misp-galaxy/clusters/backdoor.json

{
  "authors": [
    "raw-data"
  ],
  "category": "tool",
  "description": "A list of backdoor malware.",
  "name": "Backdoor",
  "source": "Open Sources",
  "type": "backdoor",
  "uuid": "75436e27-cb57-4f32-bf1d-9636dd78a2bf",
  "values": [
    {
      "description": "Cross-platform malware written in Golang, compatible with Linux and Windows. Although there are some minor differences, both variants have the same functionality. The malware communicates with a CnC server using HTTP requests and performs functions based on the received commands. Results of command execution are sent in HTTP POST requests data (RSA-encrypted). Main functionalities are: (1) Execute arbitrary shell commands, (2) Upload/Download files. The PE variant of the infection, in addition, executes PowerShell scripts. A .Net version was also observed in the wild.",
      "meta": {
        "date": "July 2018.",
        "refs": [
          "https://blog.jpcert.or.jp/2018/07/malware-wellmes-9b78.html"
        ]
      },
      "related": [
        {
          "dest-uuid": "d84ebd91-58f6-459f-96a1-d028a1719914",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "similar"
        }
      ],
      "uuid": "e0e79fab-0f1d-4fc2-b424-208cb019a9cd",
      "value": "WellMess"
    },
    {
      "description": "The rosenbridge backdoor is a small, non-x86 core embedded alongside the main x86 core in the CPU. It is enabled by a model-specific-register control bit, and then toggled with a launch-instruction. The embedded core is then fed commands, wrapped in a specially formatted x86 instruction. The core executes these commands (which we call the 'deeply embedded instruction set'), bypassing all memory protections and privilege checks.\n\nWhile the backdoor should require kernel level access to activate, it has been observed to be enabled by default on some systems, allowing any unprivileged code to modify the kernel.\n\nThe rosenbridge backdoor is entirely distinct from other publicly known coprocessors on x86 CPUs, such as the Management Engine or Platform Security Processor; it is more deeply embedded than any known coprocessor, having access to not only all of the CPU's memory, but its register file and execution pipeline as well.",
      "meta": {
        "date": "August 2018",
        "refs": [
          "https://www.bleepingcomputer.com/news/security/backdoor-mechanism-discovered-in-via-c3-x86-processors/",
          "https://github.com/xoreaxeaxeax/rosenbridge",
          "https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Christopher%20Domas/DEFCON-26-Christopher-Domas-GOD-MODE-%20UNLOCKED-hardware-backdoors-in-x86-CPUs.pdf"
        ]
      },
      "uuid": "2bb165dc-9f93-11e8-ae64-d3dbab0dd786",
      "value": "Rosenbridge"
    },
    {
      "description": "The purpose of the macro was to download and execute a variant of ServHelper that set up reverse SSH tunnels that enabled access to the infected host through the Remote Desktop Protocol (RDP) port 3389.\n\n\"Once ServHelper establishes remote desktop access, the malware contains functionality for the threat actor to “hijack” legitimate user accounts or their web browser profiles and use them as they see fit,\" researchers from Proofpoint explain in an analysis released today.\n\nThe other ServHelper variant does not include the tunneling and hijacking capabilities and functions only as a downloader for the FlawedGrace RAT.",
      "meta": {
        "refs": [
          "https://www.bleepingcomputer.com/news/security/new-servhelper-backdoor-and-flawedgrace-rat-pushed-by-necurs-botnet/"
        ]
      },
      "uuid": "8b50360c-4d16-4f52-be75-e74c27f533df",
      "value": "ServHelper"
    },
    {
      "description": "The Rising Sun backdoor uses the RC4 cipher to encrypt its configuration data and communications. As with most backdoors, on initial infection, Rising Sun will send data regarding the infected system to a command and control (C2) site. That information captures computer and user name, IP address, operating system version and network adapter information. Rising Sun contains 14 functions  including executing commands, obtaining information on disk drives and running processes, terminating processes, obtaining file creation and last access times, reading and writing files, deleting files, altering file attributes, clearing the memory of processes and connecting to a specified IP address.",
      "meta": {
        "refs": [
          "https://www.bluvector.io/threat-report-rising-sun-operation-sharpshooter/"
        ]
      },
      "uuid": "0ae6636e-87e4-4b4c-a1c8-e14e1cab964f",
      "value": "Rising Sun"
    },
    {
      "description": "A new backdoor was observed using the Github Gist service and the Slack messaging system as communication channels with its masters, as well as targeting a very specific type of victim using a watering hole attack.\nThe backdoor dubbed SLUB by the Trend Micro Cyber Safety Solutions Team who detected it in the wild is part of a multi-stage infection process designed by capable threat actors who programmed it in C++.\nSLUB uses statically-linked curl, boost, and JsonCpp libraries for performing HTTP request, \"extracting commands from gist snippets,\" and \"parsing Slack channel communication.\"\nThe campaign recently observed by the Trend Micro security researchers abusing the Github and Slack uses a multi-stage infection process.",
      "meta": {
        "refs": [
          "https://www.bleepingcomputer.com/news/security/new-slub-backdoor-uses-slack-github-as-communication-channels/"
        ]
      },
      "related": [
        {
          "dest-uuid": "bb6492fa-36b5-4f4a-a787-e718e7f9997f",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "similar"
        }
      ],
      "uuid": "a4757e11-0837-42c0-958a-7490cff58687",
      "value": "SLUB"
    },
    {
