Modified PRISM backdoor used in new attacks

guest · Aug 23, 2021

Modified PRISM backdoor used in new attacks
Linux ELF executables used to avoid detection by anti-virus products.
August 23, 2021
https://www.itpro.co.uk/security/malware/360635/modified-prism-backdoor-used-in-new-attacks

Security researchers have found a cluster of Linux ELF executables with low or zero anti-virus detections in VirusTotal.

Researchers at AT&T Alien Labs identified these executables as modifications of the open source PRISM backdoor used by multiple threat actors in various campaigns.
Click to expand...

Researchers said in further investigations of the malware, they discovered several campaigns using these malicious executables have remained active and under the radar for over 3.5 years.

“The oldest samples Alien Labs can attribute to one of the actors date from the 8th of November 2017,” researchers said.
One of the variants found was dubbed WaterDrop. According to researchers, it uses an easily identifiable user agent string “agent-waterdropx” for the HTTP-based command-and-control (C&C) communications, and it reaches to subdomains of the waterdropx[.]com domain.
Click to expand...

Researchers also found samples tagged as “PRISM v1” that they attributed to the same threat actor because it used the same C&C domain.

“Compared to the public PRISM, this version introduces the creation of a child process that constantly queries the C&C server for commands to execute,” they said.

There were two other versions of PRISM: v2.2 and v3. PRISM v2.2 introduced XOR encryption, such as the BASH command strings, to obfuscate sensitive data. PRISM v3 is identical to v2.2 with one exception: Clients include a bot ID for identification purposes.
Click to expand...

AT&T Alien Labs: PRISM attacks fly under the radar

Conclusion
PRISM is an open-source simplistic and straightforward backdoor. Its traffic is clearly identifiable and its binaries are easy to detect. Despite this, PRISM’s binaries have been undetected until now, and its C&C server has remained online for more than 3.5 years. This shows that while bigger campaigns that receive more attention are usually detected within hours, smaller ones can slip through.

Alien Labs expects the adversaries to remain active and conduct operations with this toolset and infrastructure. We will continue to monitor and report any noteworthy findings.
Click to expand...

Log in or Sign up

Modified PRISM backdoor used in new attacks

guest Guest

Log in or Sign up

Modified PRISM backdoor used in new attacks

guest Guest

Useful Searches