let’s make malware but it might get caught so the malware gets worse

let’s make malware but it might get caught so the malware gets worse

Speakers: Alex, Red Team Operator

Conference: CHCon

YouTube: https://www.youtube.com/watch?v=HTqBSRImBt4

Overview

In this engaging and insightful CHCon talk, security expert Alex, a seasoned Red Team Operator known for his past exploits (including discovering former Australian Prime Minister Tony Abbott's passport details online), delves into the evolving tactics of malware development. Titled "let’s make malware but it might get caught so the malware gets worse," the presentation strips away the mystique of sophisticated cyberattacks, guiding the audience through a progressive journey of building and refining malware to evade detection and maintain persistence. Alex's unique blend of technical expertise and humorous delivery makes complex concepts accessible, highlighting the constant arms race between attackers and defenders.

The talk is a practical exploration of adversary emulation, demonstrating how malicious software is designed not just to gain initial access, but to withstand scrutiny from incident response teams and remain operational within a compromised environment. Alex meticulously details the incremental improvements an attacker makes when their initial, simpler malware strategies are thwarted by common defensive measures. This iterative process, driven by the need to bypass increasingly robust security controls like Multi-Factor Authentication (MFA), Zero Trust architectures, and sophisticated Endpoint Detection and Response (EDR) systems, ultimately leads to more complex and resilient malware.

For red teamers, the talk provides a blueprint for crafting more realistic and effective attack simulations, mirroring the methods of actual cybercriminals. For blue teamers and incident responders, it offers crucial insights into the mindset and technical evolution of their adversaries. By understanding how malware "gets worse" – meaning, more advanced and evasive – defenders can anticipate future threats, bolster their detection capabilities, and strengthen their overall security posture against persistent and adaptive attackers.

Background

▶ Watch: Speaker intro, "Alex with double quotes", red teaming (0:00)

The premise of Alex's talk is rooted in the fundamental definition and purpose of malware. He describes malware as essentially remote control software, akin to a hacker gaining SSH access to a victim's computer. This simplified analogy helps demystify the core function: enabling an attacker to execute commands and control a remote system. The "why" behind using malware, whether by cybercriminals or red team operators engaged in adversary emulation, boils down to two primary objectives: bypassing advanced authentication mechanisms and circumventing network segmentation.

Firstly, malware offers a potent method to bypass Multi-Factor Authentication (MFA) and Two-Factor Authentication (2FA). While these controls significantly enhance security, they often protect only the initial login. Alex illustrates a common technique: once malware is established on a user's machine, an attacker can exfiltrate browser data, including cookies and session tokens. By copying the victim's browser profile (e.g., Google Chrome data) to their own machine, the attacker can effectively "log in" as the victim without needing their password or 2FA challenge, as the browser session is already established and authenticated. This technique bypasses the hard-earned security of MFA by exploiting the post-authentication state.

Secondly, malware serves as an invaluable tool for navigating Zero Trust networks and Virtual Private Networks (VPNs). These architectures are designed to restrict network access based on strict identity, device posture, and context. An external attacker typically cannot access internal resources directly. However, if malware is present on an internal machine, the attacker can use that compromised host as a proxy. By routing their network traffic through the victim's computer, the attacker's requests appear to originate from a trusted, internal device. This allows them to bypass the stringent controls of Zero Trust and VPNs, gaining access to internal production networks and sensitive resources that would otherwise be unreachable. These two motivations underscore why malware, despite its inherent risks and complexities, remains a critical component in the arsenal of sophisticated attackers.

Key Findings

▶ Watch: Basic malware architecture: C2 and open-source tools (7:30)

The central finding of Alex's talk is the iterative and reactive nature of advanced malware development. Attackers, whether real criminals or red teamers, don't just deploy a single piece of malware and hope for the best. Instead, their tools and techniques evolve in direct response to defensive measures. The talk demonstrates a clear progression from basic remote access to highly sophisticated, evasive, and persistent operations, driven by the need to counter increasingly effective security controls.

