Void Arachne – Threat Actor

Overview

Chinese Individuals

Attack vectors

Phishing

How they operate

At the heart of Void Arachne’s operations is the deployment of malicious MSI files that masquerade as legitimate software installers. These MSI files are ingeniously crafted to include both authentic software—such as AI tools and VPN applications—and the Winos 4.0 backdoor. During the installation process, the MSI file executes the Winos payload silently alongside the legitimate software, granting the threat actor unauthorized access to the victim’s system. The Winos backdoor is particularly notable for its extensive command-and-control capabilities, allowing attackers to remotely control the compromised system, exfiltrate data, and potentially escalate privileges. The initial access vector for Void Arachne’s campaign is multifaceted, involving both SEO poisoning and spear-phishing techniques. The threat actors employ SEO poisoningSEO poisoning by setting up web infrastructure that manipulates search engine rankings, making malicious links appear as top results for commonly searched software. These links, which lead to the download of the compromised MSI files, are designed to exploit users seeking popular applications. Additionally, Void Arachne utilizes spear-phishing tactics by distributing malicious links via social media and messaging platforms, luring victims with seemingly benign software installers. Once the MSI file is executed, it deploys Dynamic Link Libraries (DLLs) that facilitate the installation of the Winos backdoor. The DLLs are crucial for executing the malicious payload, as they perform various functions during runtime to maintain persistence and evade detection. The use of MSI files for this purpose is particularly insidious, as these installers are typically trusted by users, making it easier for the malware to bypass traditional security measures. Void Arachne’s C2 infrastructure is designed to be resilient and evasive. The group operates multiple subdomains under a root domain (e.g., webcamcn[.]xyz), which serve as command-and-control servers. This domain generation approach complicates efforts to block or disrupt their operations, as the threat actor can continuously add new subdomains to their C2 network. The communication between the Winos backdoor and these C2 servers occurs over HTTP/HTTPS, utilizing web traffic for data exfiltration and command relay. The campaign also highlights Void Arachne’s exploitation of the heightened public interest in technologies that circumvent internet censorship, particularly VPNs. By targeting VPN-related software and advertising it through SEO poisoning and social media channels, the threat actor capitalizes on users’ desire for privacy and access to restricted content. This tactic not only increases the likelihood of successful infections but also aligns with the broader trend of using popular software to deliver malware.

MITRE Tactics and Techniques

Initial Access:

SEO Poisoning (T1608.006): The threat actor uses SEO poisoning to make malicious websites rank high in search engine results. These websites host malicious MSI files that, when downloaded, initiate the infection process. Spear Phishing (T1566.002): Malicious links disguised as legitimate software installers are used to lure victims. These links are often distributed through social media and messaging platforms.

Execution:

Malicious MSI Files (T1203): The MSI files used in Void Arachne’s campaign contain both legitimate software and the Winos 4.0 backdoor. When executed, these installers run the Winos payload alongside the intended software. Dynamic Link Libraries (DLLs) (T1073): The MSI installers use DLLs to execute the Winos backdoor. DLLs are employed during the installation process to perform various malicious actions.

Persistence:

Registry Run Keys/Startup Folder (T1547.001): The threat actor may leverage registry run keys or startup folders to maintain persistence on infected systems, ensuring the Winos backdoor remains active after reboot.

Command and Control (C2):

Command and Control Over Web Traffic (T1071): The Winos 4.0 backdoor communicates with C&C servers over HTTP/HTTPS to receive commands and exfiltrate data. Domain Generation Algorithms (T1075): The threat actor uses multiple subdomains under a root domain (e.g., webcamcn[.]xyz) for their C&C infrastructure, making it harder to block all associated domains.

Exfiltration:

Exfiltration Over Web Service (T1041): Data is exfiltrated from compromised systems to the threat actor’s C&C servers via web services, which can be encrypted to evade detection.

Impact:

Data Destruction (T1485): While not a primary technique, the threat actor might leverage destructive payloads or ransomware in specific scenarios to impact targeted systems. Credential Dumping (T1003): If additional payloads are present, they may be used to extract credentials or other sensitive data from compromised systems.

References:

• Behind the Great Wall: Void Arachne Targets Chinese-Speaking Users With the Winos 4.0 C&C Framework