New SLUB Backdoor Uses GitHub, Communicates via Slack

guest · Mar 7, 2019

New SLUB Backdoor Uses GitHub, Communicates via Slack
March 7, 2019
https://blog.trendmicro.com/trendla...-backdoor-uses-github-communicates-via-slack/

We recently came across a previously unknown malware that piqued our interest in multiple ways.
The infection was done by exploiting CVE-2018-8174, a VBScript engine vulnerability that was patched by Microsoft back in May 2018.

Second, it uses a multi-stage infection scheme. After it exploits the vulnerability, it downloads a DLL and runs it in PowerShell (PS). This file, which is a downloader, then downloads and runs the second executable file containing a backdoor.

At the time of discovery, the backdoor was seemingly unknown to AV products.

In addition to the previously mentioned facts, we quickly noticed that the malware was connecting to the Slack platform, a collaborative messaging system that lets users create and use their own workspaces through the use of channels, similar to the IRC chatting system. We found this quite interesting, since we haven’t observed any malware to date that communicates using Slack.
Click to expand...

guest · Jul 16, 2019

SLUB Gets Rid of GitHub, Intensifies Slack Use
July 16, 2019
https://blog.trendmicro.com/trendla...lub-gets-rid-of-github-intensifies-slack-use/

On July 9, we discovered a new version of SLUB delivered via another unique watering hole website. This malicious site used CVE-2019-0752, an Internet Explorer vulnerability discovered by Trend Micro’s Zero Day Initiative (ZDI) that was just patched this April. This is the first time we found this exploit used in the wild.

This new version of the SLUB malware has stopped using GitHub as a way to communicate, heavily using Slack instead via two free workspaces.
Coincidence or not, both websites that have delivered the SLUB malware are supportive of the North Korean government.
The backdoor
The most notable change is the complete adoption of Slack as an avenue to organize victim machines and give commands.
Click to expand...

Conclusion
Once again, this attack shows a professional level when it comes to the OpSec deployed. The constant use of online services like Slack and pen.io makes it harder to track this threat actor.
Similar to the previous variant, this one has been very discreet and has not been spread at a wide scale. We could not find any other variant anywhere else, nor did we find any other ongoing campaign run by these attackers.
In response to this incident, Slack replied with the following:

[...] As part of the Trend Micro investigation, we were made aware of free workspaces being used in this manner. We investigated and immediately shut down the reported Slack Workspaces as a violation of our terms of service. We confirmed that Slack was not compromised in any way as part of this incident. We are committed to preventing the misuse of our platform and we will take action against anyone who violates our terms of service
Click to expand...

guest · Oct 30, 2020

Browsers Bugs Exploited to Install 2 New Backdoors on Targeted Computers
October 30, 2020
https://thehackernews.com/2020/10/browser-exploit-backdoor.html

Cybersecurity researchers have disclosed details about a new watering hole attack targeting the Korean diaspora that exploits vulnerabilities in web browsers such as Google Chrome and Internet Explorer to deploy malware for espionage purposes.

Dubbed "Operation Earth Kitsune" by Trend Micro, the campaign involves the use of SLUB (for SLack and githUB) malware and two new backdoors — dneSpy and agfSpy — to exfiltrate system information and gain additional control of the compromised machine.
The attacks were observed during the months of March, May, and September, according to the cybersecurity firm.

Operation Earth Kitsune is said to have deployed the spyware samples on websites associated with North Korea, although access to these websites is blocked for users originating from South Korean IP addresses.
Click to expand...

A Diversified Campaign
Although previous operations involving SLUB used the GitHub repository platform to download malicious code snippets onto the Windows system and post the results of the execution to an attacker-controlled private Slack channel, the latest iteration of the malware has targeted Mattermost, a Slack-like open-source collaborative messaging system.

"The campaign is very diversified, deploying numerous samples to the victim machines and using multiple command-and-control (C&C) servers during this operation," Trend Micro said. "In total, we found the campaign using five C&C servers, seven samples, and exploits for four N-day bugs."
Click to expand...

Designed to skip systems that have security software installed on them as a means to thwart detection, the attack weaponizes an already patched Chrome vulnerability (CVE-2019-5782) that allows an attacker to execute arbitrary code inside a sandbox via a specially-crafted HTML page.
Separately, a vulnerability in Internet Explorer (CVE-2020-0674) was also used to deliver malware via the compromised websites.
Click to expand...

Trend Micro: Operation Earth Kitsune - Tracking SLUB’s Current Operations

Log in or Sign up

New SLUB Backdoor Uses GitHub, Communicates via Slack

guest Guest

guest Guest

guest Guest

Log in or Sign up

New SLUB Backdoor Uses GitHub, Communicates via Slack

guest Guest

guest Guest

guest Guest

Useful Searches