Summary Points
- Threat actors use CLSID hijacking combined with NGEN scans to stealthily restore their MucorAgent backdoor with high privilege SYSTEM account access, a unique and unprecedented persistence method.
- The attackers also deployed legitimate remote monitoring tools like Remote Utilities, exploiting them for long-term access, a tactic now common among APT and cybercrime groups.
- The campaign demonstrated a highly adaptable threat using a mix of publicly available, open-source, and customized tools, prioritizing stealth and flexibility over novel exploits.
- This approach underscores a strategic focus on maintaining persistent, hard-to-detect access within targeted systems through innovative abuse of legitimate Windows components.
What’s the Problem?
The story reports a sophisticated cyberattack carried out by a highly adaptable threat group, which exploited advanced methods to maintain persistent access to targeted systems. The attackers hijacked a specific component called CLSID through an innovative technique involving NGEN (Native Image Generator) scans, allowing them to restore their malicious MucorAgent backdoor covertly and under the highly privileged SYSTEM account—an unprecedented method that enhances stealth and survivability. Additionally, they deployed legitimate remote management tools, such as Remote Utilities, to facilitate ongoing control over compromised networks. The attackers relied heavily on publicly available tools, open-source resources, and living-off-the-land binaries (LOLBins) to avoid detection, indicating a strategic preference for stealth over exploiting new vulnerabilities.
The attack was reported by cybersecurity researchers observing this unusual combination of techniques, which points to a persistent threat actor aiming for long-term access to their targets’ environments. These threat actors, likely motivated by espionage or cybercrime goals, targeted organizations where they could operate undetected for extended periods. The report emphasizes the innovative nature of their tactics, especially the use of CLSID hijacking with NGEN, which allowed them to evade traditional security measures and maintain stealthy control over compromised systems for as long as necessary.
What’s at Stake?
Cyber risks pose significant threats to organizations by enabling persistent adversaries to infiltrate and maintain long-term access within targeted networks. Recent findings reveal sophisticated techniques such as CLSID hijacking combined with NGEN optimization scans, allowing threat actors to stealthily restore backdoors like MucorAgent under the guise of privileged SYSTEM account actions—an unprecedented method that enhances their resilience. Additionally, the deployment of legitimate remote management tools, such as Remote Utilities, enables attackers to blend malicious activity with authorized operations, making detection challenging. These threat actors employ a diverse arsenal of publicly available tools, open-source resources, and Living Off the Land Binaries (LOLBins), emphasizing stealth and adaptability over exploiting novel vulnerabilities. The overall impact of these tactics results in highly covert, adaptable, and long-lasting breaches that threaten critical data integrity, operational continuity, and organizational security posture.
Possible Remediation Steps
Timely remediation is crucial when dealing with sophisticated adversaries like the Russian APT group Curly COMrades, especially given their use of advanced backdoor and persistence techniques. Prompt action can prevent extensive unauthorized access, data exfiltration, and long-term infrastructural damage, ultimately safeguarding sensitive information and maintaining operational integrity.
Detection and Analysis
- Conduct thorough threat hunting to identify indicators of compromise (IOCs).
- Utilize advanced threat intelligence tools to understand the group’s tactics, techniques, and procedures (TTPs).
Containment Measures
- Isolate affected systems immediately to halt lateral movement.
- Disable suspected backdoors and remove persistence mechanisms identified.
Eradication and Cleaning
- Apply targeted malware removal and system cleanup procedures.
- Reimage compromised devices if necessary to ensure complete removal.
Patch and Harden
- Update all systems and software to close vulnerabilities exploited by the group.
- Strengthen security configurations, including disabling unused services and applying least privilege principles.
Monitoring and Prevention
- Implement continuous monitoring for unusual activity to catch future threats early.
- Deploy threat detection solutions with behavior-based analytics to identify novel attack patterns.
Post-Incident Review
- Document every step of response efforts to improve future resilience.
- Conduct training to raise awareness among staff on emerging threat tactics from groups like Curly COMrades.
Continue Your Cyber Journey
Stay informed on the latest Threat Intelligence and Cyberattacks.
Access world-class cyber research and guidance from IEEE.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
