塔洛斯

2022年10月14日

思科的Talos安全研究人员警告说，一种新发现的攻击框架及其相关的远程访问木马(RAT)针对Windows、Linux和macOS系统。这种攻击框架被称为Alchimist，已经被广泛使用，它在GoLang中实现，与它植入受损系统的Insekt RAT相同。该攻击框架提供了一个用简体中文编写的web界面，允许操作人员生成和部署恶意有效载荷，建立远程连接，在受感染的机器上执行代码，并截屏。作为Alchimist活动的一部分，思科还发现了其他各种后利用工具，包括针对macOS的反向代理(frp)、自定义后门和其他各种现成的工具(如psexec、netcat和fscan)。思科还发现了一个Mach-O drop pper，其中包含针对CVE-2021-4034的漏洞，Polkit的Pkexec实用程序中的特权升级漏洞，以及Mach-O绑定shell后门。思科表示，Alchimist与最近发现的另一个自包含框架Manjusaka具有几乎相同的功能集，尽管实现不同，而且Alchimist使用的是不常见的协议SNI，而不是计划在Manjusaka中使用它。它们都被设计和实现为独立的基于golang的可执行文件，可以相对容易地分发给操作人员。里面的框架包含了植入和整个web用户界面。植入配置是使用Web UI (Web用户界面)定义的，这在两种情况下都是完全用简体中文编写的，”思科解释说。Alchimist将作为命令和控制(C&C)服务器的资源存储在基于golang的资产中，并允许用户生成针对Windows和Linux的PowerShell和wget代码片段。 When generating malicious payloads, users can provide parameters to specify the preferred protocol, C&C IP or URL, targeted operating system, whether the Insekt implant should run as a daemon, and predomain value for the SNI protocol. The C&C server, Cisco explains, does not compile new Insekt binaries. Instead, based on the provided parameters, the Insekt implant is hot-patched in memory and then dumped on disk, after which it is served to the operator. When initialized, the Insekt implant sets handlers for its seven main capabilities: get file size, fetch OS information, run commands via command prompt, upgrade the implant, run commands as a different user, sleep for specific periods of time, and take screenshots. The RAT also checks the system’s internet connectivity, supports shellcode execution, port IP scanning, proxy connections, and SSH manipulation, can list the ‘.ssh’ directory on Linux, and can execute arbitrary commands on the operating system’s shell. “Our discovery of Alchimist is yet another indication that threat actors are rapidly adopting off-the-shelf C&C frameworks to carry out their operations. […] The functionality of Manjusaka and Alchimist's web interfaces exhibiting remote administration capabilities, performed through the RATs, signifies the plethora of functionalities packed into these C&C frameworks,” Cisco concludes.