      "description": "Since it first emerged in 2015, Asruex has been known for its backdoor capabilities and connection to the spyware DarkHotel. However, when we encountered Asruex in a PDF file, we found that a variant of the malware can also act as an infector particularly through the use of old vulnerabilities CVE-2012-0158 and CVE-2010-2883, which inject code in Word and PDF files respectively.",
      "meta": {
        "refs": [
          "https://blog.trendmicro.com/trendlabs-security-intelligence/asruex-backdoor-variant-infects-word-documents-and-pdfs-through-old-ms-office-and-adobe-vulnerabilities/"
        ]
      },
      "uuid": "b7ad60a0-d648-4775-adec-c78b1a92fc34",
      "value": "Asruex"
    },
    {
      "meta": {
        "refs": [
          "https://securityintelligence.com/news/ta505-delivers-new-gelup-malware-tool-flowerpippi-backdoor-via-spam-campaign/"
        ]
      },
      "uuid": "aefe3603-8f96-425c-9f71-9fe21334f224",
      "value": "FlowerPippi"
    },
    {
      "description": "FreeBSD-based payload, Speculoos was delivered by exploiting CVE-2019-19781, a vulnerability affecting the Citrix Application Delivery Controller, Citrix Gateway, and Citrix SD-WAN WANOP appliances that allowed an adversary to remotely execute arbitrary commands. This vulnerability was first disclosed on December 17, 2019 via security bulletin CTX267679 which contained several mitigation recommendations. By January 24, 2020, permanent patches for the affected appliances were issued. Based on the spread of industries and regions, in addition to the timing of the vulnerability disclosure, we believe this campaign may have been more opportunistic in nature compared to the highly targeted attack campaigns that are often associated with these types of adversaries. However, considering the exploitation of the vulnerability in conjunction with delivery of a backdoor specifically designed to execute on the associated FreeBSD operating system indicates the adversary was absolutely targeting the affected devices.",
      "meta": {
        "refs": [
          "https://unit42.paloaltonetworks.com/apt41-using-new-speculoos-backdoor-to-target-organizations-globally/"
        ]
      },
      "related": [
        {
          "dest-uuid": "9c124874-042d-48cd-b72b-ccdc51ecbbd6",
          "tags": [
            "estimative-language:likelihood-probability=\"very-likely\""
          ],
          "type": "used-by"
        }
      ],
      "uuid": "201e8794-a93b-476f-9436-1dd859c6e5d9",
      "value": "Speculoos"
    },
    {
      "description": "Mori Backdoor has been used by Seedworm.",
      "meta": {
        "refs": [
          "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/seedworm-apt-iran-middle-east"
        ]
      },
      "uuid": "e663ac1b-9474-4f9a-b0c8-184861327dd7",
      "value": "Mori Backdoor"
    },
    {
      "description": "Something that made the brute-force attacks on RDP connections easier was a new module of the notorious Trojan, TrickBot. It now seems that the TrickBot developers have a new tactic. Cybersecurity researchers have discovered a new phishing campaign that delivers a stealthy backdoor called BazarBackdoor, which can be used to compromise and gain full access to corporate networks.\nAs is the case with 91% of cyberattacks, this one starts with a phishing email. A range of subjects are used to personalize the emails: Customer complaints, coronavirus-themed payroll reports, or employee termination lists. All these emails contain links to documents hosted on Google Docs. To send the malicious emails, the cybercriminals use the marketing platform Sendgrid.\nThis campaign uses spear phishing, which means that the perpetrators have made an effort to ensure that the websites sent in the emails seem legitimate and correspond to the emails subjects.",
      "meta": {
        "refs": [
          "https://www.advanced-intel.com/post/anatomy-of-attack-inside-bazarbackdoor-to-ryuk-ransomware-one-group-via-cobalt-strike",
          "https://www.pandasecurity.com/en/mediacenter/business/bazarbackdoor-trickbot-backdoor/"
        ]
      },
      "uuid": "1523a693-5d90-4da1-86d2-b5d22317820d",
      "value": "BazarBackdoor"
    },
    {
      "description": "Backdoor.Sunburst is Malwarebytes’ detection name for a trojanized update to SolarWind’s Orion IT monitoring and management software.",
      "meta": {
        "refs": [
          "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/",
          "https://www.varonis.com/blog/solarwinds-sunburst-backdoor-inside-the-stealthy-apt-campaign/",
          "https://blog.malwarebytes.com/detections/backdoor-sunburst/",
          "https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/",
          "https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/"
        ],
        "synonyms": [
          "Solarigate"
        ]
      },
      "related": [
        {
          "dest-uuid": "d9b2305e-9802-483c-a95d-2ae8525c7704",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "dropped-by"
        },
        {
          "dest-uuid": "d7247cf9-13b6-4781-b789-a5f33521633b",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "used-by"
        }
      ],
      "uuid": "16902832-0118-40f2-b29e-eaba799b2bf4",
      "value": "SUNBURST"
    },
    {
      "description": "BPFDoor is a passive backdoor used by a China-based threat actor. This backdoor supports multiple protocols for communicating with a C2 including TCP, UDP, and ICMP allowing the threat actor a variety of mechanisms to interact with the implant",
      "meta": {
        "refs": [
          "https://troopers.de/troopers22/talks/7cv8pz/",
          "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896?gi=1effe9eb6507",
          "https://twitter.com/cyb3rops/status/1523227511551033349",
          "https://twitter.com/CraigHRowland/status/1523266585133457408"
        ]
      },
      "uuid": "0c3b1aa5-3a33-493e-9126-28ebced4ed09",
      "value": "BPFDoor"
    }
  ],
  "version": 12
}