Hackers Exploit Open-Source Tools PoshC2, Chisel, and Classroom Spy to Build Attack Framework

Unit 42 researchers from Palo Alto Networks have uncovered a series of sophisticated cyberattacks targeting financial institutions across Africa.

Tracked as the CL-CRI-1014 cluster, this campaign, active since at least July 2023, leverages a combination of open-source and publicly available tools to establish a robust attack framework.

Cyberattacks Target African Financial Sector

The threat actors behind these attacks are suspected to be operating as initial access brokers, gaining footholds in compromised networks and potentially selling this access on darknet markets to other malicious entities.

This strategy underscores a growing trend in cybercrime where specialized actors focus on breaching networks to enable further exploitation by others.

The attackers employ a consistent and technical playbook, utilizing tools such as PoshC2, an open-source attack framework, Chisel, a tunneling utility for bypassing network controls like firewalls, and Classroom Spy, a remote administration tool marketed for educational monitoring but repurposed for malicious intent.

PoshC2, often packed with a Nim-based packer to evade detection, serves as a command-and-control mechanism with implants tailored for specific environments, including hard-coded credentials and proxy setups.

Tools and Tactics Unveiled

Chisel facilitates covert communication by creating SOCKS proxies, allowing attackers to mask their activities within infected networks.

Meanwhile, Classroom Spy, recently adopted over the previously used MeshAgent, offers capabilities like keylogging, screen monitoring, and file deployment, with binaries often renamed (e.g., systemsvc.exe) to blend into legitimate processes.

The attackers further disguise their tools by forging digital signatures and mimicking icons of trusted products from Microsoft, Cortex, and VMware, a tactic designed to bypass security scrutiny without implying vulnerabilities in the legitimate software.

These threat actors demonstrate advanced lateral movement techniques, using legitimate tools like PsExec alongside PowerShell scripts to deploy payloads and establish persistence through scheduled tasks, services, and startup shortcuts.

Their awareness of security products is evident in instances where malware is disguised as files like CortexUpdater.exe, highlighting a deliberate attempt to evade detection by mimicking trusted software names.

The shift to Classroom Spy also indicates an evolution in tooling, possibly to exploit its extensive remote control features across multiple platforms, enhancing the attackers’ ability to monitor and manipulate compromised systems.

Palo Alto Networks has updated its protective measures, including Cortex XDR, XSIAM, and Advanced WildFire, to counter these threats by identifying associated indicators of compromise (IoCs) and malicious domains.

Organizations are urged to integrate these findings into their threat hunting and defensive strategies to mitigate risks posed by such intricate cyberattacks.

Indicators of Compromise (IoCs)

Type	Indicator
PoshC2 SHA256 Hashes	3bbe3f42857bbf74424ff4d044027b9c43d3386371decf905a4a1037ad468e2c, … (abridged)
Chisel SHA256 Hashes	bc8b4f4af2e31f715dc1eb173e53e696d89dd10162a27ff5504c993864d36f2f, … (abridged)
Classroom Spy SHA256	831d98404ce5e3e5499b558bb653510c0e9407e4cb2f54157503a0842317a363, … (abridged)
Domains	finix.newsnewth365[.]com, mozal.finartex[.]com, … (abridged)

Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates