Sliver backdoor was installed via Sunlogin vulnerability exploitation, with threat actors using BYOVD to disable security products and deploy a reverse shell alongside Gh0st RAT and XMRig CoinMiner. The report details Sliver’s capabilities, the Sunlogin RCE attack chain, and the observed IOCs and defenses evasion techniques. #Sliver #BYOVD #Sunlogin #Gh0stRAT #XMRig #Powercat #Mhyprot2DrvControl #Oray
Keypoints
- Sliver is an open-source Go-based backdoor increasingly used by threat actors as an alternative to Cobalt Strike and Metasploit.
- Attacks targeted Sunlogin, leveraging a publicly available remote code execution vulnerability (CNVD-2022-10270 / CNVD-2022-03672).
- BYOVD (Bring Your Own Vulnerable Driver) is used to escalate privileges and to disable security products via Mhyprot2DrvControl.
- Gh0st RAT and XMRig CoinMiner were observed deploying through the Sunlogin RCE chain, with PowerShell-based and batch-based loaders.
- Sliver’s C2 communications employ encrypted channels (mTLS, WireGuard, HTTP(S), DNS) and support Session Mode (real-time) and Beacon Mode (async).
- Recent cases show a PowerShell script, loader components, and Sliver backdoor installed on the same system after initial Sunlogin exploitation, followed by reverse shell setup via Powercat.
MITRE Techniques
- [T1068] Exploitation for Privilege Escalation – BYOVD uses a vulnerable driver to escalate privileges and perform arbitrary actions. Quote: ‘BYOVD (Bring Your Own Vulnerable Driver) technique, which abuses vulnerable Windows driver files and uses the escalated privilege to perform arbitrary behaviors.’
- [T1562.001] Impair Defenses – Force termination of security products using Mhyprot2DrvControl to evade detection. Quote: ‘the feature which allows the force termination of processes to develop a malware that shuts down multiple anti-malware products.’
- [T1059.001] PowerShell – PowerShell is used to download and install Gh0st RAT and to run the attacker’s commands. Quote: ‘The PowerShell script is obfuscated…’
- [T1059.001] PowerShell – Additional PowerShell-based commands used to execute the Sunlogin RCE exploits and loader components. Quote: ‘PowerShell command executed through the Sunlogin RCE vulnerability.’
- [T1027] Obfuscated/Compressed Files and Information – Sliver and related scripts are obfuscated; PowerShell scripts are obfuscated. Quote: ‘the PowerShell script is obfuscated’ and ‘the Sliver backdoor is normally obfuscated.’
- [T1071.001] Web Protocols – Sliver uses mTLS, WireGuard, HTTP(S), and DNS to communicate with C2 to evade network detection. Quote: ‘Sliver also supports methods that use mTLS, WireGuard, HTTP(S), and DNS to communicate with the C&C server…’
- [T1021] Lateral Movement – Sliver’s capabilities enable internal network takeover and lateral movement. Quote: ‘Overtaking internal networks, such as privilege escalation, process memory dumping, and lateral movement.’
- [T1003] Credential Dumping – Sliver capabilities include memory detection and memory dumping as part of its behavior. Quote: ‘process memory dumping, and lateral movement.’
- [T1113] Screenshots – Sliver features include screenshot capturing. Quote: ‘screenshot capturing.’
Indicators of Compromise
- [MD5] XMRig-related artifacts – 836810671d8e1645b7dd35b567d75f27, 29d04d986a31fbeab39c6b7eab5f5550
- [File Name] Loader and launchers – syse.bat, watch.exe, splwow32.exe, WINSysCoreR.bin, config.json
- [URL] Download and delivery links – hxxp://5.199.173[.]103/syse.bat, hxxp://5.199.173[.]103/t.zip
- [IP] Command & C2 endpoints – 43.128.62[.]42:8888, 45.144.3[.]216:14356
- [Domain] C2 domain – idc6.yjzj[.]org:56573
Read more: https://asec.ahnlab.com/en/47088/