Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Data Encrypted for Impact — n0n locker (Windows/Linux) and the OpenSSL stage on FMC appliances.”
15 distinct techniques documented for this family, organized by ATT&CK tactic.
The command line is built by a bare vswprintf wrapper ... with no escaping: swprintf(buf, L"pkcs12 -export ... -passin pass:%s -passout pass:%s -name %s" ...); PASSWORD lands in -passin pass:%s unquoted; spaces split the openssl argv (CWE-78 argument injection).
it’s pretty easy to hijack the code before it’s crypted and after it’s decrypted
When ENGINE_by_id(name) finds no built-in engine, the fallback sets SO_PATH=<name> and LOAD, which calls DSO_load → LoadLibraryW(<name>). The Windows loader runs DllMain(DLL_PROCESS_ATTACH) before export-table validation, so a DLL loaded from a UNC path executes immediately.
“By default, there is one and only one attribute that is written from an Entra user to an Active Directory user and that is the searchableDeviceKey -> msDS-KeyCredentialLink attribute flow… an abuse primitive known as ‘Shadow Credentials’… if we can add a public key to the msDS-KeyCredentialLink attribute of a user, we can obtain a TGT for that user with the private key.”
The choice to use the system's openssl binary rather than a Python cryptography library... The final bundle... is exfiltrated via a raw HTTP POST to the C2's root endpoint, using curl.
it’s pretty easy to hijack the code before it’s crypted and after it’s decrypted
When ENGINE_by_id(name) finds no built-in engine, the fallback sets SO_PATH=<name> and LOAD, which calls DSO_load → LoadLibraryW(<name>). The Windows loader runs DllMain(DLL_PROCESS_ATTACH) before export-table validation, so a DLL loaded from a UNC path executes immediately.
“By default, there is one and only one attribute that is written from an Entra user to an Active Directory user and that is the searchableDeviceKey -> msDS-KeyCredentialLink attribute flow… an abuse primitive known as ‘Shadow Credentials’… if we can add a public key to the msDS-KeyCredentialLink attribute of a user, we can obtain a TGT for that user with the private key.”
"The stock openssl running dgst command to produce a P-384 signature" and "Victim harness for running OpenSSL scalar multiplication with known inputs."
“By default, there is one and only one attribute that is written from an Entra user to an Active Directory user and that is the searchableDeviceKey -> msDS-KeyCredentialLink attribute flow… an abuse primitive known as ‘Shadow Credentials’… if we can add a public key to the msDS-KeyCredentialLink attribute of a user, we can obtain a TGT for that user with the private key.”
It connects to the device, changes the PSK to all zero if needed, sets up a TLS connection... To work around this, I simply open my own socket and proxy the TLS communication through it.
We can use this authkey.key to generate PVEAuthCookie... modifying the script to generate signed ticket using the found authkey.key... Running the script generates PVEAuthCookie.
Now we can request a certificate to impersonate another user like a DA, by specifying their User Principal Name (UPN)... certipy -debug req ... -upn administrator@lab.local ... Got the administrator.pfx certificate
An attacker with sufficient access to view the process list via any method, such as diag_system_activity.php or status.php, may be able to see the configuration encryption passphrase if they happen to view the process list while the encryption or decryption is occurring.
What if we use the Spy to monitor which cache sets are being accessed by OpenSSL? The cache usage observed by the Spy reveals information about the exponent.
“We need to… obtain a TGT… bundle it in a PCKS12 file… use the PFX file with common tools like Rubeus… Rubeus.exe asktgt /user:jack.burton /certificate:… /getcredentials”
It connects to the device, changes the PSK to all zero if needed, sets up a TLS connection... To work around this, I simply open my own socket and proxy the TLS communication through it.
Microsoft’s schannel TLS implementation doesn’t exactly follow the standards and modifying the OpenSSL binaries to just stuff the client certificate down the servers throat, will result in it being processed anyway
Below is an example screenshot where we connect to a bind shell using OpenSSL on a remote windows virtual machine through an SSH tunnel
n0n locker (Windows/Linux) and the OpenSSL stage on FMC appliances
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.