Key findings include:

• The Foundational Command and Control (C2) Model: At its core, malware relies on a C2 architecture where compromised endpoints communicate with an attacker-controlled server to receive commands and exfiltrate data. This model is the bedrock upon which all further refinements are built.
• The Necessity of Persistence: Initial execution is insufficient. Malware must achieve persistence to survive system restarts, user actions (like closing terminals), and even basic cleanup efforts. This involves techniques like backgrounding processes and embedding startup commands within legitimate-looking configuration files.
• The Power of Redirected Infrastructure: To evade network-based detection and attribution, attackers employ redirected infrastructure. This involves using intermediate servers (redirectors) that act as a façade, obscuring the true C2 server and making it harder for incident responders to identify and block the command and control channel.
• The Imperative of Unique Payloads: Simple hash-based detection renders identical malware binaries useless after a single compromise. Therefore, sophisticated operations demand unique malware payloads for each target, each with distinct hashes and potentially different embedded C2 domains, preventing widespread detection through a single Indicator of Compromise (IOC).
• Advanced Delivery with Staged Payloads: Direct delivery of the final, sensitive malware binary is risky. Staged payload design mitigates this by first delivering a benign-looking "downloader" that then fetches the actual malicious payload from a separate, controlled server. This adds a layer of indirection and reduces the exposure of the primary attack tool.
• Intelligent Evasion via User-Agent Filtering: To further thwart analysis and ensure the right target receives the malicious payload, attackers can implement User-Agent based filtering on their malware hosting servers. This allows the server to serve the actual malware only if the request comes from the specific, custom User-Agent embedded in the downloader, otherwise serving a harmless file to throw off researchers.
• The Endless Arms Race: Ultimately, the talk underscores that perfect malware is an elusive goal. Each refinement addresses a specific defensive countermeasure, leading to an ongoing cycle of attack and defense, where attackers constantly adapt their tools to "get worse" in terms of sophistication and evasiveness.

Technical Deep Dive

▶ Watch: Achieving malware persistence and hiding execution (10:30)

Alex's talk meticulously deconstructs the process of building malware, starting from a rudimentary concept and progressively enhancing it to bypass common defensive measures. The journey begins with the core Command and Control (C2) architecture.

Command and Control (C2) Architecture

The fundamental C2 model involves three main components:

1. Malware on the Target: A piece of code executed on the victim's computer.
2. C2 Server (crimecentral.com): An attacker-controlled server that the malware communicates with. This server issues commands and receives exfiltrated data.
3. Attacker: The operator who interacts with the C2 server to control the malware and collect information.

The malware initiates a connection to the C2 server, requesting instructions. The C2 server responds with commands (e.g., "find SSH keys"). The malware executes these commands and sends the results back to the C2 server, which the attacker can then retrieve.

Malware Generation and Communication

For practical malware generation, Alex highlights the use of open-source malware frameworks. He specifically mentions Sliver, a Go-based cross-platform C2 framework often used by red teams. These frameworks simplify the process of creating custom malware binaries. A typical command for generating a payload might look like:

generate --mtls --http --skip-symbols --os windows --arch amd64 --save payload.exe

The crucial aspect here is the choice of communication protocol. HTTPS is preferred because it blends in with legitimate web traffic, making it harder to detect anomalies on the network. The generated malware is configured to communicate with a specified C2 domain (e.g., crimecentral.com) over HTTPS.

Persistence Mechanisms

Initial execution of malware is often fleeting. To ensure continuous access, attackers implement persistence. Alex outlines several techniques:

• Backgrounding and Detaching:
• Simply running a command with & (e.g., ./malware &) backgrounds the process, allowing the user to continue using the terminal. However, the process remains a child of the shell and will terminate if the terminal is closed.
• The disown command (e.g., ./malware & disown) detaches the backgrounded process from the parent shell. This ensures the malware continues running even if the terminal window is closed, as the shell "disowns" the child process.
• Hiding Output: To prevent suspicious output (like process IDs) from appearing in the terminal, all standard output and standard error are redirected to /dev/null:

./malware >/dev/null 2>&1 & disown

• Autostart on Reboot: To survive system restarts, malware needs to be configured to launch automatically. Alex suggests modifying shell initialization files like ~/.bash_profile or ~/.zshrc. To make this less obvious, instead of embedding the full malware command directly, an attacker can mimic legitimate software patterns. For instance, the Node Version Manager (NVM) often adds a line to ~/.bash_profile that sources another script (e.g., [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"). An attacker can leverage this by adding a similar line that sources their own malicious script, thus hiding the actual malware command within a less frequently inspected file.

Evasion of Incident Response (IR)

As defenders improve their ability to detect C2 communications and malware binaries, attackers must evolve their infrastructure and payloads:

• Redirected Infrastructure:
• Problem: A single C2 domain (crimecentral.com) becomes an easy Indicator of Compromise (IOC). Once detected, it's blocked, and all associated compromises are found.
• Solution: Introduce an intermediate server, a redirector (also known as a domain fronting or reverse proxy server), between the malware and the true C2. This redirector uses a benign-looking domain name (e.g., legit-service.com) and an HTTP reverse proxy to forward traffic to the actual C2.
• Benefits: Obfuscates the real C2, allows for rapid rotation of redirector domains if one is burned, and makes attribution harder. Attackers can use cheap, disposable hosting (even offshore DMCA-ignored providers) for these redirectors, making them easy to provision and discard. Each target can receive a unique redirector, preventing a single compromise from exposing the entire operation.
• Unique Payloads:
• Problem: If all malware binaries are identical, their file hash serves as a strong IOC. Once detected on one machine, security tools can quickly find all other instances across the network.
• Solution: Generate a unique malware binary for each target. This means embedding a different redirector domain, using slightly different compilation options, or adding minor obfuscation to ensure each payload has a distinct file hash. This forces IR teams to rely on more complex behavioral analysis rather than simple hash matching.

