A new malware campaign was spotted using Windows event logs as a way to hide chunks of shellcode. This is the first instance of such a malicious campaign in the wild.
“It allows the ‘fileless’ last stage trojan to be hidden from plain sight in the file system,” Kaspersky researcher Denis Legezo said in a technical write-up published this week.
The stealthy infection process, not attributed to a known actor, is believed to have commenced in September 2021 when the intended targets were lured into downloading compressed .RAR files containing Cobalt Strike and Silent Break.
The adversary simulator software modules can then be used to launch code injection into Windows system processes and trusted applications.
Also notable is the use of anti-detection wrappers as part of the toolset, suggesting an attempt on the part of the operators to fly under the radar.
One of the key methods is to keep encrypted shellcode containing the next-stage malware as 8KB pieces in event logs, a never-before-seen technique in real-world attacks, that’s then combined and executed.
The final payload is a set of trojans that employ two different communication mechanisms — HTTP with RC4 encryption and unencrypted with named pipes — which allow it to run arbitrary commands, download files from a URL, escalate privileges, and take screenshots.
Another indicator of the threat actor’s evasion tactics is the use of information gleaned from initial reconnaissance to develop succeeding stages of the attack chain, including the use of a remote server that mimics legitimate software used by the victim.
” The actor responsible for this campaign was quite competent,” Legezo stated. Legezo said that the code was unique and had no similarity to any known malware. “
The disclosure comes as Sysdig researchers demonstrated a way to compromise read-only containers with fileless malware that’s executed in-memory by leveraging a critical flaw in Redis servers.