InfoSecBulletin Cybersecurity for mankind
Northwave Cyber Security has found a sophisticated backdoor, LITTLELAMB.WOOLTEA, targeting Palo Alto Networks firewalls.
Northwave researcher claimed the backdoor was found during a forensic investigation of a compromised Palo Alto Networks device. Attackers exploited a recently disclosed vulnerability (CVE-2024-9474) to enter the system and deploy a malicious script called bwmupdate, which installed the backdoor. Northwave notes, “This backdoor is then executed using execve(), which fully replaces any running legitimate logd process with the malicious one.”
CISA Flags Craft CMS Code Injection Flaw Amid Active Attacks
B1ack’s Stash Releases 1 Million Credit Cards on a Deep Web Forum
Cisco Confirms
Salt Typhoon Exploited CVE-2018-0171 to Target U.S. Telecom Networks
AWS Key Hunter
Test this free automated tool to hunt for exposed AWS secrets
Check Point Flaw Used to Deploy ShadowPad and Ransomware
CVE-2024-12284
Citrix Issues Security Update for NetScaler Console
CISA and FBI ALERT
Ghost ransomware to breach organizations in 70 countries
Hacker chains multiple vulns to attack Palo Alto Firewall
150 Gov.t Portal affected
Black-Hat SEO Poisoning Indian “.gov.in, .ac.in” domain
CVE-2018-19410 Exposes 600 PRTG Instances in Bangladesh
LITTLELAMB.WOOLTEA operates stealthily by masquerading as a legitimate logging service. It maintains persistence by modifying the rc.local file and changing the RedHat package manager’s configuration to survive system upgrades.
The backdoor injects a dynamic library into the nginx process, altering the accept() function. This allows attackers to use a 48-byte “magic knock” for covert communication through existing open ports, making detection more difficult.
The backdoor’s functionalities include:
Reading and writing files on the target system.
Providing shell access for remote command execution.
Establishing single or multi-port network tunnels, enabling secure communication channels with other compromised nodes.
Setting up a SOCKS5 proxy for covert data transfer.
Northwave explains, “The backdoor supports running commands in a shell. Output from stdout or stderr is forwarded to the user… ” ensuring robust control over the compromised device.
The backdoor uses a flexible communication protocol that separates operator connections from device-to-device communications with unique identifiers, allowing for a structured command system across infected devices.
Although it’s not confirmed, the complexity of LITTLELAMB.WOOLTEA suggests a nation-state actor. Northwave said, “A suspected nation state threat actor gained entry to a Palo Alto network device through CVE2024-9474, shortly after details of the vulnerability were made public.”
Source: Northwave cybersecurity, securityonline
