Researchers have disclosed a new attack framework named Manjusaka used in the wild that can be deployed as an alternative to the widely abused Cobalt Strike toolset or parallel to it for redundancy.
Manjusaka uses implants written in the cross-platform Rust programming language, while its binaries are written in the GoLang.
Its Remote access trojan implants support command execution, file access, network reconnaissance, and more, so hackers can use it for the same operational goals as Cobalt Strike.
The security researchers at Cisco Talos discovered Manjusaka, who were called to investigate a Cobalt Strike infection on a customer, so the threat actors used both frameworks here.
The infection came via a malicious document masquerading as a report about a COVID-19 case in Golmud City in Tibet for contact tracing. The document featured a VBA macro that executes through rundll32.exe to fetch a second-stage payload, Cobalt Strike, and load it in memory.
Instead of using Cobalt Strike alone as their primary attack toolkit, the hackers used it to download Manjusaka implants, which depending on the host’s architecture, can be either EXE (Windows) or ELF files (Linux).
Both Windows and Linux versions of the implant feature almost the same capabilities and implement similar communication mechanisms. The implants comprise a RAT and a file management module having distinct capabilities.
The RAT supports arbitrary command execution via “cmd.exe”, collects credentials stored in web browsers, WiFi SSID and passwords, and discovers network connections (TCP and UDP), account names, local groups, etc.
Moreover, it can steal Premiumsoft Navicat credentials, capture screenshots of the current desktop, list running processes, and even check hardware specs and thermals.
The file management module can perform file enumeration, create directories, obtain full file paths, read or write file contents, delete files or directories, and move files between locations.
As Manjusaka is deployed in the wild for testing, it is likely that its development is not in its final phases. But the new framework is already powerful enough for real-world use.
The lure document is written in Chinese, so is the malware’s C2 menus and configuration options, so its developers are assumed to be based in China.
It is expected to see Manjusaka deployed in the campaigns of multiple Chinese APTs soon, as threat groups from the country usually share a common toolset.
Threat actors are expected to move away from Cobalt Strike gradually, and many alternative attack frameworks are likely to appear.
Image Credits : Fealse
Comments