New Backdoor Created Using Leaked CIA's Hive Malware Discovered in the Wild

guest · Jan 16, 2023

By Ravie Lakshmanan - January 16, 2023

Unidentified threat actors have deployed a new backdoor that borrows its features from the U.S. Central Intelligence Agency (CIA)'s Hive multi-platform malware suite, the source code of which was released by WikiLeaks in November 2017.

"This is the first time we caught a variant of the CIA Hive attack kit in the wild, and we named it xdr33 based on its embedded Bot-side certificate CN=xdr33," Qihoo Netlab 360's Alex Turing and Hui Wang said in a technical write-up published last week.
The intent of the backdoor, per the Chinese cybersecurity firm, is to harvest sensitive information and act as a launchpad for subsequent intrusions. It improves upon Hive by adding new C2 instructions and functionalities, among other implementation changes.
Click to expand...

This includes the ability to download and upload arbitrary files, run commands using cmd, and launch shell, in addition to updating and erasing traces of itself from the compromised host.

The malware also incorporates a Trigger module that's designed to eavesdrop on network traffic for a specific "trigger" packet in order to extract the C2 server mentioned in the IP packet's payload, establish connection, and wait for the execution of commands sent by the C2.
Click to expand...

Qihoo 360 Netlab: Heads up! Xdr33, A Variant Of CIA’s HIVE Attack Kit Emerges

By Alex.Turing, Hui Wang - January 10, 2023
To summarize, xdr33 is a backdoor born from the CIA Hive project, its main purpose is to collect sensitive information and provide a foothold for subsequent intrusions. In terms of network communication, xdr33 uses XTEA or AES algorithm to encrypt the original traffic, and uses SSL with Client-Certificate Authentication mode enabled to further protect the traffic;
Click to expand...

itman · Jan 16, 2023

It's a Linux backdoor. Pretty good detection of it at VirusTotal.

Log in or Sign up

New Backdoor Created Using Leaked CIA's Hive Malware Discovered in the Wild

guest Guest

itman Registered Member

Log in or Sign up

New Backdoor Created Using Leaked CIA's Hive Malware Discovered in the Wild

guest Guest

itman Registered Member

Useful Searches