Advanced Delivery & Obfuscation: Staged Payloads

To further reduce the risk of exposing the full malware payload and its capabilities, attackers employ staged payload design:

• Malware Downloader: Instead of directly hosting the final malware binary (which might be large, complex, and easily flagged) on an initial access vector (e.g., a GitHub repository used for social engineering), the attacker provides a small, less suspicious malware downloader. This downloader is the first stage.
• Malware Hosting Server: A separate server hosts the actual, full-featured malware payload. The downloader, once executed, fetches this second-stage payload.
• User-Agent Based Filtering: To ensure only the intended downloader receives the actual malware, the malware hosting server can implement User-Agent filtering. The downloader is programmed to use a specific, custom User-Agent string (e.g., Python-urllib/20.31 – a version that doesn't actually exist, making it unique). The server checks this User-Agent:
• If the request contains the correct, secret User-Agent, the server delivers the actual malware payload (e.g., a backdoored VPN client).
• If the request has a different or generic User-Agent (e.g., from a security researcher or automated scanner), the server delivers a benign file (e.g., a legitimate, unbackdoored VPN client or a harmless script).

This technique adds a crucial layer of defense, preventing unintended recipients or automated analysis tools from obtaining the full malware and understanding its capabilities, thus preserving the attacker's tradecraft.

Alex concludes by acknowledging that even with all these refinements, malware is never "perfect." Issues like insufficient obfuscation, lack of SOCKS proxying, disk writes, and predictable persistence methods (like .zshrc modification) remain challenges that attackers continuously address, demonstrating the perpetual evolution of offensive security techniques.

Demo / Proof of Concept

▶ Watch: Staged payloads and unique user agent authentication (17:45)

While Alex's talk did not feature a live, interactive demonstration of malware execution in a sandbox environment, he provided a highly effective conceptual walkthrough peppered with command-line examples and visual aids. He illustrated the steps involved in generating malware using a framework like Sliver, showing the actual commands an attacker would type to create a payload with specific C2 communication parameters (e.g., using HTTPS and a custom C2 domain).

He then visually demonstrated the impact of various persistence techniques, such as the output generated by backgrounding a process (&), the removal of process association using disown, and the redirection of standard output/error to /dev/null. The speaker also presented code snippets for ~/.bash_profile modifications, showing how seemingly benign lines of code could be used to source malicious scripts, mimicking legitimate software like NVM.

The explanation of redirected infrastructure and staged payloads was accompanied by network diagrams that clearly depicted the flow of communication between the malware, redirector, C2 server, and malware hosting server. These visual representations, combined with detailed explanations of the logic behind User-Agent filtering and the benefits of unique payloads, served as a compelling conceptual proof-of-concept, effectively conveying the technical intricacies without the need for a live demo. The focus was on understanding the how and why of each technique, rather than merely showing a tool in action.

Defensive Implications

▶ Watch: The never-ending challenge: remaining malware problems (20:00)

Alex's talk, by showcasing the attacker's evolving mindset and techniques, provides critical insights for defenders. The progressive sophistication of malware necessitates a shift from reactive, signature-based defenses to proactive, behavioral, and architectural security measures.

1. Enhance Endpoint Detection and Response (EDR) Capabilities:

• Beyond Hash-Based Detection: Since attackers generate unique malware hashes for each target, relying solely on file hashes is insufficient. EDR solutions must focus on behavioral analysis, detecting suspicious process relationships, unusual network connections, and unexpected modifications to system files or user profiles (e.g., ~/.bash_profile).
• Process Monitoring: Monitor for processes detaching from their parent shells (disown behavior), unexpected command-line arguments, or processes running with elevated privileges.
• Disk Write Monitoring: As Alex points out, if malware doesn't run in memory, its disk writes can be observed. EDRs should log and analyze all disk I/O, especially concerning executable files or sensitive data.

