By 
A new malware family, named Cuttlefish, was discovered which targets enterprise-grade and small office/home office (SOHO) routers to harvest public cloud authentication data from internet traffic.
The malware creates a proxy or VPN tunnel on the compromised router to exfiltrate data, and then uses stolen credentials to access targeted resources.
Cuttlefish has a modular structure which was designed to primarily steal authentication data from web requests passing through the router from the local area network (LAN). The malicious code can also perform DNS and HTTP hijacking within private IP spaces. Additionally, it can interact with other devices on the LAN and transfer data or deploy new agents.
The researchers at Lumen’s Black Lotus Labs observed similarities in code and build paths with a previously reported malware called HiatusRat, linked to China. However even there is code overlap, no shared victimology has been observed, suggesting that these malware families operate concurrently.
The malware has been active since at least July 2023 with the recent campaign spanned from October 2023 to April 2024. The experts noticed that the infection chain was distinct, with 99% of infections originating in Turkey, primarily from two major telecommunications providers. These providers comprised around 93% of infections, totaling 600 unique IP addresses. Other non-Turkish victims included IP addresses likely belonging to clients of global satellite phone providers and a potential US-based data center.
The malware passively monitors network packets for “credential markers,” including usernames, passwords, and authentication tokens. Cuttlefish primarily targets public cloud-based services such as Alicloud, AWS, Digital Ocean, CloudFlare, and BitBucket.
The Black Lotus Labs report highlights that targeted services are used for storing sensitive data. This approach enables threat actors to potentially copy data from cloud resources lacking the logging or controls commonly present in traditional network perimeters.
The malware stores the stolen data in the log, then when the log file of filtered traffic reaches a specified size, Cuttlefish compresses it using gzip and uploads it to the C2 server using a computed uuid and a predefined value of “tid”.
Cuttlefish redirects DNS requests for private IP addresses to a specified DNS server and manipulates HTTP requests to reroute traffic to an infrastructure under the control of its operators using HTTP 302 error codes. This capability suggests that Cuttlefish can hijack internal or site-to-site traffic, enabling access to secured resources not exposed on the Internet.
