Pierluigi Paganini March 05, 2021

Microsoft experts continue to investigate the SolarWinds attack and spotted 3 new strains of malware used as second-stage payloads.

Microsoft announced the discovery of three new pieces of malware that the threat actors behind the SolarWinds attack, tracked by the IT giant as Nobelium, used as second-stage payloads.

Microsoft’s initial investigation revealed the existence of the Sunburst backdoor and Teardrop malware, now the Microsoft Threat Intelligence Center (MSTIC) team and the Microsoft 365 Defender Research Team announced to have discovered three new malware strains tracked as GoldMax, Sibot, and GoldFinder.

“Microsoft discovered these new attacker tools and capabilities in some compromised customer networks and observed them to be in use from August to September 2020. Further analysis has revealed these may have been on compromised systems as early as June 2020. These tools are new pieces of malware that are unique to this actor.” reads the analysis published by Microsoft. “They are tailor-made for specific networks and are assessed to be introduced after the actor has gained access through compromised credentials or the SolarWinds binary and after moving laterally with TEARDROP and other hands-on-keyboard actions.”

These three pieces of malware were by the threat actors to maintain persistence and perform malicious actions in very targeted attacks.

The tailor-made malware were used as second-stage payloads, the attack vectors were compromised credentials, the SolarWinds binary, lateral movements conducted with the TEARDROP malware, or in some cases manually deployed.

The first malware, dubbed GoldMax, is a Go-based malware used as a command-and-control backdoor by the attackers. The malware used a scheduled task impersonating systems management software as a persistence trick. GoldMax implements a decoy network traffic generator to hide network traffic and avoid detection.

The second malware, dubbed Sibot, is a dual-purpose malicious code written in VBScript used by the threat actors to gain persistence and to download and execute a payload from a remote C2 server.

The third malware is a malware written in Go, dubbed GoldFinder, likely used as a custom HTTP tracer tool that logs the route or hops that a packet takes to reach a hardcoded C2 server.

Microsoft provided details about the malware and the alerts provided by its security solution when detecting behavior associated with a wide range of attacks, including the NOBELIUM’s activity.

This week, malware researchers at FireEye discovered a new sophisticated second-stage backdoor, dubbed Sunshuttle, while analyzing the servers of an organization that was compromised as a result of the SolarWinds supply-chain attack.

“In all stages of the attack, the actor demonstrated a deep knowledge of software tools, deployments, security software and systems common in networks, and techniques frequently used by incident response teams.” states Microsoft.

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, SolarWinds)

[adrotate banner=”5″]

[adrotate banner=”13″]