The threat actor responsible for the SolarWinds supply chain compromise has been expanding its malware arsenal. New tools and techniques were used in attacks as far back as 2019,, which is indicative of both the complexity of the campaigns as well as the adversary’s capacity to retain persistent access over many years.
According to CrowdStrike (a cybersecurity company that detailed new tactics used by the Nobelium hacking organization last week), two sophisticated malware families were installed on victim systems — a Linux version of GoldMax, and a TrailBlazer-branded implant — well before the full extent of the attacks became apparent.
Nobelium, the Microsoft-assigned moniker for the SolarWinds intrusion in December 2020, is also tracked by the wider cybersecurity community under the names UNC2452 (FireEye), SolarStorm (Unit 42), StellarParticle (Crowdstrike), Dark Halo (Volexity), and Iron Ritual (Secureworks).
The malicious activities have since been attributed to a Russian state-sponsored actor called APT29 (also known as The Dukes and Cozy Bear), a cyber espionage operation associated with the country’s Foreign Intelligence Service since at least 2008.
GoldMax (aka SUNSHUTTLE), which was discovered by Microsoft and FireEye in March 2021, is a Golang-based malware that acts as a command-and-control backdoor, establishing a secure connection with a remote server to execute arbitrary commands on the compromised machine.
In September 2021, Kaspersky revealed details of a second variant of the GoldMax backdoor called Tomiris that was deployed against several government organizations in an unnamed CIS member state in December 2020 and January 2021.
The latest iteration is a previously undocumented but functionally identical Linux implementation of the second-stage malware that was installed in victim environments in mid-2019, predating all other identified samples built for the Windows platform to date.
Also delivered around the same timeframe was TrailBlazer, a modular backdoor that offers attackers a path to cyber espionage, while sharing commonalities with GoldMax in the way it masquerades its command-and-control (C2) traffic as legitimate Google Notifications HTTP requests.
Other uncommon channels used by the actor to facilitate the attacks include —
- Credential hopping for obscuring lateral movement
- Office 365 (O365) Service Principal and Application hijacking, impersonation, and manipulation, and
- Theft of browser cookies for bypassing multi-factor authentication
Additionally, the operators carried out multiple instances of domain credential theft months apart, each time leveraging a different technique, one among them being the use of Mimikatz password stealer in-memory, from an already compromised host to ensure access for extended periods of time.
“The StellarParticle campaign, associated with the Cozy Bear adversary group, demonstrates this threat actor’s extensive knowledge of Windows and Linux operating systems, Microsoft Azure, O365, and Active Directory, and their patience and covert skill set to stay undetected for months — and in some cases, years,” the researchers said.
