The Chinese language Winnti hacking group is utilizing a brand new PHP backdoor named ‘Glutton’ in assaults on organizations in China and the U.S., and in addition in assaults on different cybercriminals.
Chinese language safety agency QAX’s XLab found the brand new PHP malware in late April 2024, however proof of its deployment, together with different information, dates again to December 2023.
XLab feedback that, whereas Glutton is a sophisticated backdoor, it has notable weaknesses in stealth and encryption, which could be a sign that it is in an early improvement part.
Winnti, also referred to as APT41, is a infamous Chinese language state-sponsored hacking group identified for cyberespionage and monetary theft campaigns.
Since its look on the scene in 2012, the group has focused organizations within the gaming, prescribed drugs, and telecommunications industries, whereas it has additionally attacked political organizations and authorities companies.
New Glutton backdoor
Glutton is an ELF-based modular backdoor that gives flexibility and stealth to the Winnti hackers, permitting them to activate particular parts for tailor-made assaults.
Its core parts are ‘task_loader,’ which determines the surroundings; ‘init_task,’ which installs the backdoor; ‘client_loader,’ which introduces obfuscation; and ‘client_task,’ which operates the PHP backdoor and communicates with the command-and-control (C2) server.
“These payloads are extremely modular, able to functioning independently or being executed sequentially through task_loader to type a complete assault framework,” explains XLab.
“All code execution happens inside PHP or PHP-FPM (FastCGI) processes, guaranteeing no file payloads are left behind, thus attaining a stealthy footprint.”
The backdoor, which masquerades as a ‘php-fpm’ course of, facilitates fileless execution by dynamic in-memory execution and injects malicious code (‘l0ader_shell’) into PHP information on ThinkPHP, Yii, Laravel, and Dedecms frameworks.
Glutton modifies system information like ‘/and so on/init.d/community’ to determine persistence between reboots and may also modify Baota panel information to take care of foothold and steal credentials and configurations.
Other than Baota, the malware may also exfiltrate system data and knowledge from the filesystem.
Supply: XLab
Glutton helps 22 instructions obtained from the C2 server, which order the next actions:
- Create, learn, write, delete, and modify information
- Execute shell instructions
- Consider PHP code
- Scan system directories
- Retrieve host metadata
- Swap between TCP and UDP connections
- Replace the C2 configuration
Concentrating on different cybercriminals
XLab says Winnti has deployed Glutton on targets in China and the USA, primarily concentrating on IT companies, social safety companies, and internet app builders.
Supply: XLab
Code injection is used towards well-liked PHP frameworks used for internet improvement, generally present in business-critical functions, together with ThinkPHP, Yii, Laravel, and Dedecms.
The Baota internet panel, a preferred server administration device in China, can be focused as it’s generally used to handle delicate knowledge, together with MySQL databases.
The menace actors are additionally actively utilizing Glutton to actively hunt different hackers, embedding it inside software program packages offered on cybercrime boards like Timibbs. These trojanized software program packages impersonate playing and gaming programs, pretend cryptocurrency exchanges, and click-farming platforms.
As soon as the cybercriminals’ programs are contaminated, Glutton deploys the ‘HackBrowserData’ device to extract delicate data from internet browsers, similar to passwords, cookies, bank cards, obtain historical past, and searching historical past.
“We hypothesize that HackBrowserData was deployed as a part of a “black eats black” technique,” explains XLabs.
“When cybercriminals try to regionally debug or modify backdoored enterprise programs, Glutton’s operators deploy HackBrowserData to steal high-value delicate data from the cybercriminals themselves. This creates a recursive assault chain, leveraging the attackers’ personal actions towards them.”
XLabs shared indicators of compromise associated to this Winnti marketing campaign, which has been underway for over a 12 months. Nevertheless, the preliminary entry vector stays unknown.