Lotus Blossom - CraftedSignal Threat Feed

TinyCC Masquerading as Svchost for Shellcode Execution

hello@craftedsignal.io — Tue, 09 Jan 2024 12:00:00 +0000

The Lotus Blossom threat actor has been observed using a technique involving the Tiny C Compiler (TinyCC) to execute shellcode on compromised systems. This technique involves renaming the legitimate tcc.exe binary to svchost.exe to masquerade as a legitimate Windows process. The renamed compiler is then used to compile and execute C source files containing malicious shellcode. A key aspect of this attack is the use of the -nostdlib and -run flags when invoking the renamed tcc.exe. This behavior was specifically observed in the Chrysalis backdoor campaign, where the attackers executed conf.c containing Metasploit block_api shellcode. This technique allows attackers to bypass traditional security measures by leveraging a legitimate tool in an unexpected way and from unusual locations. The ability of TinyCC to compile and execute code on-the-fly makes it an attractive tool for attackers seeking to evade detection.

Attack Chain

The attacker gains initial access to the system (details not specified in source).
The attacker drops the Tiny C Compiler (tcc.exe) onto the compromised system, typically in a user-writable directory like AppData or Temp.
The attacker renames tcc.exe to svchost.exe to masquerade as a legitimate Windows process. This helps evade detection based on process names.
The attacker drops a C source file (e.g., conf.c) containing malicious shellcode onto the system.
The attacker executes the renamed svchost.exe (originally tcc.exe) to compile and execute the C source file containing the shellcode. The command line includes the flags -nostdlib and -run.
The shellcode executes, performing malicious actions such as establishing a reverse shell, downloading additional payloads, or injecting into other processes.
The attacker uses the established foothold to move laterally within the network.
The attacker achieves their final objective, which could include data exfiltration, deploying ransomware, or establishing persistent access.

Impact

Successful exploitation allows attackers to execute arbitrary code on the compromised system. This can lead to data theft, system compromise, and further propagation within the network. The Lotus Blossom group has used this technique to install the Chrysalis backdoor. The number of victims and the sectors targeted by this specific campaign are not detailed in the provided source, but the technique is a significant threat to organizations due to its potential for stealth and impact.

Recommendation

Enable Sysmon process-creation logging (Event ID 1) and ensure command-line arguments are captured, to enable the rules above.
Deploy the Sigma rules in this brief to your SIEM and tune for your environment.
Monitor for processes named svchost.exe that are not located in the standard Windows system directories (C:\\Windows\\System32\\ or C:\\Windows\\SysWOW64\\), as these are indicative of the renamed TinyCC binary based on the provided data and the detection logic.
Investigate any svchost.exe or tcc.exe processes executing with the -nostdlib and -run flags, especially when compiling .c files, using the detection logic in the Sigma rule.
Implement application control policies to restrict the execution of binaries from user-writable directories, mitigating the initial execution of the renamed compiler.

Suspicious Bluetooth Service Installation from Uncommon Location

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This threat brief focuses on the anomalous installation of a Windows service named "BluetoothService" from user-writable directories. The Lotus Blossom group used this technique in their Chrysalis backdoor campaign, creating a service that pointed to a malicious binary disguised as the Bitdefender Submission Wizard, located within a hidden AppData directory. This method bypasses standard security measures by mimicking legitimate service installation procedures but placing the malicious service executable in an unexpected location. Legitimate Bluetooth services in Windows are system services with binaries located in System32, making user-directory installations highly suspicious. Monitoring for this activity can help identify potential malware persistence mechanisms. This technique is used for persistence and defense evasion.

Attack Chain

The attacker gains initial access to the system (potentially through phishing or exploiting a vulnerability).
The attacker drops a malicious executable, masquerading as a legitimate application (e.g., renaming a binary to resemble a Bitdefender tool).
The attacker creates a new Windows service named "BluetoothService" (or "Bluetooth Service").
The "ImagePath" of this service is set to point to the malicious executable located in a user-writable directory (e.g., %AppData%, %ProgramData%, %Temp%, or a user-specific Bluetooth folder).
The service is configured to start automatically, ensuring persistence across reboots.
When the system starts, the malicious "BluetoothService" executes the attacker's code.
The attacker leverages the service to establish a backdoor for remote access and control.
The attacker performs further malicious activities, such as data exfiltration or lateral movement.

Impact

Successful exploitation allows attackers to establish persistence on the compromised system, enabling them to maintain unauthorized access even after reboots. This can lead to data theft, system compromise, and further propagation of the attack within the network. The Lotus Blossom group has historically targeted organizations in the aerospace, defense, and high-tech sectors, and similar campaigns could result in significant intellectual property loss and reputational damage.

Recommendation

Monitor Windows Event Log (Event ID 7045) for service creation events, focusing on services named "BluetoothService" or "Bluetooth Service" (data_source).
Implement the provided Sigma rule to detect the creation of "BluetoothService" with an "ImagePath" pointing to user-writable directories (%AppData%, %ProgramData%, %Temp%, %Users%*\Bluetooth) (rules).
Investigate any instances of "BluetoothService" being created from unusual locations, comparing the binary against known good software (rules).
Review and harden endpoint security configurations to prevent unauthorized service creation in user-writable directories (T1543.003).
Educate users about the risks of running executables from untrusted sources and the dangers of social engineering tactics (T1036).

