Eagerbee Backdoor Strikes Middle Eastern Government Entities and ISPs

Cybersecurity experts have identified new variants of the Eagerbee backdoor, a sophisticated malware targeting government organizations and Internet Service Providers (ISPs) in the Middle East. Researchers from Kaspersky unveiled the malware’s enhanced capabilities, highlighting its advanced features and potential ties to the CoughingDown threat group.

The new Eagerbee backdoor variants come equipped with additional components to enhance their stealth and operational efficiency:

1. Service Injector: Deploys the backdoor by targeting the Themes service, injecting the malware into memory alongside stub code to decompress and execute it.
2. Plugins for Advanced Capabilities: These include payload delivery, file and system access, process management, and remote control.

How the Backdoor Operates

The deployment process involves:

• Initial Access: The exact method remains unknown, but attackers used an injector (tsvipsrv.dll) and payload (ntusers0.dat) deployed via the SessionEnv service.
• Memory Injection: The backdoor is decompressed and executed in memory, avoiding detection. Cleanup operations restore the original system state.
• System Reconnaissance: The malware gathers extensive system information, including NetBIOS name, OS details, processor architecture, and IP addresses.

Malware Capabilities

The backdoor is highly configurable, with settings stored in files or hardcoded within its binary. Key functionalities include:

• Command and Control (C2) Communication: Using decoded configuration data, the backdoor retrieves proxy settings, establishes a secure TCP connection, and transmits system data to the C2 server.
• Plugin-Based Architecture:
  • File Manager: Handles file system operations, injects additional payloads, and executes commands.
  • Process Manager: Controls system processes and executes commands within user security contexts.
  • Remote Access Manager: Enables RDP sessions and injects command shells into legitimate processes.
  • Service Manager: Manages and controls system services.
  • Network Manager: Monitors active network connections.

Observed Deployment Methods

• ProxyLogon Vulnerability Exploitation: The backdoor was deployed in some organizations through the ProxyLogon vulnerability (CVE-2021-26855) in Microsoft Exchange servers.
• Web Shell Usage: Attackers utilized web shells to execute commands on breached servers and establish persistence.

Potential Links to the CoughingDown Threat Group

Kaspersky’s analysis indicates overlaps between Eagerbee’s C2 domains and those associated with the CoughingDown Core Module, suggesting a possible connection. The consistent use of the same web shell to deploy the Eagerbee backdoor and related tools strengthens this assessment.

Implications and Recommendations

The Eagerbee backdoor demonstrates the increasing sophistication of targeted cyber threats in the Middle East. To mitigate risks, organizations are urged to:

• Regularly patch vulnerabilities, such as ProxyLogon, in critical systems.
• Monitor network activity for unusual connections or behavior.
• Implement robust access controls and endpoint protection measures.

This attack underscores the need for heightened vigilance and proactive security measures to counter advanced persistent threats (APTs) in critical sectors.