Malware researchers at FireEye discovered a new sophisticated second-stage backdoor, dubbed Sunshuttle, while analyzing the servers of an organization that was compromised as a result of the SolarWinds supply-chain attack.
The new malware is dubbed Sunshuttle, and it was “uploaded by a U.S.-based entity to a public malware repository in August 2020.”
“Mandiant Threat Intelligence discovered a sample of the SUNSHUTTLE backdoor uploaded to an online multi-Antivirus scan service.” reads the analysis published by Fireeye. “SUNSHUTTLE is a backdoor, written in GO, that reads an embedded or local configuration file, communicates with its C2 server over HTTPS and supports commands including remotely updating its configuration, file upload and download, and arbitrary command execution.”
The SUNSHUTTLE backdoor was likely developed to conduct network reconnaissance alongside other SUNBURST-related tools.
Mandiant researchers discovered the SUNSHUTTLE backdoor on a system of a victim compromised by UNC2452, and believe that it is linked to this threat actor.
Experts pointed out that the SUNSHUTTLE malware was not observed using any trick to gain persistence, this means that the persistence is likely set outside of the execution of this backdoor.
The SUNSHUTTLE backdoor communicates with C2 servers passing it the values in the cookie header.
“SUNSHUTTLE uses the cookie header to pass values to the C2.” continues FireEye. “Additionally, a referrer is selected from the following list, presumably to make the traffic blend in if traffic is being decrypted for inspection:
The cookie headers vary slightly depending on the operation being performed.”
Technical details and Indicators of compromise(IoCs) for this backdoor are included in the report published by FireEye.
If you want to receive the weekly Security Affairs Newsletter for free subscribe here.
(SecurityAffairs – hacking, SolarWinds)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.