Security analysts at AhnLab Security Emergency Response Center have detected a new hacking campaign that takes advantage of Windows BYOVD attacks to disable security software and deploy the post-exploitation toolkit Sliver. Sliver is an alternative to Cobalt Strike created by Bishop Fox and has been used by malicious actors for some time. It can be used to open reverse shells on compromised devices, install payloads, and execute commands with kernel-level privileges. The campaign was targeting two 2022 vulnerabilities in Sunlogin, a remote control software developed by Chinese developers. The attackers used PoC exploits available on the internet to exploit these vulnerabilities. The malicious code was loaded into memory and a portable executable was decoded. Mhyprot2DrvControl, an open-source tool, was used to gain access to the Windows kernel privileges and terminate security processes. Powercat was then downloaded from an external source and a reverse shell was created to connect to the C2 server. In some cases, the Sliver implant was installed on the system. Microsoft has recommended a few mitigations to protect against these attacks.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 08 Feb 2023 07:43:02 +0000