BRONZE SANDCASTLE distribuisce shell Meterpreter modificate

BRONZE SANDCASTLE Meterpreter blog feature image

Threat Research BRONZE SANDCASTLE Meterpreter Sandboxie

I ricercatori della Counter Threat Unit™ (CTU) e di SophosLabs hanno analizzato un gruppo di incidenti attribuiti al gruppo hacker BRONZE SANDCASTLE.

L’indicatore tecnico più caratteristico di BRONZE SANDCASTLE è l’utilizzo sistematico del DLL sideloading di Sandboxie

Dettagli sul DLL sideloading

Negli ambienti di diverse vittime, gli eseguibili legittimi di Sandboxie sono stati collocati nella stessa directory di un file dannoso denominato sbiedll.dll. In questo modo, l’applicazione considerata attendibile veniva indotta a caricare, durante l’esecuzione, codice controllato dall’attaccante.

Questo schema ricorrente costituisce una sorta di firma distintiva del gruppo, sebbene gli attaccanti utilizzino anche diverse altre combinazioni di file per il sideloading.

Leggi tutto l’articolo: https://www.sophos.com/en-us/blog/bronze-sandcastle-deploys-modified-meterpreter-shells

Informazioni sull'autore

Sophos Counter Threat Unit Research Team

Sophos Counter Threat Unit™ (CTU) researchers are recognized authorities in the cybersecurity field, regularly contributing expert analysis to global media, publishing technical analyses for the security community, and presenting about emerging threats at leading security conferences. Backed by Sophos’ advanced security technologies and a broad network of intelligence contacts and partners, the CTU™ plays a critical role in identifying and tracking threat actors and analyzing anomalous activity, uncovering new attack techniques, threats, and major shifts in the threat landscape.

Gabor Szappanos

Gabor graduated from the Eotvos Lorand University of Budapest with a degree in physics. His first job was in the Computer and Automation Research Institute, developing diagnostic software and hardware for nuclear power plants. He started antivirus work in 1995, and began developing freeware antivirus solutions in his spare time. Gabor joined VirusBuster in 2001 where he was responsible for taking care of macro virus and script malware and became head of the virus lab in 2002. In 2008 he became a member of the Board of Directors in AMTSO (Anti Malware Testing Standards Organization) and, in 2012, joined Sophos as a Principal Malware Researcher.