InfoSecBulletin Cybersecurity for mankind
Northwave Cyber Security has found a sophisticated backdoor, LITTLELAMB.WOOLTEA, targeting Palo Alto Networks firewalls.
Northwave researcher claimed the backdoor was found during a forensic investigation of a compromised Palo Alto Networks device. Attackers exploited a recently disclosed vulnerability (CVE-2024-9474) to enter the system and deploy a malicious script called bwmupdate, which installed the backdoor. Northwave notes, “This backdoor is then executed using execve(), which fully replaces any running legitimate logd process with the malicious one.”
India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record
Anthropic’s Mythos reportedly broke NSA classified systems in hours
OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment
AryStinger botnet infected thousands of D-Link routers globally
Hacker suspected of sending alerts across Brazil
CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT
Barracuda hosts Dhaka roundtable on cyber resilience
CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices
CISA: Splunk flaw under active exploit, patch by Sunday
Texas data breach exposes 3 million driver’s licenses
LITTLELAMB.WOOLTEA operates stealthily by masquerading as a legitimate logging service. It maintains persistence by modifying the rc.local file and changing the RedHat package manager’s configuration to survive system upgrades.
The backdoor injects a dynamic library into the nginx process, altering the accept() function. This allows attackers to use a 48-byte “magic knock” for covert communication through existing open ports, making detection more difficult.
The backdoor’s functionalities include:
Reading and writing files on the target system.
Providing shell access for remote command execution.
Establishing single or multi-port network tunnels, enabling secure communication channels with other compromised nodes.
Setting up a SOCKS5 proxy for covert data transfer.
Northwave explains, “The backdoor supports running commands in a shell. Output from stdout or stderr is forwarded to the user… ” ensuring robust control over the compromised device.
The backdoor uses a flexible communication protocol that separates operator connections from device-to-device communications with unique identifiers, allowing for a structured command system across infected devices.
Although it’s not confirmed, the complexity of LITTLELAMB.WOOLTEA suggests a nation-state actor. Northwave said, “A suspected nation state threat actor gained entry to a Palo Alto network device through CVE2024-9474, shortly after details of the vulnerability were made public.”
Source: Northwave cybersecurity, securityonline
