Loading malware…
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Other tools linked to the actor in previous attacks include Slapstick, Tinyshell, Steelhound, Steelcorgi, Wingjook, Wingcrack, Binbash, Wiperight, and the Mignogcleaner, all of which Mandiant confirmed as still deployed in LightBasin attacks.
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Command #sh will execute remote commands using the existing command line interpreter.
T1204.002 – User Execution: Malicious File
These services were registered with systemd to achieve persistence, allowing them to automatically execute during system startup and reboot.
These services were registered with systemd to achieve persistence, allowing them to automatically execute during system startup and reboot.
The threat actor employed multiple obfuscation techniques, including payload and string encryption.
STEELCORGI is a packer used to encrypt malware used by the attackers.
Decryption key can be stored in an env variable which is set by the TA.
"...STEELCORGI in-memory dropper..." and "...leveraging a similar in-memory dropper..."
The threat actor was observed executing the command “scp -t /tmp”.
MITRE list: "T1105:Ingress Tool Transfer" and description of deploying multiple utilities/toolkit components.
MITRE list: "T1573.001:Symmetric Cryptography" and references to ChaCha20/RC4 usage in droppers.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.