ESET researchers have
recently released information on the discovery of a new backdoor dubbed Crutch that uses Dropbox to exfiltrate
stolen files. Crutch has been seen as
early as 2015 and is believed to be a second-stage backdoor that is deployed
after a victim has already been compromised. Researchers have seen the Skipper implant and the PowerShell Empire post-exploitation
agent used as initial infection vectors. Until July 2019, Crutch v3 used an architecture based on
manual input of commands through Dropbox that are then run on the victim’s
machine. It included a monitor for removable drives that looked for files with certain extensions, such as .pdf, .rtf, .doc, and .docx,
then compressed and staged the
files for exfiltration. These files were then uploaded to a hard-coded Dropbox account controlled
by the attackers. Persistence was maintained by using
hijacked browser processes in Chrome, Firefox,
or OneDrive. In one
instance, the Crutch operator even left a little taunt
for the victim,
running the command “mkdir %temp%Illbeback”.
In July of 2019, researchers discovered a newer version of Crutch that was auto- mated rather than
having the operator run commands manually. The
persistence mechanism changed to using a Microsoft
Outlook component, Finder, rather than the browser processes. The drive monitor also got a makeover
and could now monitor local drives as well as removable drives. Interesting
files are still compressed, encrypted, and staged for exfiltration. Instead of
the operator manually uploading them to Dropbox, however, Crutch v4 now uploads the files
automatically using the Windows version of the wget utility.
ESET researchers
have attributed Crutch to the
Russians peaking APT group Turla.
They discovered several strong links between a 2016 version of the Crutch dropper and a Turla tool called Gazer. For instance,
both samples were found on the same machine within
a 5-day period, PDB paths were almost identical, and they both used the exact
same RC4 key to decrypt their payloads.
“Given these
elements and that Turla malware
families are not known to be shared among different groups, we believe that Crutch is a malware family that is part
of the Turla arsenal,” says the ESET
release. Crutch was also discovered
on the network of the Ministry of Foreign Affairs in an undisclosed European
Union country, which also aligns with Turla’s
previous strategies targeting gov- ernments, embassies, and military
organizations.
Sources:
Turla’s ‘Crutch’ Backdoor Leverages Dropbox in Espionage Attacks | Threatpost
Turla Crutch: Keeping the “back door” open | WeLiveSecurity
Experts Uncover ‘Crutch’ Russian Malware Used in APT Attacks for 5 Years (thehackernews.com)