InfoSecBulletin Cybersecurity for mankind
Northwave Cyber Security has found a sophisticated backdoor, LITTLELAMB.WOOLTEA, targeting Palo Alto Networks firewalls.
Northwave researcher claimed the backdoor was found during a forensic investigation of a compromised Palo Alto Networks device. Attackers exploited a recently disclosed vulnerability (CVE-2024-9474) to enter the system and deploy a malicious script called bwmupdate, which installed the backdoor. Northwave notes, “This backdoor is then executed using execve(), which fully replaces any running legitimate logd process with the malicious one.”
Palo Alto Firewalls Found Vulnerable to Secure Boot Bypass
CISA Releases 6 ICS Advisories Detailing Security Issues
Account Credentials for Security Vendors Found on Dark Web: Cyble Report
Four Critical Ivanti CSA Vulnerabilities Exploited: CISA , FBI warns
GitLab Releases Patch (CVE-2025-0314) for XSS Exploit
CVE-2025-20156
Cisco Fixes Meeting Management Allowing Privilege Escalation
Delay patching leaves about 50,000 Fortinet firewalls to zero-day attack
Daily Security Update Dated: 21.01.2025
126 Linux kernel Vulns Allow Attackers Exploit 78 Linux Sub-Systems
CERT-UA alerts about “security audit” requests through AnyDesk
LITTLELAMB.WOOLTEA operates stealthily by masquerading as a legitimate logging service. It maintains persistence by modifying the rc.local file and changing the RedHat package manager’s configuration to survive system upgrades.
The backdoor injects a dynamic library into the nginx process, altering the accept() function. This allows attackers to use a 48-byte “magic knock” for covert communication through existing open ports, making detection more difficult.
The backdoor’s functionalities include:
Reading and writing files on the target system.
Providing shell access for remote command execution.
Establishing single or multi-port network tunnels, enabling secure communication channels with other compromised nodes.
Setting up a SOCKS5 proxy for covert data transfer.
Northwave explains, “The backdoor supports running commands in a shell. Output from stdout or stderr is forwarded to the user… ” ensuring robust control over the compromised device.
The backdoor uses a flexible communication protocol that separates operator connections from device-to-device communications with unique identifiers, allowing for a structured command system across infected devices.
Although it’s not confirmed, the complexity of LITTLELAMB.WOOLTEA suggests a nation-state actor. Northwave said, “A suspected nation state threat actor gained entry to a Palo Alto network device through CVE2024-9474, shortly after details of the vulnerability were made public.”
Source: Northwave cybersecurity, securityonline
