NKNShell Malware Distributed via VPN Website

MITRE Techniques

• [T1071] Application Layer Protocol – NKNShell uses MQTT and NKN protocols for C2 communication (“…uses the NKN and MQTT protocols to communicate with its C&C server…”).
• [T1105] Ingress Tool Transfer – PowerShell downloaders (sql-auto.ps1, install.ps1) download additional payloads such as MeshAgent, gs-netcat, and NKNShell (“…The ‘sql-auto.ps1’ script acts as a downloader for additional malware…”).
• [T1055] Process Injection – NKNShell injects into legitimate processes such as Microsoft Edge, Notepad, Calculator, and Paint (“…the NKNShell backdoor executes and injects into Microsoft Edge, Notepad, Calculator, and Paint processes.”).
• [T1547.001] Registry Run Keys / Startup Folder (via WMI Persistence) – install.ps1 registers a WMI filter named “Cleanup” to persist and execute the downloader (“…registers a WMI filter named ‘Cleanup’ for persistence. The ‘Cleanup’ filter allows executing the actual downloader script…”).
• [T1218] Signed Binary Proxy Execution / Valid Accounts (misuse) – Installer is signed with an invalid certificate impersonating NVIDIA to appear legitimate (“…signed with an invalid certificate impersonating NVIDIA.”).
• [T1059.001] PowerShell – Attackers load and execute Base64-encoded PowerShell commands and use PowerShell-based downloader scripts to deploy payloads (“…loads it into memory, and runs Base64-encoded commands… ‘sql-auto.ps1’ … downloads additional payloads”).
• [T1573] Encrypted Channel / Alternate Protocols – Use of blockchain-based NKN P2P network provides resilient, non-standard C2 channels (“…use of the blockchain-based P2P networking protocol NKN for C&C communication…”).
• [T1112] Modify Registry – Scripts attempt to add Defender exclusions and disable protections (AMSI/ETW) and register persistence mechanisms (“…attempts to disable Windows Defender, add exclusion paths, and execute the ‘Null-AMSI’ script… registers a WMI filter named ‘Cleanup’ for persistence.”).
• [T1496] Resource Hijacking (Data from Local System) – NKNShell collects and transmits detailed system information to attacker-controlled addresses (“…sends collected information to attacker-controlled addresses that are hardcoded into the binary.”).
• [T1106] Native API – The trojanized installer (written in Go) and Go-based backdoors use native language features for execution and evasion, including disabling AMSI via native methods (“…PowerShell is a PowerShell console developed in C/C++, which disables security features such as AMSI.”).