FontOnLake

Initial Access T1078 Valid Accounts FontOnLake can collect at least ssh credentials.

Execution T1059.004 Command and Scripting Interpreter: Unix Shell FontOnLake enables execution of Unix Shell commands.

Execution T1059.006 Command and Scripting Interpreter: Python FontOnLake enables execution of arbitrary Python scripts.

Execution T1106 Native API FontOnLake uses fork() to create additional processes such as sshd.

Execution T1204 User Execution FontOnLake trojanizes standard tools such as cat to execute itself.

Persistence T1037 Boot or Logon Initialization Scripts FontOnLake creates a system start-up script ati_remote3.modules.

Initial Access T1078 Valid Accounts FontOnLake can collect at least ssh credentials.

Persistence T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions One of FontOnLake’s rootkits can be executed with a start-up script.

Persistence T1554 Compromise Client Software Binary FontOnLake modifies several standard binaries to achieve persistence.

Credential Access T1556 Modify Authentication Process FontOnLake modifies sshd to collect credentials.

Persistence T1037 Boot or Logon Initialization Scripts FontOnLake creates a system start-up script ati_remote3.modules.

Initial Access T1078 Valid Accounts FontOnLake can collect at least ssh credentials.

Persistence T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions One of FontOnLake’s rootkits can be executed with a start-up script.

Defense Evasion T1014 Rootkit FontOnLake uses rootkits to hide the presence of its processes, files, network connections and drivers.

Defense Evasion T1027 Obfuscated Files or Information FontOnLake packs its executables with UPX.

Initial Access T1078 Valid Accounts FontOnLake can collect at least ssh credentials.

Defense Evasion T1140 Deobfuscate/Decode Files or Information Some backdoors of FontOnLake can decrypt AES-encrypted and serialized communication and base64 decode encrypted C&C address.

Defense Evasion T1564 Hide Artifacts FontOnLake hides its connections and processes with rootkits.

Defense Evasion T1564.001 Hide Artifacts: Hidden Files and Directories FontOnLake hides its files with rootkits.

Defense Evasion T1222.002 File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification FontOnLake’s backdoor can change the permissions of the file it wants to execute.

Credential Access T1556 Modify Authentication Process FontOnLake modifies sshd to collect credentials.

Credential Access T1556 Modify Authentication Process FontOnLake modifies sshd to collect credentials.

Discovery T1082 System Information Discovery FontOnLake can collect system information from the victim’s machine.

Discovery T1083 File and Directory Discovery One of FontOnLake’s backdoors can list files and directories.

Lateral Movement T1021.004 Remote Services: SSH FontOnLake collects ssh credentials and most probably intends to use them for lateral movement.

Command and Control T1008 Fallback Channels FontOnLake can use dynamic DNS resolution to construct and resolve to a randomly chosen domain. One of its rootkits also listens for specially crafted packets, which instruct it to download and execute additional files. It also both connects to a C&C and accepts connections on all interfaces.

Command and Control T1071.001 Application Layer Protocol: Web Protocols FontOnLake acquires additional C&C servers over HTTP.

Command and Control T1071.002 Application Layer Protocol: File Transfer Protocols FontOnLake can download additional Python files to be executed over FTP.

Command and Control T1090 Proxy FontOnLake can serve as a proxy.

Command and Control T1095 Non-Application Layer Protocol FontOnLake uses TCP for communication with its C&C.

Command and Control T1132.001 Data Encoding: Standard Encoding FontOnLake uses base64 to encode HTTPS responses.

Command and Control T1568 Dynamic Resolution FontOnLake can use HTTP to download resources that contain an IP address and port number pair to connect to and acquire its C&C. It can use dynamic DNS resolution to construct and resolve to a randomly chosen domain.

Command and Control T1571 Non-Standard Port Almost every sample of FontOnLake uses a unique non-standard port.

Command and Control T1573.001 Encrypted Channel: Symmetric Cryptography FontOnLake uses AES to encrypt communication with its C&C.

Exfiltration T1041 Exfiltration Over C2 Channel FontOnLake uses its C&C to exfiltrate collected data.