New Backdoor Targets French Entities via an Open-Source Package Installer

A new campaign has been discovered. It leverages Windows package manager Chocolatey to deploy a backdoor called Snake on compromised systems.
The campaign’s ultimate objective remains unknown for now.

Enterprise security company Proofpoint attributed the attacks to a state-sponsored or state-aligned threat actor based on the tactics and victimology.

The campaign’s ultimate objective remains unknown at this time.

“The attacker is attempting to install a backdoor on a potential victim’s device, which could enable remote administration of the device, execution of commands, and control of the device, as well as data theft and delivery of other useful information.”
Proofpoint researchers said in a report shared with The Hacker News.

The phishing “lure” that triggers the infection sequence uses a CV-themed subject line and a Microsoft Word document containing a macro, while masquerading as information related to the European Union’s General Data Protection Regulation (GDPR).

Enabling the macro triggers the execution chain, which retrieves an apparently harmless image file hosted on a remote server, but which actually contains malware.
It is a Base64-encoded PowerShell script concealed through steganography
(hiding malicious code within an image or audio file in order to
bypass human detection).

The PowerShell script is designed to install the Chocolatey utility on the Windows machine.
It is then used to install the Python pip package installer, which subsequently enables the installation of the PySocks proxy library.

The same PowerShell script also retrieves another image file from the same remote server, which contains a disguised Python backdoor called Snake, capable of executing commands relayed by the server.

In addition to steganography, the use of widely trusted tools such as Chocolatey as a manager for the subsequent deployment of legitimate Python packages is an attempt to stay under the radar and avoid being flagged as a threat, Proofpoint said.

The attacks could not be linked to a previously identified actor or group, but they are suspected to be the work of a sophisticated, possibly state-aligned hacking team.

“It takes advantage of the desire of many organizations, and technical groups in particular, to allow their users to be ‘self-sufficient’ when it comes to tooling and package managers. In addition, the use of
steganography is unusual and something we do not see regularly.”

Source: The Hacker News