Eight Arms to Hold You: The Cuttlefish Malware – Lumen

MITRE Techniques

• [T1059.004] Unix Shell – The threat uses a bash script to enumerate the device and download/exeCute payloads. ‘The threat actor deploys a bash script that gathers certain host-based data to send to the C2.’
• [T1082] System Information Discovery – The bash script enumerates the device, listing directories, /etc contents, running processes, connections, and mounts. ‘The bash script begins to enumerate the device, looking for details such as the directory listing, the contents of “/etc,” running processes, active connections (via netstat), and the mounts.’
• [T1040] Network Sniffing – The malware uses a packet sniffer (libpcap/eBPF) to eavesdrop and hunt for credentials in transit. ‘The sample uses libpcap to create an extended Berkeley Packet Filter (eBPF) for eavesdropping and hijacking IP ranges.’
• [T1560] Archive Collected Data – It compresses collected data into co.tmp.tar.gz before exfiltration. ‘it compresses all data and names the file “co.tmp.tar.gz.”’
• [T1071.004] DNS – DNS hijacking for private IPs; DNS requests are redirected to a configured DNS server. ‘If the agent observes a DNS request to a private IP, it redirects the request to a DNS server in the configuration file.’
• [T1071.001] Web Protocols – HTTP hijacking via 302 redirection to actor-controlled infrastructure. ‘HTTP requests are purloined by inserting a 302-error code… into the data stream, allowing the connection to be redirected toward actor-controlled infrastructure.’
• [T1090] Proxy – VPN or proxy tunnels back through the router to weaponize stolen credentials. ‘the threat actor creates either a VPN or proxy tunnel back into the compromised router.’
• [T1572] Protocol Tunneling – The VPN/tunnel behavior effectively tunnels traffic to/from C2, enabling persistence and data access. ‘VPN or proxy tunnel back through the compromised router…’