We dubbed it Operation Windigo and you’ll find extra details about it in this white paper and this follow-up blogpost.
Extra technical particulars on FontOnLake will be present in our complete white paper.
|38B09D690FAFE81E964CBD45EC7CF20DCB296B4D||Backdoor 1 variant 1|
|56556A53741111C04853A5E84744807EEADFF63A||Backdoor 1 variant 2|
|FE26CB98AA1416A8B1F6CED4AC1B5400517257B2||Backdoor 1 variant 3|
|D4E0E38EC69CBB71475D8A22EDB428C3E955A5EA||Backdoor 1 variant 4|
|204046B3279B487863738DDB17CBB6718AF2A83A||Backdoor 2 variant 1|
|9C803D1E39F335F213F367A84D3DF6150E5FE172||Backdoor 2 variant 2|
|BFCC4E6628B63C92BC46219937EA7582EA6FBB41||Backdoor 2 variant 3|
|515CFB5CB760D3A1DA31E9F906EA7F84F17C5136||Backdoor 3 variant 4|
|A9ED0837E3AF698906B229CA28B988010BCD5DC1||Backdoor 3 variant 5|
|56CB85675FE7A7896F0AA5365FF391AC376D9953||Rootkit 1 model 1|
|72C9C5CE50A38D0A2B9CEF6ADEAB1008BFF12496||Rootkit 1 model 2|
|B439A503D68AD7164E0F32B03243A593312040F8||Rootkit 1 model 3|
|E7BF0A35C2CD79A658615E312D35BBCFF9782672||Rootkit 1 model 4|
|56580E7BA6BF26D878C538985A6DC62CA094CD04||Rootkit 1version 5|
|49D4E5FCD3A3018A88F329AE47EF4C87C6A2D27A||Rootkit 1 model 5|
|74D44C2949DA7D5164ADEC78801733680DA8C110||Rootkit 2 model 1|
|74D755E8566340A752B1DB603EF468253ADAB6BD||Rootkit 2 model 2|
|E20F87497023E3454B5B1A22FE6C5A5501EAE2CB||Rootkit 2 model 3|
From internet-wide scan:
/and many others/sysconfig/modules/ati_remote3.modules
MITRE ATT&CK methods
This desk was constructed utilizing model 9 of the ATT&CK framework.
|Preliminary Entry||T1078||Legitimate Accounts||FontOnLake can gather no less than ssh credentials.|
|Execution||T1059.004||Command and Scripting Interpreter: Unix Shell||FontOnLake allows execution of Unix Shell instructions.|
|T1059.006||Command and Scripting Interpreter: Python||FontOnLake allows execution of arbitrary Python scripts.|
|T1106||Native API||FontOnLake makes use of fork() to create further processes similar to sshd.|
|T1204||Person Execution||FontOnLake trojanizes normal instruments similar to cat to execute itself.|
|Persistence||T1547.006||Boot or Logon Autostart Execution: Kernel Modules and Extensions||One in every of FontOnLake’s rootkits will be executed with a start-up script.|
|T1037||Boot or Logon Initialization Scripts||FontOnLake creates a system start-up script ati_remote3.modules.|
|T1554||Compromise Shopper Software program Binary||FontOnLake modifies a number of normal binaries to realize persistence.|
|Protection Evasion||T1140||Deobfuscate/Decode Information or Data||Some backdoors of FontOnLake can decrypt AES-encrypted and serialized communication and base64 decode encrypted C&C deal with.|
|T1222.002||File and Listing Permissions Modification: Linux and Mac File and Listing Permissions Modification||FontOnLake’s backdoor can change the permissions of the file it desires to execute.|
|T1564||Disguise Artifacts||FontOnLake hides its connections and processes with rootkits.|
|T1564.001||Disguise Artifacts: Hidden Information and Directories||FontOnLake hides its information with rootkits.|
|T1027||Obfuscated Information or Data||FontOnLake packs its executables with UPX.|
|T1014||Rootkit||FontOnLake makes use of rootkits to cover the presence of its processes, information, community connections and drivers.|
|Credential Entry||T1556||Modify Authentication Course of||FontOnLake modifies sshd to gather credentials.|
|Discovery||T1083||File and Listing Discovery||One in every of FontOnLake’s backdoors can checklist information and directories.|
|T1082||System Data Discovery||FontOnLake can gather system info from the sufferer’s machine.|
|Lateral Motion||T1021.004||Distant Companies: SSH||FontOnLake collects ssh credentials and most likely intends to make use of them for lateral motion.|
|Command and Management||T1090||Proxy||FontOnLake can function a proxy.|
|T1071.001||Utility Layer Protocol: Net Protocols||FontOnLake acquires further C&C servers over HTTP.|
|T1071.002||Utility Layer Protocol: File Switch Protocols||FontOnLake can obtain further Python information to be executed over FTP.|
|T1132.001||Information Encoding: Normal Encoding||FontOnLake makes use of base64 to encode HTTPS responses.|
|T1568||Dynamic Decision||FontOnLake can use HTTP to obtain sources that include an IP deal with and port quantity pair to hook up with and purchase its C&C. It may well use dynamic DNS decision to assemble and resolve to a randomly chosen area.|
|T1573.001||Encrypted Channel: Symmetric Cryptography||FontOnLake makes use of AES to encrypt communication with its C&C.|
|T1008||Fallback Channels||FontOnLake can use dynamic DNS decision to assemble and resolve to a randomly chosen area. One in every of its rootkits additionally listens for specifically crafted packets, which instruct it to obtain and execute further information. It additionally each connects to a C&C and accepts connections on all interfaces.|
|T1095||Non-Utility Layer Protocol||FontOnLake makes use of TCP for communication with its C&C.|
|T1571||Non-Normal Port||Nearly each pattern of FontOnLake makes use of a singular non-standard port.|
|Exfiltration||T1041||Exfiltration Over C2 Channel||FontOnLake makes use of its C&C to exfiltrate collected information.|