Lancefly’s recent activity centers on the Merdoor backdoor and ZXShell rootkit, targeting government, aviation, and other sectors with intelligence-gathering as a primary motive. The campaign shows adaptability in initial access vectors, credential theft via non-malware methods, and a mix of loaders and backdoors to maintain access and exfiltrate data. #Lancefly #Merdoor #ZXShell #PlugX #ShadowPad #APT41
Keypoints
- Lancefly employed the Merdoor backdoor and an updated ZXShell rootkit, with targeted activity across government, aviation, and other sectors.
- Initial infection vectors were not definitively identified, but indications include SSH brute forcing and exploitation of an exposed public-facing load balancer/server.
- Credential theft relied on non-malware, living-off-the-land techniques such as PowerShell-based memory dumping, Reg.exe registry export, and LSASS memory dumping using comsvcs.dll.
- A masqueraded WinRAR was used to stage and encrypt data prior to exfiltration, indicating use of traditional archiving for data handling.
- Attack chain tools and TTPs include Impacket Atexec for lateral movement, suspicious SMB activity, LSSAS dumper, NBTScan, and loaders like Blackloader and Prcloader linked to PlugX.
- ZXShell rootkit details show a carrot of kernel-level drivers (TdiProxy.sys) and a loader that drops and interacts with a kernel driver via DeviceIoControl, with extensive registry manipulation and compression techniques.
- Possible links to other groups (e.g., APT41) are discussed but no definitive attribution is established; the ZXShell/toolchain history suggests overlaps but not a conclusive tie.
MITRE Techniques
- [T1078.004] Valid Accounts – SSH – SSH brute forcing suspected as a potential initial infection vector. Quote: “the initial infection vector may have been SSH brute forcing.”
- [T1133] External Remote Services – Exposed public-facing server used as an initial access vector. Quote: “an exposed public-facing server.”
- [T1003.001] Credential Dumping: LSASS – Dump memory via MiniDump (LSASS memory). Quote: “PowerShell was used to launch rundll32.exe in order to dump the memory of a process using the MiniDump function of comsvcs.dll. This technique is often used to dump LSASS memory.”
- [T1003.002] Credential Dumping: SAM and SYSTEM – Reg.exe dumped SAM and SYSTEM registry hives. Quote: “Reg.exe was used to dump the SAM and SYSTEM registry hives.”
- [T1059.001] PowerShell – usage to facilitate credential dumping and other actions. Quote: “PowerShell was used to launch rundll32.exe…”
- [T1036] Masquerading – Masqueraded WinRAR to stage files. Quote: “A masqueraded version of the legitimate archiving tool WinRAR to stage and encrypt files before exfiltration.”
- [T1560.001] Archive Collected Data – Use of WinRAR to stage/encrypt data before exfiltration. Quote: “to stage and encrypt files before exfiltration.”
- [T1021.002] SMB/Windows Admin Shares – Impacket Atexec used to execute remote commands via SMB (lateral movement). Quote: “Impacket Atexec: A dual-use tool that can be used by malicious actors to create and run an immediate scheduled task on a remote target via SMB in order to execute commands on a target system.”
- [T1053.005] Scheduled Task – Remote scheduled task creation via SMB to run commands. Quote: “immediate scheduled task on a remote target via SMB…”
- [T1055] Process Injection – mavinject.exe used for process injection; createdump used to dump LSASS. Quote: “mavinject.exe (which can be used for process injection) and createdump.exe (which can be used to dump a process e.g. LSASS).”
- [T1112] Modify Registry – Numerous registry writes and values created (ptdf, ecdf, tudf, etc.). Quote: “Next, it sets the following registry value” and “It creates the following registry value.”
- [T1543.003] Create/Modify System Process: Create Service – Creation of services (TdiProxy0, etc.) and starting them. Quote: “The sample creates a service with the following parameters…”
- [T1140] Deobfuscate/Decode Files or Information – XOR-transformed data and decompression steps. Quote: “partially transformed using the XOR algorithm with the byte key 0x12” and “decompresses”
- [T1562.001] Impair Defenses – Termination of Defender processes (egui.exe, ekrn.exe, msmpeng.exe). Quote: “it may terminate the processes ‘egui.exe’, ‘ekrn.exe’, and ‘msmpeng.exe’.”
- [T1564.001] Hide Artifacts: Archive Collected Data – Use of compression (aPLib) and staged files. Quote: “using aPLib for compression”
- [T1036] Masquerading – WinRAR and related file names used to conceal their actions. Quote: “masqueraded WinRAR (wmiprvse.exe)”
- [T1547] Boot or Logon Autostart Execution – Service creation and manipulation to run at startup (service-based persistence). Quote: “It restarts the referred service.”
Indicators of Compromise
- [SHA256] Merdoor Backdoor – 13df2d19f6d2719beeff3b882df1d3c9131a292cf097b27a0ffca5f45e139581, 8f64c25ba85f8b77cfba3701bebde119f610afef6d9a5965a3ed51a4a4b9dead, and 22 more hashes
- [Filename] Merdoor-related files – a.exe, chrome_frame_helper.exe, siteadv.exe, and 14 more filenames