1. Strengthen Network Monitoring and Traffic Analysis:

• C2 Traffic Detection: Look for anomalous HTTPS traffic, particularly connections to newly registered domains, domains with low reputation scores, or known offshore hosting providers (as Alex mentioned, like "Alex Host").
• Custom User-Agent Detection: Network intrusion detection systems (NIDS) and proxies should be configured to flag or block unusual User-Agent strings, especially those that are non-standard or known to be used by specific C2 frameworks. The example Python-urllib/20.31 is a perfect illustration of a custom, non-existent User-Agent that should raise an alert.
• Traffic Patterns: Analyze C2 beaconing patterns (e.g., regular, short connections) that differ from typical user activity.

1. Improve Identity and Access Management (IAM) and Zero Trust Implementation:

• Protect Browser Sessions: While MFA is crucial, defenders must recognize that it can be bypassed post-authentication by session theft. Implement Conditional Access Policies that frequently re-authenticate users, enforce device health checks, and limit session lifetimes. Consider browser isolation or containerization for high-risk users.
• Device Certificate Integrity: For Zero Trust, ensure that device certificates are securely managed and that any compromise of a device leads to immediate revocation of its certificate and network access.

1. Bolster Social Engineering Awareness and Email Security:

• User Training: Continuously educate users about the dangers of social engineering, emphasizing vigilance against suspicious links, attachments, and requests, even if they appear to come from trusted sources. Highlight the risk of downloading and executing files from untrusted sources, even if they seem to be "downloaders" for legitimate software.
• Email Gateway Security: Implement advanced email security solutions that can detect malicious links, analyze attachments for staged payloads, and flag emails with unusual sender characteristics or content.

1. Focus on Proactive Threat Hunting and Incident Response:

• Assume Compromise: Adopt a mindset that compromise is inevitable. Focus on detecting persistence mechanisms and lateral movement rather than solely preventing initial access.
• Indicator of Behavior (IOB) over Indicator of Compromise (IOC): Incident response teams should prioritize understanding the attacker's Tactics, Techniques, and Procedures (TTPs) rather than relying solely on easily mutable IOCs like file hashes or C2 domains. This allows for detection of variations of known attack methods.
• Supply Chain Security: Be wary of seemingly benign scripts (.bash_profile, NVM init scripts). Regularly audit these files for unauthorized modifications and ensure that software installations are from trusted, verified sources.

By internalizing the lessons from Alex's talk, defenders can move beyond simply reacting to known threats and instead build a more resilient and adaptive security program that anticipates and mitigates the "worsening" nature of modern malware.

Key Takeaways

• Malware Evolution is Reactive: Attackers continuously refine their malware and infrastructure in direct response to defensive countermeasures, making sophisticated attacks an ongoing arms race.
• Persistence is Paramount: Gaining initial access is only the first step. True success for an attacker lies in establishing robust persistence mechanisms to maintain control over a compromised system, surviving reboots and user actions.
• Layered Infrastructure for Evasion: Sophisticated operations utilize redirected infrastructure (e.g., intermediate proxy servers) to obscure the true Command and Control (C2) server, making detection, blocking, and attribution significantly harder for defenders.
• Unique Payloads Defeat Hash-Based Detection: To avoid widespread detection from a single compromise, attackers generate unique malware binaries for each target, ensuring distinct file hashes and C2 domains, forcing defenders to rely on more complex behavioral analysis.
• Staged Delivery and Intelligent Filtering: Advanced attackers employ staged payload designs, where a benign-looking "downloader" fetches the actual malicious payload. This is often coupled with User-Agent filtering on the malware hosting server to ensure only the intended, custom-configured downloader receives the sensitive payload.
• Defenders Must Adapt to TTPs: To effectively counter these evolving threats, defenders must shift their focus from simple Indicators of Compromise (IOCs) to understanding the attacker's Tactics, Techniques, and Procedures (TTPs), enhancing behavioral detection, and strengthening network and endpoint monitoring for subtle anomalies.

About the Speaker(s)

Alex, who humorously introduces himself as "Alex with double quotes" due to past journalistic portrayals, is a highly experienced Red Team Operator. His professional background includes working at major companies like Atlassian, where he honed his skills in adversary emulation – essentially, ethically hacking organizations to identify vulnerabilities before real criminals do. Alex is known for his practical approach to security, having gained public attention for discovering and responsibly disclosing the passport and phone number of former Australian Prime Minister Tony Abbott online. Beyond his red teaming work, Alex is actively involved in the security community, co-organizing PurpleCon, a conference that bridges the gap between offensive and defensive security. He also runs "Mango PDF Communication," a venture dedicated to teaching technical experts, including hackers, how to communicate complex ideas clearly to non-technical audiences. His talk reflects his deep understanding of attacker methodologies and his ability to articulate them in an engaging and accessible manner.