Rundll32 Execution with Log.DLL

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This threat brief focuses on the abuse of rundll32.exe to execute malicious DLLs, specifically log.dll, a technique associated with the Lotus Blossom group's Chrysalis backdoor. The attacker places a rogue log.dll in a location such as %AppData%\Bluetooth and leverages rundll32.exe to invoke a specific function within the DLL (e.g., LogInit). This execution decrypts and runs shellcode. While some legitimate applications like the Bitdefender Submission Wizard also use log.dll, they are susceptible to DLL sideloading attacks, making this detection crucial for identifying malicious activity that bypasses traditional defenses. This campaign was first reported in 2026 and continues to be a relevant threat.

Attack Chain

The attacker gains initial access, often through social engineering or exploiting software vulnerabilities (not specified in source).
A malicious log.dll is placed in a writable directory, such as %AppData%\Bluetooth, mimicking a legitimate DLL location.
The attacker uses rundll32.exe to execute the malicious log.dll with a specific function call (e.g., rundll32.exe log.dll,LogInit).
Rundll32.exe loads and executes the log.dll.
The LogInit function in log.dll decrypts embedded shellcode.
The shellcode is injected into a legitimate process or executed directly, establishing persistence or escalating privileges.
The injected shellcode connects to a command-and-control (C2) server to download additional payloads or receive instructions.
The attacker performs actions on the compromised system, such as data exfiltration, lateral movement, or installing additional malware.

Impact

Successful exploitation can lead to complete system compromise, data theft, and the installation of persistent backdoors. The Lotus Blossom group has been known to target organizations across various sectors. The ability to bypass traditional security measures through DLL sideloading makes this a high-impact threat. Even legitimate software can become an attack vector.

Recommendation

Deploy the Sigma rule Rundll32 Execution with Log.DLL to detect malicious rundll32.exe executions using log.dll (logsource: process_creation).
Investigate any rundll32.exe process executions with log.dll as a command-line argument, especially when originating from unusual paths (Sigma rule Rundll32 Execution with Log.DLL).
Monitor for suspicious file creations or modifications in %AppData%\Bluetooth or other common DLL sideloading locations (logsource: file_event).
Implement application control policies to restrict the execution of rundll32.exe from untrusted locations.
Audit systems for DLL sideloading vulnerabilities in legitimate applications.

Bitdefender Submission Wizard DLL Sideloading

hello@craftedsignal.io — Tue, 02 Jan 2024 10:00:00 +0000

This threat brief addresses the potential DLL side-loading attack targeting Bitdefender Submission Wizard (BDSubmit.exe, bdsw.exe, or renamed BluetoothService.exe). The attack involves a malicious actor placing a rogue log.dll in a directory where the legitimate Bitdefender executable will load it, thus executing attacker-controlled code. This technique is associated with the Lotus Blossom group (G0065). The observed activity relies on exploiting the DLL search order to execute arbitrary code. Defenders should monitor for instances of BDSubmit.exe, bdsw.exe, or BluetoothService.exe loading log.dll from unexpected paths outside of standard installation directories such as "Program Files" or "Windows\System32".

Attack Chain

The attacker gains initial access to the system (method unspecified in source).
The attacker identifies a vulnerable executable, such as BDSubmit.exe or bdsw.exe.
The attacker crafts a malicious log.dll.
The attacker places the malicious log.dll in the same directory as the Bitdefender executable, or in a directory that takes precedence in the DLL search order.
A user executes the legitimate Bitdefender Submission Wizard executable (BDSubmit.exe, bdsw.exe, or renamed BluetoothService.exe).
The legitimate application attempts to load log.dll. Due to DLL side-loading, the malicious log.dll is loaded instead of the legitimate one.
The malicious log.dll executes attacker-controlled code within the context of the Bitdefender Submission Wizard process.
The attacker achieves code execution for persistence or privilege escalation.

Impact

Successful exploitation through DLL side-loading allows attackers to execute arbitrary code within a trusted process. This can lead to privilege escalation, persistence, and potentially complete system compromise. Specific impacts include unauthorized access to sensitive data, installation of malware, and lateral movement within the network. The Lotus Blossom group has been known to use similar techniques to deploy backdoors.

Recommendation

Enable Sysmon ImageLoad events (EventCode 7) to monitor DLL loading activity and ensure the Splunk Add-on for Sysmon is configured to parse them as described in the "how_to_implement" section.
Deploy the Sigma rule "Bitdefender Submission Wizard DLL Sideloading" to detect instances where log.dll is loaded from a non-standard path, and tune for your environment.
Investigate any alerts generated by the provided detection rule, focusing on the "dest" and "User" fields as described in the "drilldown_searches" section.
Monitor for the execution of BDSubmit.exe, bdsw.exe, or BluetoothService.exe from unusual locations or with unusual command-line arguments.
Review and harden DLL search order configurations to prevent side-loading attacks (T1574.002).