The CIS CTI team identified KrustyLoader staged in AWS S3 buckets and used by threat actors to deliver an encrypted Sliver payload that injects into Windows Explorer and deletes itself from disk. Investigation linked the activity to multiple compromised or attacker-created cloud storage buckets, with open-source reporting connecting the campaign to UNC5221 and UTA0178 through exploitation of Ivanti, SAP NetWeaver, ConnectWise ScreenConnect, and JetBrains TeamCity systems. #KrustyLoader #Sliver #UNC5221 #UTA0178 #AWS #Ivanti #SAPNetWeaver #ConnectWiseScreenConnect #JetBrainsTeamCity
Keypoints
- KrustyLoader was discovered in AWS S3 buckets and used to stage malicious downloads for MS-ISAC member environments.
- The loader retrieves an encrypted Sliver payload, injects it into explorer.exe, and self-deletes to reduce forensic evidence.
- CIS CTI identified active S3 buckets hosting KrustyLoader and notified affected U.S. SLTT members through the CIS SOC.
- Static analysis recovered the configuration, decryption keys, and the second-stage download location without executing the malware.
- The Sliver payload provides interactive shell access, in-memory execution, and SOCKS5 proxying for internal movement.
- Infrastructure analysis found additional buckets and files sharing build characteristics, many likely tied to compromised legitimate organizations.
- Open-source attribution overlaps suggest a China-nexus cluster tracked as UNC5221 by GTI and UTA0178 by Volexity.
MITRE Techniques
- [T1105] Ingress Tool Transfer – The threat actors used AWS S3 buckets to host and deliver KrustyLoader and the second-stage Sliver payload (‘malicious downloads indistinguishable from normal cloud traffic’ and ‘retrieves an encrypted Sliver payload from a second S3 location’).
- [T1106] Native API – KrustyLoader used a dynamically resolved Windows function to create a thread for injection (‘using a dynamically resolved thread-creation function (RtlCreateUserThread)’).
- [T1055] Process Injection – The loader injected the decrypted payload into a live explorer.exe process (‘injects it into Windows Explorer’ and ‘injects it into a live explorer.exe process’).
- [T1027] Obfuscated Files or Information – The sample used encryption, XOR masking, and hex decoding to hide its configuration and payload (‘encrypted configuration block’, ‘single-byte XOR mask’, and ‘AES-128-CFB decryption’).
- [T1070.004] File Deletion – The malware erased itself from disk after execution (‘erases itself from disk’ and ‘removes its own on-disk body’).
- [T1102] Web Service – The campaign relied on cloud storage services for staging and delivery, blending into trusted web traffic (‘abuse legitimate companies’ cloud storage accounts’ and ‘AWS’s trusted reputation’).
- [T1021.002] SMB/Windows Admin Shares – Not mentioned.
- [T1046] Network Service Scanning – Not mentioned.
- [T1105] Ingress Tool Transfer – The stage-2 Sliver implant was recovered from cloud infrastructure and delivered from S3 (‘resolved the second-stage S3 location’).
- [T1056.004] Input Capture: Credential API Hooking – Not mentioned.
- [T1090.001] Internal Proxy – Sliver included a SOCKS5 proxy tunnel for lateral movement (‘a SOCKS5 proxy tunnel for lateral movement through the internal network’).
- [T1087] Account Discovery – Not mentioned.
- [T1059.003] Windows Command Shell – The Sliver implant provided interactive shell access (‘including interactive shell access’).
- [T1105] Ingress Tool Transfer – The malware loaded an encrypted payload in memory rather than writing it to disk (‘decrypts the payload in memory’).
Indicators of Compromise
- [Domains] Malicious staging and C2 infrastructure – kleinnretail[.]s3[.]amazonaws[.]com, sellprolab[.]s3[.]amazonaws[.]com, update[.]lotteofficial[.]org
- [URLs] Retrieved samples and stage-2 locations – hxxps[://]kleinnretail[.]s3[.]amazonaws[.]com/uDTMypt5Y, hxxps[://]sellprolab[.]s3[.]amazonaws[.]com/oJ4kCFP0lcxvtR, hxxps[://]sellprolab[.]s3[.]amazonaws[.]com:443/oJ4kCFP0lcxvtR
- [URLs] Additional staging infrastructure – hxxps[://]omnidleadzdev[.]s3[.]amazonaws[.]com/l9oWUjyPR6Gc and other identified S3 bucket URLs
- [File names / objects] Hosted malware objects and stages – uDTMypt5Y, oJ4kCFP0lcxvtR
- [Vulnerability identifiers] Exploited internet-facing systems – CVE-2023-46805, CVE-2024-21887, and other CVEs listed for Ivanti, SAP, ConnectWise, and JetBrains
- [Hashes] Similarity and content-search results – approximately 100 candidate S3 URLs, 149 files, and 9 samples across 7 S3 buckets
- [Rust crate strings] Build artifacts used for family identification – self-replace-1.3.5, cfb-mode-0.7.1
- [GitHub path / package string] Sliver build reference – github[.]com/bishopfox/sliver
Read more: https://www.cisecurity.org/insights/blog/sltt-traffic-directing-s3-buckets-hosting-krustyloader