Attackers may exploit CVE-2024-7344 to bypass UEFI Secure Boot and deploy a malicious bootkit, achieving persistence and potentially exfiltrating sensitive data or disrupting system operations.
Tag: T1547.001
Hunt 4 Zloader Trojan – DNS Tunneling
Attackers are using hidden files and directories to evade detection and maintain persistence within the environment.
Hunt: Snowblind – The Invisible Hand of Secret Blizzard
A sophisticated attacker, potentially the “Secret Blizzard” group, has gained access to the network and is actively attempting to establish persistence, evade detection, escalate privileges, and collect sensitive data. They are likely using custom malware with advanced anti-analysis capabilities and are targeting specific systems and data.
Unveiling RevC2 and Venom Loader
- Initial Access: The attack likely begins with a phishing email containing a malicious LNK file (VenomLNK).
- Execution: The LNK file executes an obfuscated batch script, which downloads and executes various payloads, including RevC2 and Venom Loader. Venom Loader utilizes DLL side-loading and JavaScript for execution.
- Persistence: Venom Loader establishes persistence by adding a PowerShell script to the autorun registry key.
- Command and Control: RevC2 uses WebSockets (ws://208.85.17[.]52:8082) for C2 communication, while More_eggs lite uses HTTP POST requests (/api/infos).
- Defense Evasion: Both RevC2 and Venom Loader employ obfuscation to hinder analysis. Venom Loader also uses DLL side-loading.
- Collection: RevC2 steals cookies, passwords, and takes screenshots.
- Exfiltration: Stolen data is exfiltrated over the C2 channel.
Harnessing Chisel for Covert Operations
The attacker utilizes Chisel, a tunneling tool, to establish a covert communication channel with the C2 server over HTTP. This allows them to bypass firewalls and security measures that might detect traditional C2 traffic.