Back to threat feeds
Malware
Lazarus Group Backdoors 3CX Customers with Gopuram Malware
Lazarus group backdoors 3CX customers with Gopuram malware targeting crypto companies.
Continue reading
Lazarus group backdoors 3CX customers with Gopuram malware targeting crypto companies.
Continue reading
On March 29, Crowdstrike released a report about a supply chain attack conducted via 3CXDesktopApp, a popular VoIP program. Since then, the security community has started analyzing the attack and sharing their findings. The infection is spread via 3CXDesktopApp MSI installers, and an installer for macOS has also been trojanized. The malicious installation package contains an infected DLL library that decrypts a shellcode from the d3dcompiler_47.dll library’s overlay and executes it. The decrypted payload extracts C2 server URLs from icons stored in a GitHub repository (the repository is removed). The payload connects to one of the C2 servers, downloads an infostealer and starts it. The infostealer collects system information and browser history, then sends it to the C2 server.
As researchers reviewed available reports on the 3CX attack, they discovered that the increase in Gopuram infections was directly related to the 3CX supply chain attack. The threat actor specifically targeted cryptocurrency companies, dropping malicious files on infected machines. The dropped files included the wlbsctrl.dll malicious library (MD5: 9f85a07d4b4abff82ca18d990f062a84) and an encrypted shellcode payload. Once dropped, wlbsctrl.dll becomes loaded on every startup by the IKEEXT service via DLL hijacking. DLLs with the names ualapi.dll and ncobjapi.dll were also sideloaded into spoolsv.exe and svchost.exe, respectively.
The wlbsctrl.dll library is responsible for decrypting and executing the shellcode stored in the C:\Windows\System32\config\TxR directory. The decryption is notably performed through the CryptUnprotectData API function that uses a different encryption key internally on every machine, making it difficult for researchers to decrypt the payload from the file without physical access to the victim machines.
The component loaded by the library is Gopuram’s main module. Its name in the export directory is guard64.dll. The main module connects to a C2 server and requests commands. The backdoor implements commands that allow the attackers to interact with the victim’s file system and create processes on the infected machine. Gopuram was additionally observed to launch in-memory modules. Gopuram’s modules are DLL files that include an export function named DllGetClassObject. Researchers have observed nine modules so far: Ping, Connect, Registry, Service, Timestomp, Inject, KDU, Update, and Net.
The discovery of the new Gopuram infections allowed researchers to attribute the 3CX campaign to the Lazarus threat actor with medium to high confidence. The attribution is based on the fact that, while investigating an attack on a Southeast Asian cryptocurrency company in 2020, Gopuram was found coexisting on the same machine with the AppleJeus backdoor, which is attributed to Lazarus.
A single ClickFix infrastructure is pushing StealC, Amatera, Remus, NetSupport, CastleLoader and a new loader called ResiLoader through fake Google/Cloudflare checks.
