Cyber Attack

CRON#TRAP Campaign Attacks Windows Machine With Weaponized Linux Virtual Machine

Weaponized Linux virtual machines are used for offensive cybersecurity purposes, such as “penetration testing” or “exploiting vulnerabilities.”

These setups often use the tools and frameworks that are designed for ethical hacking.

Securonix researchers recently detected CRON#TRAP campaign that has been attacking Windows machines with weaponized Linux virtual machines.

Technical analysis

CRON#TRAP is a sophisticated cyber attack campaign that begins with a “phishing email” containing a malicious shortcut (‘.lnk’) file disguised as “OneAmerica Survey.”

OneAmerica Survey.zip (Source – Securonix)

When executed, this file launches a “hidden 285MB package” that deploys a legitimate virtualization tool, QEMU (Quick Emulator), which is renamed “fontdiag.exe” to avoid detection. 

Build an in-house SOC or outsource SOC-as-a-Service -> Calculate Costs

The attack creates a hidden Linux environment running “Tiny Core Linux,” complete with a pre-configured backdoor that automatically establishes a connection to a “C2” server. 

This environment is dubbed “PivotBox” and contains custom commands like “get-host-shell” and “get-host-user” for host-system interaction by using “SSH keys” for persistent access. 

PivotBox (Source – Securonix)

The threat actors employed several tools, including vim, openssh, and 7zip, to manipulate the system while maintaining persistence via modified “boot local.sh” scripts and backed-up configurations via “file tool. sh. “

This campaign’s primary targets are “North America” and “Europe.” This is concerning as it uses QEMU and operates within a hidden virtual environment, which makes it extremely difficult for traditional AV solutions to detect. 

While the sophisticated infrastructure of the malware contains:- 

  • Network testing capabilities.
  • Payload manipulation through a file called ‘crondx.’
  • Data exfiltration channels using free file-sharing services.

This highlights a well-planned multi-stage attack methodology designed for “long-term stealth” and “system compromise.”

The analysis of “crondx” (Chisel) reveals a sophisticated cyber attack component found within the “CRON#TRAP campaign,” where a pre-configured “64-bit ELF” executable serves as a critical backdoor mechanism.

crondx (Source – Securonix)

This ELF executable is located at “/home/tc/crondx” in a Linux “QEMU” instance.

While this Golang-compiled binary is mainly engineered to establish “covert communication channels” with a C2 server at IP address “18.208.230[.]174” by using “websocket protocols” for data transmission. 

The attack sequence initiates via a phishing email containing a malicious “ZIP” file with a “.lnk” shortcut that triggers a “PowerShell script” to launch an emulated Linux environment via ‘QEMU.’ 

This effectively helps to evade traditional Windows-based AV detection systems. The threat actors modified the open-source “Chisel tunneling” tool for legitimate “TCP/UDP” tunneling over HTTP with SSH security. 

It’s done by hardcoding connection parameters directly into the binary instead of requiring command-line configurations, which helps enhance its “stealth capabilities.” 

This customized implementation enables persistent remote access via “encrypted channels,” that allow threat actors to deploy additional payloads to execute commands and exfiltrate data while remaining undetected. 

Various persistence mechanisms, such as “modified startup scripts” and “SSH key implementations,” further support the system’s compromise. 

Here, custom command aliases like ‘get-host-shell’ and ‘get-host-user’ facilitate direct interaction with the host machine within the isolated QEMU environment. 

.ash_history file (Source – Securonix)

The “.ash_history” file documents the threat actor’s activities, such as “tool installation,” “system reconnaissance,” and “payload deployment.” 

It shows a modular approach to system infiltration that uses legitimate software tools (‘QEMU’ and ‘Chisel’) to maintain persistent access while evading security controls.

Recommendations

Here below we have mentioned all the recommendations:-

  • Avoid downloading unsolicited files or attachments.
  • Treat external download links as potential threats.
  • Monitor common malware staging directories, especially for scripts.
  • Watch for legitimate software running from unusual locations.
  • Enable robust endpoint logging for better detection.

Run private, Real-time Malware Analysis in both Windows & Linux VMs. Get a 14-day free trial with ANY.RUN!

Tushar Subhra

Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Recent Posts

Researchers Detailed Credential Abuse Cycle

The United States Department of Justice has unsealed an indictment against Anonymous Sudan, a hacking…

37 seconds ago

Rise Of Ransomware-As-A-Service Leads To Decline Of Custom Tools

Ransomware-as-a-Service (RaaS) platforms have revolutionized the ransomware market. Unlike traditional standalone ransomware sales, RaaS offers…

4 mins ago

North Korean Hackers Employing New Tactic To Acruire Remote Jobs

North Korean threat actors behind the Contagious Interview and WageMole campaigns have refined their tactics,…

13 mins ago

HookBot Malware Use Overlay Attacks Impersonate As Popular Brands To Steal Data

The HookBot malware family employs overlay attacks to trick users into revealing sensitive information by…

20 mins ago

ToxicPanda Banking Malware Attacking Banking Users To Steal Logins

Recent research has uncovered a new strain of malware developed for Android devices, initially misidentified…

23 mins ago

Azure API Management Vulnerabilities Let Attackers Escalate Privileges

Recent discoveries by Binary Security have revealed critical vulnerabilities in Azure API Management (APIM) that could allow…

3 hours ago