Hackers Exploit Vulnerabilities in Sunlogin to Deploy Sliver C2 Framework

Risk actors are leveraging identified flaws in Sunlogin computer software to deploy the Sliver command-and-handle (C2) framework for carrying out article-exploitation routines.

The findings arrive from AhnLab Security Crisis response Middle (ASEC), which discovered that security vulnerabilities in Sunlogin, a distant desktop method designed in China, are becoming abused to deploy a vast variety of payloads.

“Not only did danger actors use the Sliver backdoor, but they also made use of the BYOVD (Convey Your Personal Susceptible Driver) malware to incapacitate security goods and set up reverse shells,” the scientists claimed.

Attack chains begin with the exploitation of two distant code execution bugs in Sunlogin variations prior to v11…33 (CNVD-2022-03672 and CNVD-2022-10270), adopted by delivering Sliver or other malware these as Gh0st RAT and XMRig crypto coin miner.

In a single instance, the risk actor is mentioned to have weaponized the Sunlogin flaws to set up a PowerShell script that, in flip, employs the BYOVD approach to incapacitate security software installed in the method and fall a reverse shell using Powercat.

The BYOVD system abuses a legit but susceptible Windows driver, mhyprot2.sys, that’s signed with a legitimate certification to acquire elevated permissions and terminate antivirus procedures.

It can be worth noting right here that the anti-cheat driver for the Genshin Effects video video game was previously used as a precursor to ransomware deployment, as disclosed by Development Micro.

“It is unconfirmed whether it was done by the similar threat actor, but right after a couple several hours, a log shows that a Sliver backdoor was put in on the similar procedure as a result of a Sunlogin RCE vulnerability exploitation,” the researchers said.

The conclusions come as danger actors are adopting Sliver, a Go-primarily based genuine penetration screening device, as an alternate to Cobalt Strike and Metasploit.

“Sliver offers the required action-by-phase capabilities like account facts theft, internal network movement, and overtaking the inside network of corporations, just like Cobalt Strike,” the scientists concluded.

Identified this short article exciting? Follow us on Twitter  and LinkedIn to read through more distinctive written content we write-up.

Some pieces of this write-up are sourced from:
thehackernews.com