Winnti

APT41 Winnti ELF backdoor with near-maximum entropy connects to three typosquat domains.

APT41 exploits vulnerabilities in public-facing applications and deploys malware such as Winnti and ShadowPad to maintain persistence.

References include 'APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks,' ShadowPad reporting, and third-party compromise reporting involving Air India.

The modus operandi of this group was to compromise developer workstations that had access to source code repositories and then install backdoors and other malware into legitimate software.

The group has since earned infamy for being involved in malicious activities associated with targeted attacks, such as deploying spear-phishing campaigns and building a backdoor.

$uuid_lookup = "/usr/sbin/dmidecode | grep -i 'UUID' |cut -d' ' -f2 2>/dev/null"

The attack surface is obvious: the GOT is a writeable table of function pointers. If we overwrite the puts entry with our own address, every future call to puts in the victim will land in our code instead of libc.

The threat actors have also been known to deploy the Winnti malware and the China Chopper web shell...

The library used to hide Winnti’s system activity is a copy of the open-source userland rootkit Azazel, with minor changes. When executed, it will register symbols for multiple commonly used functions, including: open(), rmdir(), and unlink(), and modify their returns to hide the malware’s operations.

In some instances, Winnti operators wrote the names of their targets directly into the malware, obfuscated with a rolling XOR cipher.

Old tool we created and used to sniff and decrypt Winnti's traffic within networks after nearly a year to reverse this shit.

The attack surface is obvious: the GOT is a writeable table of function pointers. If we overwrite the puts entry with our own address, every future call to puts in the victim will land in our code instead of libc.

The group also engaged in the theft of digital certificates which they then used to sign their malware to make them stealthier.

Old tool we created and used to sniff and decrypt Winnti's traffic within networks after nearly a year to reverse this shit.

At the heart of this new Winnti backdoor is a focused cloud credential harvesting engine that systematically walks through each major provider’s metadata and credential storage mechanisms. On AWS, the implant queries the instance metadata endpoint at 169.254.169.254 to extract IAM role credentials, while also reading the standard ~/.aws/credentials file if it exists. On GCP, it requests service account tokens from the metadata server and checks for application default credentials, and on Azure it pulls managed identity tokens from the IMDS endpoint and scans ~/.azure profiles. For Alibaba Cloud, the malware targets ECS metadata to obtain RAM role credentials and inspects the local Alibaba CLI configuration files.

Harvests cloud instance metadata.

Kaspersky researchers uncovered that the digital signature used to sign the original Winnti malware was stolen from another video game vendor known as KOG... the Winnti group had used at least 18 stolen code-signing certificates in its campaigns

Inside the cloud network, the implant supports lateral movement by periodically sending UDP broadcast beacons to 255.255.255.255 on port 6006, allowing other compromised hosts to discover each other and share tasking without extra direct C2 traffic.

Old tool we created and used to sniff and decrypt Winnti's traffic within networks after nearly a year to reverse this shit.

This script identifies infected hosts by first sending a custom hello packet, immediately followed by an encoded request for host information, and then parsing the response.

When a winnti infection is found the script gathers basic host information by sending a query to the backdoor and printing the response.

In 2009, the Winnti group shifted to targeting gaming companies in South Korea using a self-named data- and file-stealing malware.

a feature of recent versions of Winnti we came across in the Linux variant (as well as Windows) that allows the operators to initiate a connection directly to an infected host, without requiring a connection to a control server. This secondary communication channel may be used by operators when access to the hard-coded control servers is disrupted.

For years, TAU has reversed and emulated the network Command and Control (C2) protocols of high-profile malware families... Continuing its research, TAU has discovered additional Winnti 4.0 C2 servers actively used over the last two years.

According to the Breakglass Intelligence report, the backdoor uses an unusual but effective command-and-control strategy built around SMTP traffic over port 25, rather than more common HTTPS-based channels. This choice allows the implant to disguise its C2 as email traffic... All collected secrets are encrypted using a hardcoded AES-256 key and staged locally prior to exfiltration through the SMTP-based C2 channel.

prior reporting suggests that the operators commonly deploy plugins for remote command execution, file exfiltration, and socks5 proxying on the infected host.

The driver component of Winnti (aka "NdisReroute") is able to reroute network traffic from ports that are already occupied by legit applications to the malware's userspace component. The first packet of a TCP stream signals the driver that the stream shall be rerouted.

References include 'Attacks on East Asia using Google Code for Command and Control' and 'Winnti Abuses GitHub for C&C Communications.'

This component is primarily designed to handle communications and the deployment of modules directly from the command-and-control servers.

The malware is a modularized Remote Access Trojan (RAT) supporting multiple C2 protocols.

The driver component of Winnti (aka "NdisReroute") is able to reroute network traffic from ports that are already occupied by legit applications to the malware's userspace component.

prior reporting suggests that the operators commonly deploy plugins for remote command execution, file exfiltration, and socks5 proxying on the infected host.

the Egregor operators stole unencrypted files from the company and leaked a 380MB archive on its darknet leak site