InfoSecBulletin Cybersecurity for mankind
Northwave Cyber Security has found a sophisticated backdoor, LITTLELAMB.WOOLTEA, targeting Palo Alto Networks firewalls.
Northwave researcher claimed the backdoor was found during a forensic investigation of a compromised Palo Alto Networks device. Attackers exploited a recently disclosed vulnerability (CVE-2024-9474) to enter the system and deploy a malicious script called bwmupdate, which installed the backdoor. Northwave notes, “This backdoor is then executed using execve(), which fully replaces any running legitimate logd process with the malicious one.”
Russia detects first SuperCard malware attacks via NFC
Income Property Investments exposes 170,000+ Individuals record
ALERT (CVE: 2023-28771)
Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs
CISA Flags Active Exploits in Apple iOS and TP-Link Routers
10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online
Canada 2nd largest airlines “WestJet” investigates cyberattack disrupting internal systems
Paraguay 7.4 Million Citizen Records Leaked on Dark Web
High-Severity Flaw in HashiCorp Nomad Allows Privilege Escalation
SoftBank: Over 137,000 personal info leaked
Alert
Trend Micro Apex One Flaw Allow Attackers to Inject Malicious Code
LITTLELAMB.WOOLTEA operates stealthily by masquerading as a legitimate logging service. It maintains persistence by modifying the rc.local file and changing the RedHat package manager’s configuration to survive system upgrades.
The backdoor injects a dynamic library into the nginx process, altering the accept() function. This allows attackers to use a 48-byte “magic knock” for covert communication through existing open ports, making detection more difficult.
The backdoor’s functionalities include:
Reading and writing files on the target system.
Providing shell access for remote command execution.
Establishing single or multi-port network tunnels, enabling secure communication channels with other compromised nodes.
Setting up a SOCKS5 proxy for covert data transfer.
Northwave explains, “The backdoor supports running commands in a shell. Output from stdout or stderr is forwarded to the user… ” ensuring robust control over the compromised device.
The backdoor uses a flexible communication protocol that separates operator connections from device-to-device communications with unique identifiers, allowing for a structured command system across infected devices.
Although it’s not confirmed, the complexity of LITTLELAMB.WOOLTEA suggests a nation-state actor. Northwave said, “A suspected nation state threat actor gained entry to a Palo Alto network device through CVE2024-9474, shortly after details of the vulnerability were made public.”
Source: Northwave cybersecurity, securityonline
