Hacking group hides backdoor malware inside Windows logo image.

Security researchers have discovered a malicious campaign by the 'Witchetty' hacking group, which uses steganography to hide a backdoor malware in a Windows logo.

Witchetty is believed to have close ties to the state-backed Chinese threat actor APT10 (aka 'Cicada'). The group is also considered part of the TA410 operatives, previously linked to attacks against U.S energy providers.

Symantec reports that the threat group is operating a new cyberespionage campaign launched in February 2022 that targeted two governments in the Middle East and a stock exchange in Africa and is still ongoing.

In this campaign, the hackers refreshed their toolkit to target different vulnerabilities and used steganography to hide their malicious payload from antivirus software.

Steganography is the act of hiding data within other non-secret, public information or computer files, such as an image, to evade detection. For example, a hacker can create a working image file that displays correctly on the computer but also includes malicious code that can be extracted from it.

In the campaign discovered by Symantec, Witchetty is using steganography to hide an XOR-encrypted backdoor malware in an old Windows logo bitmap image.

Windows logo hiding the payload (Symantec)

The file is hosted on a trusted cloud service instead of the threat actor's command and control (C2) server, so the chances of raising security alarms while fetching it are minimized.

"Disguising the payload in this fashion allowed the attackers to host it on a free, trusted service," Symantec explains in its report.

"Downloads from trusted hosts such as GitHub are far less likely to raise red flags than downloads from an attacker-controlled command-and-control (C&C) server."

The attack begins with the threat actors gaining initial access to a network by exploiting the Microsoft Exchange ProxyShell (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) and ProxyLogon (CVE-2021-26855 and CVE-2021-27065) attack chains to drop webshells on vulnerable servers.

Next, the threat actors fetch the backdoor hiding in the image file, which enables them to do the following:

• Perform file and directory actions
• Start, enumerate, or kill processes
• Modify the Windows Registry
• Download additional payloads
• Exfiltrate files

Witchetty also introduced a custom proxy utility that causes the infected computer to act "as the server and connects to a C&C server acting as a client, instead of the other way around."

Other tools include a custom port scanner and a custom persistence utility that adds itself in the registry as "NVIDIA display core component."

Along with the custom tools, Witchetty uses standard utilities like Mimikatzand to dump credentials from LSASS and abuses "lolbins" on the host, like CMD, WMIC, and PowerShell.

TA410 and Witchetty remain active threats to governments and state organizations in Asia, Africa, and around the globe. The best way to prevent its attacks is to apply security updates as they are released.

In the campaign discovered by Symantec, the hackers rely on exploiting last year's vulnerabilities to breach the target network, taking advantage of the poor administration of publicly exposed servers.