ZetaNile is a set of open-source software trojans used by North Korea’s Lazarus/ZINC to trojanize tools like PuTTY and TightVNC, enabling in-memory backdoors and C2 communications. The campaign blends social engineering, trojanized open-source software, and a fingerprinted, encrypted in-memory payload to elude detection. #ZetaNile #ZINC #Lazarus #PuTTY #TightVNC #FingerText #leadsblue
Keypoints
- The Lazarus/ZINC threat group has adopted trojanized open-source software (PuTTY, KiTTY, TightVNC, Sumatra PDF) to deliver backdoors and evade scrutiny.
- The operation uses social engineering (LinkedIn recruiters) and an ISO attachment sent via WhatsApp to deliver the malware payloads.
- The ZetaNile implants execute payloads only after victims enter credentials, aiding anti-sandbox behavior.
- Stage 1 loads a backdoor inside trojanized PuTTY/KiTTY/TightVNC and runs the final payload in memory, avoiding disk artifacts.
- Stage 2 uses a trojanized FingerText container to run a backdoor that communicates with a C2 over HTTPS to a compromised WordPress site.
- Persistence includes DLL hijacking/side-loading and a scheduled task; in many samples persistence was incomplete, suggesting rapid prototyping or rapid deployment.
- The campaign demonstrates advanced evasion (API hashing, in-memory execution) and emphasizes static analysis of evasive samples.
MITRE Techniques
- [T1566.001] Spearphishing Attachment – The attack begins with ZINC impersonating recruiters via LinkedIn and sending an ISO file as an attachment over WhatsApp. ‘The attack begins with ZINC impersonating recruiters in popular technology and defense companies, contacting victims through LinkedIn. After building trust with victims and encouraging them to apply at legitimate job listings, the attackers sent an ISO file as an attachment over WhatsApp.’
- [T1071.001] Web Protocols – The backdoor communicates with the C2 over HTTPS using POST requests to a server. ‘The backdoor communicated over HTTPS with POST commands to the server hxxps[://]leadsblue[.]com/wp-content/wp utility/index[.]php’
- [T1041] Exfiltration – The actors move laterally and exfiltrate data from victim networks. ‘move laterally and exfiltrate collected information from victim networks.’
- [T1055] Process Injection / In-Memory Execution – The payload loads in memory and hides with API hashing; shellcode is used to load an embedded DLL. ‘shellcode hides its functionality using API hashing and manually retrieves functions from the user32.dll and msvcrt.dll libraries.’
- [T1620] Reflective Code Loading – The final payload is loaded reflectively in memory, avoiding disk artifacts. ‘reflectively loads the payload in memory, avoiding disk artifacts.’
- [T1574.002] DLL Side-Loading – DLL hijacking/side-loading is used (e.g., colorui.dll loaded by a legitimate app). ‘PuTTY sample dropped the file colorui.dll in a new directory… and copied the legitimate executable…’
- [T1053.005] Scheduled Task – A scheduled task (PackageColor) is created to run the malicious payload. ‘c:windowssystem32schtasks.exe /CREATE /SC DAILY /MO 1 /ST 10:30 /TR “C:WindowsSystem32cmd.exe /c start /b C:ProgramDataPackageColorcolorcpl.exe 0CE1241A44557AA438F27BC6D4ACA246” /TN PackageColor /F’
Indicators of Compromise
- [Hash] ISO images – 887781551bb75a53846ba0e1d359d2ec76304cb4, cbb4e9ccb34de07e51899ee6601dd4814920c4ae
- [Hash] PuTTY variant – 165c47c85828a6f987ead5a6a53ff4f175735a1f
- [Hash] IBMTech-VNC.exe – 93563c9411a34502769af9c79181343a6405f928
- [Hash] AET-VNC.exe – 4d1539edcc25a2a66246799982fb8d4030f7f05b
- [Hash] AMAZON-P.exe – 561e5df47589a21bb6a1bd9712f5b4bf1111866b
- [Hash] Dell_SE_Assessment.iso – 1d4e1d4a7387e1c078938e86cfd9a87ca56f3396
- [Hash] IBM_SSA_Assessment.iso – 887781551bb75a53846ba0e1d359d2ec76304cb4
- [Hash] colorui.dll – 239f4f33e428fe919be34c7cb090ff6e237e0d49
- [IP] 44.238.74.84 – C2 IP communicated with victim (receives username and computer name)
- [URL] leadsblue.com/wp-content/wp-utility/index.php – C2 URL used by FingerText trojanized payload
- [User-Agent] Mozilla/5.0 … Edg/100.0.1185.39 – Trojanized FingerText User Agent
Read more: https://blog.reversinglabs.com/blog/zetanile-open-source-software-trojans-from-north-korea