Saturday, November 2, 2024
HomeMalwareTitanium APT Hackers Inject New Hidden Backdoor on Windows Using Fileless Technique

Titanium APT Hackers Inject New Hidden Backdoor on Windows Using Fileless Technique

Published on

Malware protection

A new wave of malware attack strikes again from the Titanium APT group that infects windows with hidden backdoor by mimicking common legitimate software and fileless technique.

Titanium APT is one of the technologically advanced hacking group, they are using the various sophisticated technique to attack the target, and their method of attack makes very hard to detect their activities in wide.

Additionally, their malware file system cannot be detected as malicious due to the use of encryption and fileless technologies to infect the victims.

- Advertisement - SIEM as a Service

Titanium APT mainly targeting the APAC region, and the current attack believed to be focused on South and Southeast Asia.

Researchers from Kaspersky uncovered that the malware hides at every step by mimicking common software (protection related, sound drivers software, DVD video creation tools).

Titanium APT Backdoor Infection Stages

Before installing a backdoor on a windows computer in the final stage, threat actors following complex sequences of dropping, downloading, and installing stages.

During this process, in every stage, they are mimic known software, such as security software, software for making DVD videos, sound drivers’ software to evade detection.

Researchers believe that the attackers using the local intranet website with malicious code to spread the malware.

In another way, Titanium APT inject the shellcode into a process called winlogon.exe, a legitimate process file popularly known as Windows Logon Application that performs a variety of critical tasks related to the Windows sign-in process. Kaspersky said via blog post.

The shellcode itself contains position-independent code connect to the hardcoded C&C address, download an encrypted payload then decrypt and launch it using a hardcoded unpacking password.

Titanium Threat actors always have a habit to use of Wrapper DLLs to decrypt and load an encrypted file on the system memory.

In order to maintain the persistence on the victim’s machine, threat actor using Windows task installer, a password-encrypted SFX archive that can be downloaded via BITS Downloader.

BITS downloader library helps to download files in encrypted form from the C&C and launch them.

Installing the Backdoor

At the final stage, the process of installing a backdoor, attackers uses the Trojan-Backdoor installer that launched from the command line using a password to unpack it.

Installer receives a command from the C2 server by sending an empty request to the C2 server, and the malware can also get proxy settings from Internet Explorer.

In response, C2 Server sending a PNG file that contains steganographically hidden data. This data is encrypted with the same key as the C&C requests. The decrypted data contains backdoor commands to steal the data from infected victims.  

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Notorious WrnRAT Delivered Mimic As Gambling Games

WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling...