Researchers Uncover Stealthy Techniques Used by Cranefly Espionage Hackers

A recently discovered hacking group known for targeting employees dealing with corporate transactions has been linked to a new backdoor called Danfuan.

This hitherto undocumented malware is delivered via another dropper called Geppei, researchers from Symantec, by Broadcom Software, said in a report shared with The Hacker News.

The dropper “is being used to install a new backdoor and other tools using the novel technique of reading commands from seemingly innocuous Internet Information Services (IIS) logs,” the researchers said.

The toolset has been attributed by the cybersecurity company to a suspected espionage actor called UNC3524, aka Cranefly, which first came to light in May 2022 for its focus on bulk email collection from victims who deal with mergers and acquisitions and other financial transactions.

One of the group’s key malware strains is QUIETEXIT, a backdoor deployed on network appliances that do not support antivirus or endpoint detection, such as load balancers and wireless access point controllers, enabling the attacker to fly under the radar for extended periods of time.

Geppei and Danfuan add to Cranefly’s custom cyber weaponry, with the former acting a dropper by reading commands from IIS logs that masquerade as harmless web access requests sent to a compromised server.

“The commands read by Geppei contain malicious encoded .ashx files,” the researchers noted. “These files are saved to an arbitrary folder determined by the command parameter and they run as backdoors.”

This includes a web shell called reGeorg, which has been put to use by other actors like APT28, DeftTorero, and Worok, and a never-before-seen malware dubbed Danfuan, which is engineered to execute received C# code.

Symantec said it hasn’t observed the threat actor exfiltrating data from victim machines despite a long dwell time of 18 months on compromised networks.

“The use of a novel technique and custom tools, as well as the steps taken to hide traces of this activity on victim machines, indicate that Cranefly is a fairly skilled threat actor,” the researchers concluded.

“The tools deployed and efforts taken to conceal this activity […] indicate that the most likely motivation for this group is intelligence gathering.”