Microsoft Reveals 3 New Malware Strains Used By SolarWinds Hackers

Microsoft has revealed information on newly found malware the SolarWinds hackers deployed on victims’ networks as second-stage payloads.

The company now tracks the “sophisticated attacker” who used the Sunburst backdoor and Teardrop malware during the SolarWinds supply-chain attack as Nobelium.

Security researchers with the Microsoft Threat Intelligence Center (MSTIC) and the Microsoft 365 Defender Research Team found three new malware strains named GoldMax, Sibot, and GoldFinder.

The Nobelium hackers used these malware strains during late-stage activity between August and September 2020. Still, it is believed that Nobelium dropped them on compromised SolarWinds customers’ systems as early as June 2020.

“Microsoft assesses that the newly surfaced pieces of malware were used by the actor to maintain persistence and perform actions on very specific and targeted networks post-compromise, even evading initial detection during incident response,” the company said.

“They are tailor-made for specific networks and are assessed to be introduced after the actor has gained access through compromised credentials or the SolarWinds binary and after moving laterally with TEARDROP and other hands-on-keyboard actions.”

Also Read: How To Make A PDPC Complaint: With Its Importance And Impact

According to Microsoft, these malware strains come with the following capabilities:

• GoldMax: Go-based malware used as a command-and-control backdoor for hiding malicious activity and evading detection. It also has a decoy network traffic generator for concealing malicious network traffic with seemingly benign traffic.
• Sibot: VBScript-based malware used for maintaining persistence and downloading additional malware payloads using a second-stage script
• GoldFinder: Go-based malware “most likely” used as a custom HTTP tracer tool for detecting servers and redirectors like network security devices between the infected devices and C2 server.

Earlier today, FireEye also shared information on another new second-stage backdoor discovered on the servers of an organization compromised by the SolarWinds hackers.

FireEye researchers believe the new malware dubbed Sunshuttle is linked to the SolarWinds hackers tracked as UNC2452 (FireEye), StellarParticle (CrowdStrike), SolarStorm (Palo Alto Unit 42), Dark Halo (Volexity), and now Nobelium (Microsoft).

While Microsoft and FireEye made no connections between the malware they revealed today, Sunshuttle and GoldMax seem to designate the same malware strain based on a C2 domain they share and their capability to hide C2 traffic.

Also Read: Deemed Consent PDPA: How Do Businesses Comply?

“These capabilities differ from previously known NOBELIUM tools and attack patterns, and reiterate the actor’s sophistication,” Microsoft said.

“In all stages of the attack, the actor demonstrated a deep knowledge of software tools, deployments, security software and systems common in networks, and techniques frequently used by incident response teams.”

Microsoft also said last month that the SolarWinds hackers downloaded source code for a limited number of Azure, Intune, and Exchange components.

On Monday, SolarWinds revealed expenses of roughly $3.5 million through December 2020 from last year’s supply-chain attack. High additional costs are expected throughout the next financial periods.