Security researchers have discovered a malicious campaign by the ‘Witchetty’ hacking group, which uses steganography to hide a backdoor malware in a Windows logo.

Using the Windows logo against you

In this campaign, the hackers refreshed their toolkit to target different vulnerabilities and used steganography to hide their malicious payload from antivirus software.

Steganography is the act of hiding data within other non-secret, public information or computer files, such as an image, to evade detection. For example, a hacker can create a working image file that displays correctly on the computer but also includes malicious code that can be extracted from it.

In the campaign discovered by Symantec, Witchetty is using steganography to hide an XOR-encrypted backdoor malware in an old Windows logo bitmap image.

The file is hosted on a trusted cloud service instead of the threat actor’s command and control (C2) server, so the chances of raising security alarms while fetching it are minimized.

“Disguising the payload in this fashion allowed the attackers to host it on a free, trusted service,” Symantec explains in its report.

“Downloads from trusted hosts such as GitHub are far less likely to raise red flags than downloads from an attacker-controlled command-and-control (C&C) server.”

Next, the threat actors fetch the backdoor hiding in the image file, which enables them to do the following:

• Perform file and directory actions
• Start, enumerate, or kill processes
• Modify the Windows Registry
• Download additional payloads
• Exfiltrate files

Witchetty also introduced a custom proxy utility that causes the infected computer to act “as the server and connects to a C&C server acting as a client, instead of the other way around.”

Other tools include a custom port scanner and a custom persistence utility that adds itself in the registry as “NVIDIA display core component.”

Along with the custom tools, Witchetty uses standard utilities like Mimikatzand to dump credentials from LSASS and abuses “lolbins” on the host, like CMD, WMIC, and PowerShell.

TA410 and Witchetty remain active threats to governments and state organizations in Asia, Africa, and around the globe. The best way to prevent its attacks is to apply security updates as they are released.

In the campaign discovered by Symantec, the hackers rely on exploiting last year’s vulnerabilities to breach the target network, taking advantage of the poor administration of publicly exposed servers.

Original posts: Hacking group hides backdoor malware inside Windows logo image