MalwareUsed by 1 actor

Reductor

Reductor is a Windows malware family with remote-access Trojan functionality that is notable for covert manipulation of TLS-related randomness and certificate material on infected hosts. It was observed in 2019 and shows strong code similarities to COMpfun, with development assessed as likely originating from the same authors. Based on code similarities and victimology, Reductor has been tentatively associated with Turla. Known targeting included victims in Russia and Belarus.

Reductor supports core backdoor operations including uploading, downloading, deleting, and executing files, and it communicates with command-and-control infrastructure over HTTP POST using encrypted host identifiers. It can install root certificates embedded in its data section and can also receive additional certificates remotely. For persistence, it uses an LSA notification package.

Its most distinctive capability is host-side manipulation of TLS traffic without directly modifying packets on the wire. Reductor patches PRNG-related functions in browser and Windows cryptographic components in memory, including functions used by Firefox, Chrome, and Windows cryptographic APIs, in order to alter TLS client random values during handshakes. This allows it to embed encrypted victim-specific identifiers derived from certificate data and hardware characteristics into outbound TLS traffic. The malware therefore enables reliable victim marking and traffic correlation, and its certificate handling strongly suggests support for interception-oriented workflows, although analyzed samples did not themselves implement a full man-in-the-middle capability.

Observed delivery included trojanized software installers distributed through HTTP downloads, including software sought from warez ecosystems, as well as secondary deployment from systems already infected with COMpfun. In at least some cases, operators were assessed to have replaced legitimate installers in transit, indicating control over the victim’s network path during delivery. Reductor was deployed in both 32-bit and 64-bit forms.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Turla

We called these new modules ‘Reductor’ after a .pdb path left in some samples. Besides typical RAT functions such as uploading, downloading and executing files, Reductor’s authors put a lot of effort into manipulating digital certificates and marking outbound TLS traffic with unique host-related identifiers.

via securelistsecurelist.com

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1195Supply Chain CompromiseEvidence1

We registered two initial infection schemes: Reductor spreads by either infecting popular software distributions (Internet Downloader Manager, WinRAR, etc. and, for at least one victim, through a popular warez website over HTTP)...

T1566.001Spearphishing AttachmentEvidence1

The campaign operators retained their focus on diplomatic entities, this time in Europe, and spread the initial dropper as a spoofed visa application.

Execution

2 techniques

T1106Native APIEvidence1

The malware is also able to get additional certificates from the operators through a named pipe.

T1574Hijack Execution FlowEvidence1

They don’t touch the network packets at all; instead developers analyzed the Firefox source code and Chrome binary code to patch the corresponding pseudo random number generation (PRNG) functions in the process’s memory.

Persistence

3 techniques

T1546.015Component Object Model HijackingEvidence1

In the second scenario, the targets are already infected with the COMpfun Trojan, which uses COM CLSID for persistence.

T1547.002Authentication PackageEvidence1

Persistence ... LSA notification package

T1556Modify Authentication ProcessEvidence1

The malware adds digital certificates from its data section to the target host and allows the operators to add additional certificates remotely through a named pipe.

Privilege Escalation

2 techniques

T1546.015Component Object Model HijackingEvidence1

In the second scenario, the targets are already infected with the COMpfun Trojan, which uses COM CLSID for persistence.

T1547.002Authentication PackageEvidence1

Persistence ... LSA notification package

Stealth

1 technique

T1574Hijack Execution FlowEvidence1

Defense Impairment

1 technique

T1556Modify Authentication ProcessEvidence1

The malware adds digital certificates from its data section to the target host and allows the operators to add additional certificates remotely through a named pipe.

Credential Access

2 techniques

T1556Modify Authentication ProcessEvidence1

The malware adds digital certificates from its data section to the target host and allows the operators to add additional certificates remotely through a named pipe.

T1557Adversary-in-the-MiddleEvidence1

This allowed us to confirm that Reductor’s operators have some control over the target’s network channel and could replace legitimate installers with infected ones on the fly.

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

The second four-byte hash (hwid_hash) is based on the target’s hardware properties: SMBIOS date and version, Video BIOS date and version and hard drive volume ID.

T1083File and Directory DiscoveryEvidence1

Besides typical RAT functions such as uploading, downloading and executing files...

Collection

1 technique

T1557Adversary-in-the-MiddleEvidence1

This allowed us to confirm that Reductor’s operators have some control over the target’s network channel and could replace legitimate installers with infected ones on the fly.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

Reductor sends HTTP POST queries to the /query.php scripts on the C2s listed in its configuration.

T1105Ingress Tool TransferEvidence1

After getting into the browser’s address space, the Trojan can receive the command to download additional modules from the C2. As a result, the target’s browser downloaded Reductor’s custom dropper-decryptor.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

C2 command Features ... upfile Upload the file of interest

INDICATORS OF COMPROMISE

IOCs tracked for this family

18 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

14 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app5 years ago

hash.sha1●●●●●●●●●●●●View more in app5 years ago

ip.v4●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

securelistNews

May 13, 2021

COMpfun authors spoof visa application with HTTP status-based Trojan | Securelist

A COMpfun successor mentioned as prior related malware that infected files on the fly to compromise TLS traffic.

securelistNews

May 13, 2021

COMpfun successor Reductor infects files on the fly to compromise TLS traffic | Securelist

A Trojan/RAT family that installs digital certificates, patches browser and system PRNG functions in memory to embed victim-specific identifiers into TLS client random values, communicates with C2 over HTTP POST, and supports file upload/download, execution, certificate renewal, and cleanup. It was distributed via trojanized installers and via COMpfun as a downloader.

securelistNews

Sep 3, 2020

IT threat evolution Q2 2020

COMpfun-related malware that infects files on-the-fly to enable compromise of TLS traffic.

securelistNews

Aug 1, 2019

APT trends report Q2 2019

Remote access trojan with advanced capabilities to manipulate digital root certificates and mark outbound TLS traffic with unique identifiers.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching18

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Reductor