Hackers exploit reverse TCP shells on Linux or Unix systems to gain unauthorized remote access.
Cybersecurity researchers at PwC recently discovered a reverse TCP shell for Linux or Unix systems with C2 capabilities while analyzing one of the malware of Teal Kurma dubbed 'SnappyTCP'.
The three years Teal Kurma was initially tracked three years ago, and it primarily focuses on the targets throughout:-.
Since 2017, Teal Kurma has been exploiting vulnerabilities, especially CVEs like-.
With basic C2 capabilities and persistence functions, the Webshell is a Linux/Unix reverse TCP shell.
Php since July 2021, linked to 2022 Greek CERT alert, suggesting sustained use.
Recent infrastructure in 2023 linked to SnappyTCP via CERT alert indicators.
Using OpenSSL and TLS certificates for a secure link, the malware, in other cases, connects to an IP from the conf file, and then it sends:-.
Similar to past instances, it spawns a pthread calling bash to execute a different file, 'update,' not 'kdd launch':-.
GLIBC is statically linked, enabling self-contained operation without linking to the target machine's library files.
Besides this, the execution methods vary, resulting in either a shared object file or an executable.
The ELF files lack compile dates, as it helps in hiding the linking variations in toolchain usage to malware evolution.
The GitHub repository reveals Teal Kurma's reverse TCP shell mirroring public code, with 'update' replacing 'connector.
' Other samples in the repository establish reverse shells, possibly tied to Teal Kurma's activity.
The analyzed samples pivoted on SnappyTCP GET requests and used Sea Turtle reporting for the Teal Kurma infrastructure hunt.
Explored CERT infrastructure and found active links:-.
Uncovered TLS certificates tied to Media and NGO sectors, targeting the Middle East, using the reverse shell for espionage.
Threat actors aim for surveillance or traditional intelligence, with NGO and media sectors also targeted.
TLS certificates indicate the Middle East and North Africa focus; SnappyTCP is likely in European countries.
Targeting details aids attribution and provides insights for organizations in similar regions or sectors.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 07 Dec 2023 14:20:10 +0000