Site icon TheCyberThrone

WitChetty APT- Plants Backdoor in Windows logo

PravinKarthik
Advertisements

Researcher has spotted a threat actor dubbed Witchetty, using steganography to hide a previously undocumented backdoor in a Windows logo. The group used the backdoor in attacks against Middle Eastern governments.

The cyber espionage group Witchetty, experts argue it is a sub-group of the China-linked TA410 group. The group has been continuously improving its toolset by employing new malware in attacks aimed at governments, diplomatic missions, charities, and industrial/manufacturing organizations in the Middle East and Africa.

Advertisements

Witchetty operations were characterized by the use of two pieces of malware, a first-stage backdoor dubbed X4 and a second-stage modular malware known as LookBack.

The threat actors exploited the ProxyShell and ProxyLogon vulnerabilities to deploy web shells on public-facing servers before performing malicious actions, such as stealing credentials, moving laterally across networks, and drop addition malicious payload.

The group started using a previous undetected implant tracked as Backdoor.Stegmap in recent attacks, which relies on steganography to conceal the malicious payload in a bitmap image of an old Microsoft Windows logo hosted on a GitHub repository. Hiding the malicious code within an image hosted on a trusted service allowed the attackers to evade detection.

Witchetty has ability to continually refine and refresh its toolset to compromise targets of interest. Exploitation of vulnerabilities on public-facing servers provides it with a route into organizations, while custom tools paired with adept use of living-off-the-land tactics allow it to maintain a long-term, persistent presence in targeted organizations.

This research was documented by researchers from Symantec Threat Hunters Group

Advertisements

Indicators of Compromise

Exit mobile version