Chinese APT group develops EggStreme Fileless Malware

A Chinese APT group has been linked to the breach of a Philippines-based military company, via a new fileless malware framework, called EggStreme.

“This multi-layered tool achieves persistent, low-profile espionage by injecting malicious code directly into memory and leveraging DLL sideloading to execute payloads,” said researcher Bogdan Zavadovschi.

“The core component, EggStremeAgent, is a complete backdoor that allows for extensive system identification, persistence, and data theft via an integrated keylogger.“.

Targeting the Philippines is a recurring pattern for Chinese state-backed hacking groups, particularly in light of geopolitical tensions fueled by territorial disputes in the South China Sea between China, Vietnam, the Philippines, Taiwan, Malaysia and Brunei.

See also: CyberVolk ransomware targets critical infrastructure

Bitdefender detected the first signs of malicious activity in early 2024 and described EggStreme as a set of malicious components designed to establish a “durable foothold” on infected machines.

EggStreme: Multi-stage infection

The starting point is a payload called EggStremeFuel (“mscorsvc.dll”). It profiles the system and deploys the EggStremeLoader to create persistence. It then executes the EggStremeReflectiveLoader, which, in turn, activates the EggStremeAgent.

EggStremeFuel features include:

– Get disk information
– Start cmd.exe and establish communication via pipes
– Close all connections and shut down
– Read a file from the server and save it to disk
– Read a local file from a given path and transmit its contents
– Send the external IP address by making a request to myexternalip[.]com/raw
– Dump in-memory configuration to disk

EggStremeAgent is the “central nervous system” of the EggStreme framework. The backdoor monitors new user sessions and inserts a keylogger called EggStremeKeylogger for each session to collect keystrokes and other sensitive data. It communicates with a C2 server using the Google Remote Procedure Call (gRPC) protocol.

It supports 58 commands that enable a wide range of capabilities to facilitate local and network discovery, system enumeration, shellcode execution, privilege escalation, lateral movement, data extraction, and payload injection, including a helper implant codenamed EggStremeWizard (“xwizards.dll”).

See also: DarkSamural: New malicious campaign targets critical infrastructure

"Attackers use this to launch a legitimate binary that loads the malicious DLL, a technique they consistently abuse throughout the attack chain," Zavadovschi noted.

“This secondary backdoor provides reverse shell access and file upload/download capabilities. Its design also incorporates a list of multiple C2 servers, enhancing its resilience and ensuring that communication with the attacker can be maintained even if a C2 server goes down“.

The malicious activity is also characterized by the use of the Stowaway utility to establish an internal network base. Detection is further complicated by the fileless nature of the EggStreme framework itself, causing malicious code to be loaded and executed directly in memory without leaving a trace on disk.

“This, combined with its heavy use of DLL side-loading and complex, multi-layered execution flow, allows the framework to operate with a low profile, making it a significant and persistent threat,” Bitdefender said.

“The EggStreme malware family is a highly sophisticated and complex threat designed to achieve persistent access, lateral movement, and data exfiltration. The threat actor demonstrates an advanced understanding of modern defense techniques by employing a variety of tactics to evade detection.“.

See also: The Gentlemen ransomware: Meet the new threat

Malware protection

Static detection methods for security are not enough to avoid malware . A more robust approach should incorporate antivirus software , equipped with advanced analysis capabilities.

It's also important to keep your operating system and applications up to date. These updates often include security that can protect your computer from the latest threats.

Information security training is also crucial. This means knowing how to recognize and avoid phishing attacks , which attackers often use to install malware.

Also, don't forget to use firewalls and monitor network traffic to help you immediately detect suspicious activity. Users to avoid executable files downloaded from strange websites.

Finally, using strong passwords and enabling two-factor authentication can provide an extra layer of protection. This can make it harder for attackers to gain access to your account, even if they manage to steal your password.