Loading malware…
Waterbear is a modular Windows backdoor associated with BlackTech, a China-linked cyberespionage group also known as Earth Hundun and BRONZE CANAL. It has been deployed against Taiwanese government agencies and used for post-compromise access and lateral movement. Waterbear commonly serves as a secondary backdoor after attackers have already established access to a victim environment.
Its loader retrieves the main backdoor from a command-and-control server or an encrypted local payload and loads it into memory. Later versions use patched legitimate server applications as loaders, including enterprise management, backup, virtualization, and application-delivery software. Waterbear also uses DLL side-loading and DLL hijacking. In an April 2020 campaign, attackers abused inadequate DLL integrity verification in trusted data loss prevention software to launch a malicious component with elevated privileges. Waterbear injects decrypted shellcode into Windows services, including the Server service, and can deploy additional malicious packages. Command-and-control communication includes HTTP CONNECT tunneling.
Waterbear incorporates multiple defense-evasion mechanisms, including RC4-encrypted payloads, memory-resident execution, self-modifying code, junk-byte padding, and artificially enlarged binaries. Its loader has used Heaven’s Gate to execute 64-bit code from a 32-bit process and complicate monitoring and analysis. It can identify security software and associated processes, query the Windows Registry, and modify registry values to facilitate malicious DLL loading.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
While PLEAD and KIVARS are most likely to be used in first phase attacks, Waterbear can be seen as a secondary backdoor installed after attackers have gained a certain level of privilege.
BRONZE CANAL ... Tools ... Bifrose, Deuterbear, DRIGO, Flagpro, Gh0stTimes, KIVARS, PLEAD, Spiderpig, Waterbear, XBOW
42 distinct techniques documented for this family, organized by ATT&CK tactic.
A sophisticated hacking group tied to the government of China is exploiting routers in attacks on a variety of organizations... The group specifically targets “branch routers” — smaller appliances used at more remote branch offices to connect to a corporate headquarters.
The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.
Waterbear similarly employs a modular approach to its malware. A loader component executable will connect to the C&C server to download the main backdoor and load it in memory.
Last year, Waterbear captured interest in the cybersecurity industry after implementing API hooking to hide its activities by abusing security products.
A vulnerability in the DLP tool was then used to perform DLL hijacking. As the software failed to verify the integrity of DLLs it was loading, the malicious file was launched with a high level of privilege.
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
“Abuses print processors to run malicious DLLs during system”
Specifically, upon gaining an initial foothold into a target network and gaining administrator access to network edge devices, BlackTech cyber actors often modify the firmware to hide their activity across the edge devices to further maintain persistence in the network.
Using beginthreadex() acts as a proxy and starts the new thread at threadstartex(), instead of using the address where the shellcode is located as if using CreateThread() directly | Recent Injection Technique used by APT
A vulnerability in the DLP tool was then used to perform DLL hijacking. As the software failed to verify the integrity of DLLs it was loading, the malicious file was launched with a high level of privilege.
“Abuses print processors to run malicious DLLs during system”
Last year, Waterbear captured interest in the cybersecurity industry after implementing API hooking to hide its activities by abusing security products.
To scupper analysis attempts, the Waterbear loader will also use RC4 encryption on its main payload... The size of the malware's binary was also inflated in an attempt to bypass file-based scanners.
“bypass antivirus software adding a large amount of padding with 0x00 around the beginning and end to avoid detection.”
Transmits payloads in modified RC4-encrypted chunks... Table 1 ... Payloads in modified RC4-encrypted chunks ... T1027.002: Obfuscated Files or Information: Software Packing
Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'
Self Modifying Code - Waterbear... Before self-modifying After self-modifying Only the wait-for-connection function is left
“Makes the patched executable that appears legitimate or benign to users and/or security tools”
Using beginthreadex() acts as a proxy and starts the new thread at threadstartex(), instead of using the address where the shellcode is located as if using CreateThread() directly | Recent Injection Technique used by APT
Bisonal has deleted Registry keys to clean up its prior activity. FIN8 has deleted Registry keys during post compromise cleanup activities. SUNBURST also deleted previously-created Image File Execution Options (IFEO) Debugger registry values and registry keys related to HTTP proxy to clean up traces of its activity.
The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.
Known as 'Heaven's Gate,' the misdirection technique is used to trick Microsoft Windows operating systems into executing 64-bit code, even when declared as a 32-bit process. This, in turn, can be used to bypass security engines... some monitor/analysis systems will only apply 32-bit analysis and will fail the 64-bit part.
During execution, the code employs byte randomization... using the host’s current time as a seed... ~65 calls to Windows API kernel32!GetTickCount... T1497.003: Time Based Evasion
Waterbear 'can hook the ZwOpenProcess and GetExtendedTcpTable APIs called by the process of a security product to hide PIDs and TCP records from detection.'
Last year, Waterbear captured interest in the cybersecurity industry after implementing API hooking to hide its activities by abusing security products.
A vulnerability in the DLP tool was then used to perform DLL hijacking. As the software failed to verify the integrity of DLLs it was loading, the malicious file was launched with a high level of privilege.
A loader component executable will connect to the C&C server to download the main backdoor and load it in memory.
“checks the debugger mode” and “Checking debugger mode by process time”
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
Specifically, upon gaining an initial foothold into a target network and gaining administrator access to network edge devices, BlackTech cyber actors often modify the firmware to hide their activity across the edge devices to further maintain persistence in the network.
The content repeatedly describes threat actors and malware disabling or modifying security tools, EDR/AV, logging, firewall rules, integrity checkers, and security settings; e.g., 'Agrius used several mechanisms to try to disable security tools' and 'BlackByte disabled security tools such as Windows Defender and the Raccine anti-ransomware tool during operations.'
Specifically, upon gaining an initial foothold into a target network and gaining administrator access to network edge devices, BlackTech cyber actors often modify the firmware to hide their activity across the edge devices to further maintain persistence in the network.
The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
“Downloaders check for internet connectivity on compromised systems.”
“Waterbear RAT lists network connections… by querying for information over the network.”
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
The shellcode begins by locating the target’s Process Environment Block (PEB) to check if it’s currently being debugged... This routine is performed 52 times... Table 1 ... T1082: System Information Discovery
“RAT searches files and directories or in specific locations.”
Known as 'Heaven's Gate,' the misdirection technique is used to trick Microsoft Windows operating systems into executing 64-bit code, even when declared as a 32-bit process. This, in turn, can be used to bypass security engines... some monitor/analysis systems will only apply 32-bit analysis and will fail the 64-bit part.
During execution, the code employs byte randomization... using the host’s current time as a seed... ~65 calls to Windows API kernel32!GetTickCount... T1497.003: Time Based Evasion
Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.
“checks the debugger mode” and “Checking debugger mode by process time”
PLEAD also uses the document-targeting exfiltration tool DRIGO, which mainly searches the infected machine for documents.
“Downloaders communicate with C&C by HTTP/HTTPS” and “Deuterbear downloader enables HTTPS tunnel”
Waterbear uses HTTP CONNECT tunneling for its C&C communication.
The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."
“Encodes traffic with a non-standard RC4 to make the content of traffic more difficult to detect”
“Employs a RC4/RSA to conceal command and control traffic” and “The downloader… generate an RSA… [then] RC4_KEY_1 and RC4_KEY_2… encrypted by RSA”
Obscures its connection protocol by connecting to the C2 server over a common port (443)... Table 1 ... Command and Control ... T1573.002: Encrypted Channel: Asymmetric Cryptography
“Sends collected data to C&C”
91 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
38 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.