03-04-2021 , 07:15 PM
Quote:FireEye discovered a new "sophisticated second-stage backdoor" on the servers of an organization compromised by the threat actors behind the SolarWinds supply-chain attack.
The new malware is dubbed Sunshuttle, and it was "uploaded by a U.S.-based entity to a public malware repository in August 2020."
FireEye researchers Lindsay Smith, Jonathan Leathery, and Ben Read believe Sunshuttle is linked to the threat actor behind the SolarWinds supply-chain attack.
"Mandiant observed SUNSHUTTLE at a victim compromised by UNC2452, and have indications that it is linked to UNC2542, but we have not fully verified this connection," FireEye said.
Sunshuttle is GO-based malware featuring detection evasion capabilities. At the moment, the infection vector used to install the backdoors is not yet known, but it is "most likely" dropped as a second-stage backdoor.
"The new SUNSHUTTLE backdoor is a sophisticated second-stage backdoor that demonstrates straightforward but elegant detection evasion techniques via its "blend-in" traffic capabilities for C2 communications," FireEye [color=var(--theme-link_a)]added.[/color]
"SUNSHUTTLE would function as a second-stage backdoor in such a compromise for conducting network reconnaissance alongside other SUNBURST-related tools."
New blog from [color=var(--theme-link_a)]@jonleathery and [color=var(--theme-link_a)]@LindsaySmithDC[/color] on SUNSHUTTLE, a full featured backdoor written in Go, that we think is linked to UNC2452. Tracking this is a team effort with our IR, FLARE and AP teams doing great work.[color=var(--theme-link_a)]https://t.co/dr7DwHRh71[/color]
— Ben Read (@bread08) [color=var(--theme-link_a)]March 4, 2021[/color][/color]
Fourth malware linked to SolarWinds hackers
If the connection made by FireEye with the state hackers behind the SolarWinds hack checks out, Sunshuttle would be the fourth malware found while investigating the supply-chain attack.
The threat actor who orchestrated the attacks is currently tracked as [color=var(--theme-link_a)]UNC2452 (FireEye), [color=var(--theme-link_a)]StellarParticle[/color] (CrowdStrike), [color=var(--theme-link_a)]SolarStorm[/color] (Palo Alto Unit 42), and [color=var(--theme-link_a)]Dark Halo[/color] (Volexity).[/color]
CrowdStrike found the [color=var(--theme-link_a)]Sunspot malware used to inject backdoors in Orion platform builds after being dropped by in the development environment of SolarWinds' Orion IT management software.[/color]
The [color=var(--theme-link_a)]Sunburst (Solorigate) backdoor malware was deployed during second-stage attacks on the systems of organizations using trojanized Orion builds via the platform's built-in automatic update mechanism.[/color]
FireEye found a third malware named [color=var(--theme-link_a)]Teardrop, a previously unknown memory-only dropper and a post-exploitation tool the attackers used to deploy customized Cobalt Strike beacons.[/color]
A fourth malware, [color=var(--theme-link_a)]dubbed SuperNova, not linked to UNC2452 but also delivered using trojanized Orion builds, was discovered by Palo Alto Networks Unit 42 and Microsoft while investigating the supply-chain attack.[/color]
Earlier this week, [color=var(--theme-link_a)]SolarWinds reported expenses of $3.5 million incurred after the attack, including incident investigation and remediation costs.[/color]
Source