Undocumented Loader Framework Disguised as Python Runtime Uncovered in Cyberattack
A new threat to cybersecurity has emerged, revealing a sophisticated loader framework that camouflages malicious Go code within a counterfeit Python runtime. Researchers at Blackpoint Cyber’s Adversary Pursuit Group (APG) reported these findings on July 30, detailing an incursion that primarily targeted two endpoints at a law firm. This assault deployed two undocumented families of malware: a Go loader labeled HollowFrame and a pair of Rust backdoors dubbed Matryoshka.
Exclusions Preceding Payload Delivery
The cyber-attack initiated with a meticulously crafted spear phishing email directed at members of the law firm’s staff. Recipients of this email were taken through an attacker-controlled redirector, ultimately leading them to an encrypted archive on Mega. This archive contained an enticingly named shortcut file, "Case Documents.lnk." Upon execution, this file cleverly transferred Base64-encoded content to a temporary location, utilized the built-in certutil utility to rebuild a script, and finally initiated a complicated obfuscated PowerShell command chain. This series of commands prompted the user to grant administrative rights, a necessary step for the subsequent actions.
With administrative privileges secured, this phase of the attack established exclusions within Microsoft Defender. These exclusions not only pertained to a designated staging directory but also encompassed the process named python.exe. This strategic maneuver laid the groundwork for downloading additional executable content undetected. According to Blackpoint, the attackers had "effectively prepared a trusted looking execution lane" prior to the entrance of the loader.
The archive retrieved by the loader was insidiously named to resemble an official Python embedded distribution, though an anomalous filename—amd96—instead of amd64 drew attention.
Python: A Misleading Facade
When the bundled python.exe was launched with no specific script or module arguments, the attack transitioned into a phase of DLL sideloading. Here, the accompanying python311.dll was not the expected CPython library; it was a 64-bit Go library designed to export merely four function names compatible with Python. This minimalistic approach was sufficient to satisfy the import requirements of the host environment, thus handing over execution to the harmful Go code.
This code embodied the HollowFrame framework, a modular loader boasting multiple execution techniques including process ghosting, module stomping, and manual PE mapping. Each technique was engineered to generate distinct telemetry on various endpoints, thereby complicating detection efforts. Additionally, HollowFrame conducted checks on system uptime, installed memory, and user cursor movement prior to executing payloads. The loader provided three avenues for persistence: through scheduled tasks, WMI event subscriptions aligned with new logon sessions, and users’ Startup folders.
A Hidden Repository on GitHub
Following the inception of HollowFrame, the framework dropped a native loader that sideloaded a malicious version.dll next to a legitimate OneDrive updater. This strategic positioning allowed the first Matryoshka backdoor to execute commands and transmit network traffic within a seemingly trusted Microsoft process.
A second variant emerged as a Rust-based wtsapi32.dll, which acted as a proxy for 41 Windows Terminal Services exports. Interestingly, this variant utilized GitHub as a covert channel, assigning each victim a directory within a private repository. This design enabled efficient tasking and file transfers without the necessity of a custom command-and-control (C2) server.
Beyond gaining shell access, this variant was capable of identifying domain controllers, enumerating domain computers and privileged group memberships, as well as inventorying network configurations, local privileges, and installed software. Echoing stealthy techniques, its requests utilized a OneDrive user agent, which Blackpoint has indicated as a potential detection marker.
Recommendations for Mitigation
To address the vulnerabilities exposed by this intricate cyberattack, Blackpoint Cyber has offered a series of recommendations. These include closely monitoring unexpected GitHub API interactions from non-browser processes, especially those requesting task-related files, and flagging signed binaries that attempt to load adjacent DLLs from user-writable paths.
Further guidance entails constraining GitHub API access for endpoints lacking development roles and rigorously reviewing scheduled tasks and WMI subscriptions for any names suggestive of updates. In an era where cyber threats are increasingly complex, Blackpoint also advises that users perform controlled detonations of password-protected archives and shortcut files to uncover any malicious behavior.
In summary, the unraveling of this loader framework signifies a notable escalation in the sophistication of cyber threats, particularly through the clever use of trusted processes and camouflage techniques. The implications for cybersecurity measures are profound, urging organizations to be more vigilant than ever in safeguarding their systems against such ingenious attacks.