Meanwhile, researchers at SecurityScorecard say the “fileless” malware loader in the attack – Teardrop – actually dates back to 2017.
Organisationen, die untersuchen, ob sie Opfer der sogenannten SolarWinds-Angriffskampagne sind oder noch immer davon infiziert sind, haben jetzt Zugriff auf ein kostenloses Toolkit, mit dem Microsoft die Malware in seinem eigenen Code ausrottet.
Microsoft is offering the CodeQL queries it employed to analyze its source code in the wake of the SolarWinds breach discovery. CodeQL is a tool in GitHub’s Advanced Security toolset; the queries Microsoft used with CodeQL root out code that contains similarities in patterns and functions to the SolarWinds binary. These queries can be used on any software for signs of the SolarWinds attack campaign.
And in a separate SolarWinds development, security researchers at SecurityScorecard say they have discovered that one piece of malware used in the SolarWinds attacks — the memory-only dropper dubbed Teardrop that profiled the victim’s network and systems environments — dates back to 2017 and appears to be associated with a single Russian cyber-espionage group.
Dies deutet darauf hin, dass Teardrop wahrscheinlich bei anderen APT-Operationen vor SolarWinds von diesem nationalstaatlichen Hackerteam eingesetzt wurde, sagt Ryan Sherstobitoff, Vizepräsident für Cyberthreat Research and Intelligence bei SecurityScorecard, und weist auf den früheren Zeitrahmen hin, der mit der Malware in Zusammenhang steht.
Teardrop, das von FireEye in seiner Analyse der Malware benannt wurde, wurde zum Ausführen von Cobalt Strike BEACON verwendet, einem Command-and-Control-Tool (C2) im Open-Source-Toolkit Cobalt Strike, das die Angreifer verwendeten – höchstwahrscheinlich zur Tarnung ihre Tätigkeit.
FireEye zuerst ging im Dezember an die Börse about the attack it had suffered at the hands of a malicious software update to its SolarWinds Orion software, and that its red-team tools had been stolen in the attack. FireEye initially described Teardrop — a dynamic link library (DLL) file payload delivered via the Sunburst Trojan (the first-stage malware in the attack) — as a piece of malware that didn’t match any it had seen before.
“TEARDROP does not have code overlap with any previously seen malware,” FireEye wrote in its detailed Bericht im Dezember auf der SolarWinds-Malware.
But Sherstobitoff says the C2 telemetry his team found shows that Teardrop was not necessarily built solely for the SolarWinds attacks, which were triggered in 2020 but test-run in October 2019. “It pushes a lot of timelines much earlier than what people suspected,” he says.
His team also confirms that the attacker behind SolarWinds is a single APT group out of Russia, targeting US organizations. Like other security vendors, SecurityScorecard won’t name names, but experts surmise it’s the handiwork of the Russian SVR and its hacking team known as Cozy Bear.
Some 95% of victim organizations are in the US, the researchers found, and they reiterate that it’s most likely a cyber-espionage campaign as most experts believe. Even so, Sherstobitoff says because Teardrop opens a backdoor into the victim organization, the fear is that it could be used to drop other more destructive payloads. Teardrop itself was used mainly to “fingerprint” and profile the victim’s systems and networks.
“The challenge is, are there third- or fourth-stage implants we don’t know about? They may be highly custom,” he says.
CodeQL
Meantime, Microsoft’s release of its CodeQL queries today could help root out attack code that could be deeply embedded in a victim’s network.
“Anything that’s able to look for behaviors or host-level artifacts will help [find] out if there are compromises from Teardrop or Sunburst because the command-and-control at this point is most likely offline,” notes Sherstobitoff.
Sagte Microsoft die Open-Source-Version ist ein Versuch, seine Erkenntnisse über den Malware-Angriff, den es Solorigate nennt, zu teilen.
“With the increasing sophistication of attacks like Solorigate, it’s more important than ever for the security community to work together in transparency to share learnings where possible. Since these attacks were detected, we’ve worked closely behind the scenes with the security community and have published dozens of technische Updates und Tools to empower defenders,” a Microsoft spokesperson said. “The open sourcing of CodeQL queries is another example of how sharing techniques that Microsoft has found useful can give defenders the edge they need to help protect against sophisticated attacks.”
Kelly Jackson Higgins ist der Executive Editor von Dark Reading. Sie ist eine preisgekrönte erfahrene Technologie- und Wirtschaftsjournalistin mit mehr als zwei Jahrzehnten Erfahrung in der Berichterstattung und Bearbeitung für verschiedene Veröffentlichungen, darunter Network Computing, Secure Enterprise… Vollständige Biographie anzeigen
Empfohlene Lektüre:
Weitere Einblicke
