“It hooks a lot of functions, like the system functions. It hides files, processes, network connections from the user land anti-malware tools. So it's decently sophisticated, I would say. And in terms of speed, I would say, as we saw, that they also used AI for writing their POCs and starting to target those companies, which we have mentioned in the research as well.”
sputnikintelligence.com
Dave Bittner asked how sophisticated the threat actor was. Singha had just been describing the group's custom loader and its Linux rootkit, and here he describes what the rootkit does. He adds that the group used AI to write proof-of-concept exploits and speed up its targeting. In this passage "it" is the rootkit and "they" are the attackers.
…the arsenal, they were going ahead and trying to target that. But there was a small log, which I remember, which mentioned they were targeting a voting database in the US, but they failed to. So that's something very interesting, even we mentioned in our research. So that's all about the targeting.
How would you rate the sophistication of this threat actor?
…machines, which they did compromise. And also, they, I mean, as I mentioned, like, you know, they could drop the rootkit, and the rootkit was already present in the loader. And this is a few of the interesting things. And like, in terms of technical sophistication, when I talk about for Jitterly and for the rootkit sigzuit, so it was basically it's quite sophisticated as well. And, you know, it hooks a lot of functions, like the system functions. It hides files, processes, network connections from the user land anti-malware tools. So it's decently sophisticated, I would say. And in terms of speed, I would say, as we saw, that they also used AI for writing their POCs and starting to target those companies, which we have mentioned in the research as well.
And what would be your recommendations for defenders out there to protect themselves against this sort of thing?
The best mitigation against this threat, I would say, as we saw, they have been abusing the GTF vulnerability and that to ND. So the simplest way is to go ahead and patch and also not to expose previously GTA or previous versions of GTA to the internet or maybe use VPN or authenticated reverse…
Our thanks to Subhajeet Singha from Acronis for joining us. The research is titled Red Heron Exploits Gatia Ende Flaw in Multinational Campaign, Exposing New Linux Rootkit. We'll have a link in the show notes. And that's Research Saturday brought to you by N2K Cyberwire. We'd love to know what you…