New Tornet Backdoor Seen In Widespread Campaign
Thumbnail
Cisco Talos has identified a financially motivated cyber campaign targeting users in Poland and Germany, utilizing phishing emails to deliver various malware payloads, including Agent Tesla, Snake Keylogger, and a new backdoor named TorNet. The campaign employs sophisticated evasion techniques to avoid detection. Affected: Cisco Secure Endpoint, Cisco Secure Web Appliance, Cisco Secure Email, Cisco Secure Firewall, Cisco Secure Malware Analytics, Umbrella, Cisco Duo

Keypoints :

  • Ongoing malicious campaign discovered by Cisco Talos targeting users in Poland and Germany.
  • Phishing emails impersonate financial institutions and logistics companies.
  • Malware delivered includes Agent Tesla, Snake Keylogger, and a new backdoor called TorNet.
  • The actor employs a Windows scheduled task for persistence, even on low battery.
  • Phishing emails contain compressed attachments using the “.tgz” extension.
  • PureCrypter malware is used to drop and run the TorNet backdoor.
  • TorNet connects to the TOR network for stealthy command and control communications.
  • Malware performs extensive anti-analysis and evasion checks.
  • Cisco security products are recommended for protection against this threat.

MITRE Techniques :

  • Phishing (T1566): The initial infection vector is phishing emails impersonating legitimate organizations.
  • Command and Control (T1071): TorNet establishes a TCP connection to the C2 server.
  • Persistence (T1547): The malware creates a Windows scheduled task to maintain persistence.
  • Obfuscated Files or Information (T1027): The malware uses obfuscation techniques to hide its true purpose.
  • Process Injection (T1055): The backdoor injects itself into the .NET runtime executable process.
  • Network Traffic Obfuscation (T1071): The use of the TOR network for anonymizing C2 communications.

Indicator of Compromise :

  • [domain] 104[.]168[.]7[.]37
  • [url] /filescontentgalleries/pictorialcoversoffiles/
  • [url] /post-postlogin/
  • [file name] .tgz
  • [tool name] TorNet
  • Check the article for all found IoCs.

Full Research: https://blog.talosintelligence.com/new-tornet-backdoor-campaign/