Cybersecurity researchers have offered insight into a system known as Double Feature. The system tracks different stages of post-exploitation originating from the DanderSpiriz—a full-featured malware framework deployed by the Equation group.
DanderSpirtz was first discovered on April 14, 2017; DanderSpritz was discovered when Shadow Brokers, a hacking group, revealed the exploit tool under a dispatch labeled “ Lost in Translation.” The hacking group also revealed EternalBlue. The U.S. National Security Agency (NSA) developed the exploit EternalBlue, which allowed threat actors to plant NotPetya ransomware on unpatched Windows computers.
The tool is a modular, sneaky and completely operational framework that uses dozens of plugins for exploiting Windows and Linux hosts. Check Point researchers published a report which states that DoubleFeature operates as a “diagnostic tool for victim machines carrying DanderSpritz,”
Also read,
https://cyberdaily.securelayer7.net/wp-admin/post.php?post=7284&action=edit
“DoubleFeature could be used as a sort of Rosetta Stone for better understanding DanderSpritz modules, and systems compromised by them,” the Israeli cybersecurity firm added. “It’s an incident response team’s pipe dream.”
Double Feature, a python-based dashboard, is designed to record tool types that could be planted in a target system, and it can also be used as a reporting utility to remove the logging information from the infected machine to an attacker-controlled server. The output is construed via a specialized executable named “DoubleFeatureReader.exe.”
Some of the plugins monitored by DoubleFeature include remote access tools called UnitedRake (aka EquationDrug) and PeddleCheap, a stealthy data exfiltration backdoor dubbed StraitBizarre, an espionage platform called KillSuit (aka GrayFish), a persistence toolset named DiveBar, a covert network access driver called FlewAvenue, and a validator implant named MistyVeal that verifies if the compromised system is indeed an authentic victim machine and not a research environment.
“Sometimes, the world of high-tier APT tools and the world of ordinary malware can seem like two parallel universes,” the researchers said. “Nation-state actors tend to [maintain] clandestine, gigantic codebases, sporting a huge gamut of features that have been cultivated over decades due to practical need. It turns out we too are still slowly chewing on the 4-year-old leak that revealed DanderSpritz to us, and gaining new insights.”
References:
https://thehackernews.com/2021/12/experts-detail-logging-tool-of.html?&web_view=true
