New multiplatform backdoor exploited by advanced threat actor

A new cross-platform backdoor dubbed SysJoker has successfully evaded security solutions since mid-2021.

“In the Linux and macOS versions, it masquerades as a system update. In the Windows version, it masquerades as Intel drivers. The update names are somewhat generic: in the macOS version the file is moved and named “updateMacOs” and in the Linux version it is named “updateSystem” “, shared Avigayil Mechtinger, security researcher at Intezer, with Help Net Security.

SysJoker: A cross-platform backdoor

Intezer researchers spotted the backdoor during an active attack on an Apache web server at a leading educational institution. It had been downloaded via a reverse shell.

The behavior of SysJoker is similar for all three operating systems: once executed, it “falls asleep” for 90 to 120 seconds before starting to:

• Create directories and copy yourself
• Collect machine information (MAC address, user name, physical media serial number, IP address)
• Add entries to a registry key to achieve persistence
• Contact a command and control server

The various instructions that it can receive from the C2 server allow it to drop and execute another executable, as well as to execute specific commands.

The only difference between the Windows version and those for Linux and macOS is that the former contains a first stage dropper.

A stealthy threat

When researchers released their findings on Tuesday, January 12, the Linux and macOS versions of SysJoker were still not detected by the various security solutions on VirusTotal. In the meantime, about a dozen have been able to spot them.

“Based on the C2 domain registration and samples found in VirusTotal, we estimate that the SysJoker attack was launched in the second half of 2021. During our analysis, the C2 changed three times, indicating that the attacker is active and is monitoring infected machines, ”the researchers shared.

They did not observe many malware samples in the wild, so they believe that the exploitation of the attacks is limited.

The immaturity of security tools for Linux and macOS systems and the obfuscation of C2 server domains are among the other possible reasons Mechtinger cites for the prolonged theft of the malware under the radar.

“The domain is dynamically fetched from a Google Drive link, so the address is easy to update, and any traffic to Google Drive will not normally be considered suspicious on a network,” he explained. .

It is not known if there were other targets / victims. Judging from the information currently available, the attacker appears to be focusing on academic institutions.

“One of the areas of C2 server typosquate the ‘Bookitlab’ software, which is commonly used by universities and scientific institutions for facility management and laboratory equipment planning software,” explained Mechtinger.

Researchers believe that the SysJoker attack is carried out by an advanced threat actor because the malware code (for all operating systems) is original, because it is rare to find new Linux malware in an attack in direct, and because they did not witness a second step or command sent by the attacker (which means the attack is specific).

Remediation

It is impossible to tell whether the malware is setting the stage for cyber espionage or the spread of ransomware. Yet none of these goals is good news for potential targets and could lead to very negative results.

The researchers have published Indicators of Compromise (IoC) and detection content to help defenders find infected machines on their networks, and offered remediation advice.