Stealthy ‘LabRat’ Campaign Abuses TryCloudflare to Hide Infrastructure

A newly discovered financially motivated operation is relying on signature-based tools and stealthy cross-platform malware to remain undetected, and abuses TryCloudflare to hide its command-and-control (C&C) infrastructure, cloud security company Sysdig reports.

Dubbed LabRat and focused on cryptomining and proxyjacking, the campaign was seen relying on binaries written in Go and .NET, kernel-based rootkits, and C&C tools to bypass firewalls.

The attackers exploited CVE-2021-22205, a critical-severity vulnerability impacting GitLab Community Edition (CE) and Enterprise Edition (EE) versions 11.9 to 13.10.3, 13.9.6, and 13.8.8. Patched in April 2021, the vulnerability has a CVSS score of 10.

The bug leads to unauthenticated remote code execution and, as part of this campaign, the attackers exploited it to deploy a script to achieve persistence, kill specific processes to evade defenses, download additional binaries, and perform lateral movement by harvesting SSH keys.

To obfuscate their infrastructure, the attackers created subdomains Cloudflare’s TryCloudflare service. For that, they only needed to download and install Cloudflared, and run a specific command.

Through TryCloudflare, the attackers redirected connections to a password-protected server hosting the initial script, generating a new subdomain for each iteration of the script.

As part of the observed activity, the attackers linked directly to a private GitLab repository hosting various binaries, including some uploaded there very recently and not yet detected by antivirus services.

Sysdig also discovered a variation of the attack, where a Solr server was used instead of TryCloudflare. Pointing to a legitimate webpage, the server was likely compromised by the attackers and abused as part of the operation.

The LabRat operators were also seen using the open source tool Global Socket (GSocket) – which offers a custom relay or proxy network, encryption, and connectivity over the Tor network – to obtain persistent access to the infected systems.

While investigating the repositories used in this campaign, Sysdig identified files related to a Russian proxyware service called ProxyLite[.]ru, as well as XMRig binaries connecting to various mining pools, including three that were not detected as malicious.

The cybersecurity firm also discovered evidence that, in previous attacks, the threat actor used a kernel-based rootkit to hide the cryptomining process, but which also provided full control over the infected systems.

“The stealthy and evasive techniques and tools used in this operation make defense and detection more challenging. Since the goal of the LabRat operation is financial, time is money. The longer a compromise goes undetected, the more money the attacker makes and the more it will cost the victim,” Sysdig notes.

Related: New ‘Lobshot’ hVNC Malware Used by Russian Cybercriminals

Related: Takedown of GitHub Repositories Disrupts RedLine Malware Operations

Related: New ‘Domino’ Malware Linked to FIN7 Group, Ex-Conti Members