ComfyUI, a popular AI image-generation framework, has been targeted by Pickai, a lightweight backdoor exploiting its vulnerabilities to steal sensitive AI data and maintain persistent control over infected hosts. Pickai leverages diverse process spoofing, multiple persistence mechanisms, and a resilient network communication strategy involving rotating command-and-control domains, threatening large-scale supply chain networks including Rubick.ai and its customers. #ComfyUI #Pickai #Rubickai
Keypoints
- ComfyUI suffers from multiple high-risk vulnerabilities actively exploited by hacker groups using the Pickai backdoor.
- Pickai is a C++ backdoor that supports remote command execution, reverse shell access, and features anti-debugging and process name spoofing for stealth.
- Pickai uses multiple hard-coded command-and-control (C2) servers with automatic failover, including domains like h67t48ehfth8e.com (now seized) and historyandresearch.com.
- Pickai samples were hosted on Rubick.ai’s official platform, creating a significant supply chain risk affecting over 200 major online retail brands worldwide.
- Pickai employs diverse persistence mechanisms, creating multiple copies of itself with randomized data and maintaining services via init.d and systemd under both root and non-root contexts.
- Network communication with C2s involves periodic device info reporting, command polling, and liveness checks, using encrypted payloads and sophisticated timing strategies.
- Nearly 700 servers globally, especially in Germany, the United States, and China, were confirmed infected, underscoring the backdoor’s expansive reach and resilience.
MITRE Techniques
- [T1059] Command and Scripting Interpreter – Pickai supports EXECUTE commands to run system commands remotely and REVERSE commands to establish reverse shell access (“Pickai supports two instructions: EXECUTE… and REVERSE…”).
- [T1105] Ingress Tool Transfer – Pickai was distributed as ELF executables disguised as config files hosted on legitimate platforms like Rubick.ai (“distributing ELF executables disguised as config files such as config.json”).
- [T1543] System Service – Pickai establishes persistence by creating multiple services under init.d and systemd with different names depending on user privileges (“sets up services using both init.d and systemd”).
- [T1050] New Service – Creation of services with randomized names such as auditlogd, hwstats, and nano for persistence (“Pickai randomly selects process names from a predefined pool… creates services named auditlogd, hwstats, etc.”).
- [T1036] Masquerading – Pickai changes its process name to legitimate-sounding kernel process names for stealth (“uses prctl syscall to rename process with names like kworker/0:0-events”).
- [T1003] Credential Dumping – While not explicitly credential dumping, Pickai steals sensitive AI-related data from infected hosts (“stealing sensitive AI-related data”).
- [T1071] Application Layer Protocol – Pickai communicates with C2 servers using custom packets (LISTEN|, UPDATE|, STATUS|) over network connections (“communicates with C2s with 1024-byte packets starting with LISTEN| or UPDATE|”).
Indicators of Compromise
- [IP Addresses] Pickai C2 servers – 185.189.149.151 (Switzerland), 195.43.6.252 (Egypt), 80.75.169.227 (Egypt), 154.68.72.34 (Rwanda), and others.
- [File Hashes] Pickai samples – MD5 8680f76a9faaa7f62967da8a66f5a59c (latest x64 sample), f9c955a27207a1be327a1f7ed8bcdcaa (old version), c587e4596fce1de62d132f46ca1f03de (vim.json), and 4 more hashes.
- [Domains] Command and Control domains – h67t48ehfth8e.com (seized by XLab), historyandresearch.com (current active C2 domain).
- [URLs] Pickai downloader URLs – http://78.47.151.49:8878/wp-content/x64, https://rubick.ai/wp-content/tmux.conf, https://rubick.ai/wp-content/vim.json.
- [File Names] Malicious payload disguise – config.json, tmux.conf, vim.json used as backdoor droppers.
Read more: https://blog.xlab.qianxin.com/pickai-the_backdoor_hiding_in_your_ai_stack/