New Malware Used by SolarWinds Attackers Went Undetected for Years

The threat actor behind the supply chain compromise of
SolarWinds has continued to expand its malware arsenal with new
tools and techniques that were deployed in attacks as early as
2019, once indicative of the elusive nature of the campaigns and
the adversary’s ability to maintain persistent access for
years.

According to cybersecurity firm CrowdStrike, which detailed the novel tactics^[1] adopted by the Nobelium
hacking group last week, two sophisticated malware families were
placed on victim systems — a Linux variant of GoldMax and a new
implant dubbed TrailBlazer — long before the scale of the attacks
came to light.

Nobelium, the Microsoft-assigned moniker for the SolarWinds intrusion^[2]
in December 2020, is also tracked by the wider cybersecurity
community under the names UNC2452 (FireEye), SolarStorm (Unit 42),
StellarParticle (Crowdstrike), Dark Halo (Volexity), and Iron
Ritual (Secureworks).

The malicious activities^[3]
have since been attributed to a Russian state-sponsored actor
called APT29^[4]
(also known as The Dukes and Cozy Bear), a cyber espionage
operation associated with the country’s Foreign Intelligence
Service since at least 2008.

GoldMax (aka SUNSHUTTLE), which was discovered by Microsoft and
FireEye in March 2021, is a Golang-based malware^[5]
that acts as a command-and-control backdoor, establishing a secure
connection with a remote server to execute arbitrary commands on
the compromised machine.

In September 2021, Kaspersky revealed details of a second
variant of the GoldMax backdoor called Tomiris^[6]
that was deployed against several government organizations in an
unnamed CIS member state in December 2020 and January 2021.

The latest iteration is a previously undocumented but
functionally identical Linux implementation of the second-stage
malware that was installed in victim environments in mid-2019,
predating all other identified samples built for the Windows
platform to date.

Also delivered around the same timeframe was TrailBlazer, a
modular backdoor that offers attackers a path to cyber espionage,
while sharing commonalities with GoldMax in the way it masquerades
its command-and-control (C2) traffic as legitimate Google
Notifications HTTP requests.

Other uncommon channels used by the actor to facilitate the
attacks include —

• Credential hopping for obscuring lateral movement
• Office 365 (O365) Service Principal and Application^[7] hijacking,
  impersonation, and manipulation, and
• Theft of browser cookies for bypassing multi-factor
  authentication

Additionally, the operators carried out multiple instances of
domain credential theft months apart, each time leveraging a
different technique, one among them being the use of Mimikatz
password stealer in-memory, from an already compromised host to
ensure access for extended periods of time.

“The StellarParticle campaign, associated with the Cozy Bear
adversary group, demonstrates this threat actor’s extensive
knowledge of Windows and Linux operating systems, Microsoft Azure,
O365, and Active Directory, and their patience and covert skill set
to stay undetected for months — and in some cases, years,” the
researchers said.