Disclosing the BLOODALCHEMY backdoor | Hacker News Reader

Disclosing the BLOODALCHEMY backdoor

elastic.co

53 pointsskilled13 comments

  Summary

  BLOODALCHEMY is a backdoor shellcode containing only original code(no statically linked libraries).
  This code appears to be crafted by experienced malware developers.
  
  The backdoor contains modular capabilities based on its configuration. These capabilities include
  multiple persistence, C2, and execution mechanisms.
  
  While unconfirmed, the presence of so few effective commands indicates that the malware may be a
  subfeature of a larger intrusion set or malware package, still in development, or an extremely focused
  piece of malware for a specific tactical usage.

Omitted from summary: In Microsoft Windows

Omitted from entirety of article: Which versions of Windows. Maybe some readers care. I do not! :)

Omitted from entirety of article: Why it has such a silly name. I would cut them some slack if it exploited a lib named BLDLCM.DLL or something like that, but it seems the name is just more silliness for the sake of silliness?

Names crafted like ALLCAPSNOUNVERB are usually government issued internal names that are used once and are unambiguous while also giving no hint to what they refer to, in the case of information leaks.

The author did not name it, but the state-sponsored actor did (either the one that wrote it, in cases of tool leaks, or the one that first identified it, in the cases of foreign tool identification).

>The author did not name it, but the state-sponsored actor did (either the one that wrote it, in cases of tool leaks, or the one that first identified it, in the cases of foreign tool identification).

From the article, there is no indication that the name comes from whoever authored the software. Sounds made up, and the way they obfuscate strings in the code makes me think it is not from a state-actor (definitely not one in the west).

https://www.elastic.co/security-labs/introducing-the-ref5961...

This contains language that leads me to believe they take contract work from state entities. So, either their sponsor names these, or they have internally taken to this style to better integrate into the state security apparatus.

That's reasonable enough. But ALCHEMY is not a verb.

This is true. The verb would be Alchemise.

There is no real hard rules on how to make these names, other than they have to be memorable, unique, and not actually describe the thing they're naming. Having a noun that can be verbed works well enough.

Thinking further though, I assume government project name generators have word lists, and I assume that BLOOD is not in those lists.

The general proximity of both words to the retro previous-century hacker subculture conceit (guilty!) suggests to me that this name was chosen. I could be wrong, of course.

yeah; not explaining the main platform / device this impacts anywhere clearly is a bad miss. the author / reveiwer should fix.

Interesting, from the title I thought Elastic was disclosing a backdoor in Elasticsearch. However, this is the security team disclosing that they found a new piece of malware.

Malware that exploits a brother industries exe, which is vulnerable to loading a malware DLL named the same as a legit one.

Possibly to do with printers ?

Not very clear if the exe has been patched since, as the article talks about a exe with an expired signature

Attackers use vulnerabilities in MS-signed 3rd party drivers as malware loaders. Most attackers use drivers with known vulnerabilities, but every now and then they come up with something new.

More details and mitigation instructions can be found here: https://learn.microsoft.com/en-us/windows/security/applicati...

Much of what is written on the page is over my head. Do they explain why they gave it an edgy name?

They do not. It appears to be yet another subtool or part of a tool chain for exploration.

Reply on news.ycombinator.com