SmoothOperator | Ongoing Campaign Trojanizes 3CXDesktopApp in Supply Chain Attack

MITRE Techniques

• [T1055] Process Injection – The shellcode reflectively loads a DLL, removing the ‘MZ’ at the start. “[The shellcode reflectively loads a DLL, removing the ‘MZ’ at the start.]”
• [T1105] Ingress Tool Transfer – The malware downloads icon files from a dedicated Github repository. “[downloading icon files from a dedicated Github repository: …]”
• [T1140] Deobfuscate/Decode Files or Information – ICO files are appended with base64 data and decoded to obtain a C2 URL. “[ICO files are appended with a chunk of base64 encoded data after a ‘$’ character. The malware searches for the ‘$’ and extracts the remaining bytes from the ICO file. These bytes are decoded and decrypted, yielding a C&C URL.]”
• [T1071.001] Web Protocols – The main loop builds and encrypts an “initial-run” command to the C2 and sends it via HTTP POST. “[The main loop first will build and encrypt an ‘initial-run’ command to the C&C. It sends this command via an HTTP POST request.]”
• [T1116] Code Signing – The compromise includes a code signing certificate used to sign the trojanized binaries. “[The compromise includes a code signing certificate used to sign the trojanized binaries.]”
• [T1543.003] Create or Modify System Process: Launch Daemons – macOS persistence via Launch Daemons for the POOLRAT backdoor. “[Launch Daemons as a persistence mechanism.]”
• [T1082] System Information Discovery – The Windows infostealer collects computer name, domain, and OS version information. “[NetWkstaGetInfo to obtain the computer name and domain name. It calls RtlGetVersion to obtain the Windows version.]”