InfoSecBulletin Cybersecurity for mankind
Northwave Cyber Security has found a sophisticated backdoor, LITTLELAMB.WOOLTEA, targeting Palo Alto Networks firewalls.
Northwave researcher claimed the backdoor was found during a forensic investigation of a compromised Palo Alto Networks device. Attackers exploited a recently disclosed vulnerability (CVE-2024-9474) to enter the system and deploy a malicious script called bwmupdate, which installed the backdoor. Northwave notes, “This backdoor is then executed using execve(), which fully replaces any running legitimate logd process with the malicious one.”
OpenAI Offering $100K Bounties for Critical Vulns
Splunk Alert User RCE and Data Leak Vulns
CIRT alert Situational Awareness for Eid Holidays
Cyberattack on Malaysian airports: PM rejected $10 million ransom
Micropatches released for Windows zero-day leaking NTLM hashes
VMware Patches Authentication Bypass Flaw in Windows Tool
IngressNightmare
Over 40% of cloud environments are vulnerable to RCE
(CVE-2025-29927)
Urgently Patch Your Next.js for Authorization Bypass
Oracle refutes breach after hacker claims 6 million data theft
Russian zero-day seller to offer up to $4 million for Telegram exploits
LITTLELAMB.WOOLTEA operates stealthily by masquerading as a legitimate logging service. It maintains persistence by modifying the rc.local file and changing the RedHat package manager’s configuration to survive system upgrades.
The backdoor injects a dynamic library into the nginx process, altering the accept() function. This allows attackers to use a 48-byte “magic knock” for covert communication through existing open ports, making detection more difficult.
The backdoor’s functionalities include:
Reading and writing files on the target system.
Providing shell access for remote command execution.
Establishing single or multi-port network tunnels, enabling secure communication channels with other compromised nodes.
Setting up a SOCKS5 proxy for covert data transfer.
Northwave explains, “The backdoor supports running commands in a shell. Output from stdout or stderr is forwarded to the user… ” ensuring robust control over the compromised device.
The backdoor uses a flexible communication protocol that separates operator connections from device-to-device communications with unique identifiers, allowing for a structured command system across infected devices.
Although it’s not confirmed, the complexity of LITTLELAMB.WOOLTEA suggests a nation-state actor. Northwave said, “A suspected nation state threat actor gained entry to a Palo Alto network device through CVE2024-9474, shortly after details of the vulnerability were made public.”
Source: Northwave cybersecurity, securityonline
