Cranefly espionage group uses a stealthy malware technique by hiding commands inside legitimate Microsoft IIS logs. The Geppei dropper reads these disguised web requests to deploy malware such as the Danfuan backdoor, which can execute C# code. Cranefly also uses the QUIETEXIT backdoor on network appliances with limited security monitoring, helping maintain long-term access for intelligence gathering while avoiding detection.
Web-based cybersecurity attackers use “stealthier techniques” which are not as “noisy” as active attacks, making it easier to continue undetected for a longer period of time. Stealthy techniques are employed by malware developers which utilize various mechanisms to avoid detection. It takes its name from the term stealth, which describes an approach to doing something while avoiding notice. Once injected into a computer, the stealthier techniques enable the malware to operate and gain control over parts of the system or the entire system without issuing any alerts or notifying the user of its presence.
A news report broadcasted by the hacker news outlines the Sealthy Techniques revealed by researchers from Symantec which are being utilized by Cranefly Espionage Hackers. The Cranefly Espionage hackers group is recognized for attacking bulk email collections of employees that worked in corporate development, mergers, acquisitions and large corporate transactions. Initial analysis appeared to show a link between the toolset of Cranefly activity and that of a group called UNC3524 which surfaced for the first time in May 2022. These attackers spent at least 18 months on victim networks without retreating data and used backdoors on appliances that didn’t support security tools to remain undetected.
The ever growing scope of expanding attack surfaces is of particular concern in today’s dynamic threat landscape. Cybersecurity resilience from attacks like Cranefly using stealthy techniques involves the continuous discovery, inventory, classification, prioritization, security monitoring and visibility into the systems to identify cyber threats that could facilitate data breaches and data leaks.
