ToneShell: The Backdoor Exploiting RDP Certificates to Target VIPs

The ToneShell backdoor, a cyber espionage tool associated with the Mustang Panda threat group, has been used to target attendees of the 2024 IISS Defense Summit in Prague, which highlights the intersection of cyber espionage and international strategy as nations seek to gather sensitive security and defense information. 

The IISS Prague Defence Summit, a new event focused on defense and security in the Euro-Atlantic region, is a potential target for cyber espionage. 

With attendees including senior political leaders and defense officials, the summit offers adversaries a valuable opportunity to gain insights into sensitive military strategies, defense cooperation, and responses to geopolitical tensions. 

Cyberattacks could compromise the confidentiality of discussions, potentially providing adversaries with a strategic advantage.

Analysts discovered a suspicious executable, “IISS PRAGUE DEFENCE SUMMIT (8–10 November 2024 ).exe,” during triage on Hatching Triage, whose relevance to a high-profile event raised concerns, prompting further investigation. 

Analysis of the PCAP revealed network traffic communication with a C2 server using the magic bytes “17 03 03,” a known indicator of Toneshell and PubLoad malware activity. Additionally, the same executable exhibited similar behavior on ANY.RUN, solidifying suspicions of malicious intent. 

The archive used in this attack employs social engineering tactics through a decoy PDF. Upon extraction, the archive presents two folders: one containing the malicious executable and another containing a seemingly legitimate PDF titled “Annex 2 – IISS PRAGUE DEFENCE SUMMIT… – Copy.pdf.” 

This PDF is an exact replica of a genuine document found on the IISS website, with the only difference being its filename, which aims to build trust in the target by presenting a familiar and relevant document, lowering suspicion and allowing the malware to run undetected in the background. 

An attacker sent a ZIP file containing a decoy PDF and a malicious PIF file disguised as an agenda document that dropped SFFWallpaperCore.exe and libemb.dll and used a scheduled task to run SFFWallpaperCore.exe every 6 minutes. 

SFFWallpaperCore.exe likely sideloaded libemb.dll, a Mustang Panda C++ DLL containing references to Twitter accounts and communicating with the C2 server at 103.27.108.14 on port 443 using raw TCP disguised as TLS. 

APT group Mustang Panda is using self-signed RDP certificates to hide their C2 server, which is hosted on Topway Global Limited’s ASN in Hong Kong. The RDP certificate was issued on August 25, 2021, and only lasted for a short period of time. 

Hunt’s Advanced Search identified other servers using the same certificate; all except one are on the same ASN as the C2 server, which suggests that these servers are likely controlled by the same threat actor and are used for maintaining operational control and flexibility.

Also Read:

RAMBO: The New Cyber Attack That Hijacks Data from Air-Gapped Systems

See more