A well-funded and well-organized threat group that focuses its activities on Asian companies has been using Bifrose code to develop its own backdoors, Trend Micro reported on Thursday.
Bifrose, also known as Bifrost, is a piece of malware that has been around since at least September 2008. In September 2014, researchers reported seeing a new version of Bifrose, one that used the Tor network for command and control (C&C) communications, being used in targeted attacks.
In the past, the Bifrose source code was sold on the underground market for as much as $10,000. Researchers at Trend Micro believe a threat actor that has been active since at least 2010 acquired the Bifrose source code and used it to create other backdoors.
“Our research indicates that the group has sufficient financial resources to purchase the source code of a widely available malware tool, and the human resources to design improved versions of its own backdoors based on this,” Trend Micro threats analyst Razor Huang explained.
According to the security firm, the APT actor likely purchased the Bifrose source code, improved its functions, designed a new installation flow, created a new builder, and made its backdoor capabilities simpler and more concise. The result was a new backdoor that became known as Kivars, a threat that is capable of targeting 64-bit systems since mid-2014.
The malware, which has been used by the threat group since 2010, allows attackers to download and upload files, take screenshots, log keystrokes, manipulate active windows, and execute mouse and keyboard actions.
Trend Micro linked Bifrose to Kivars based on several clues, including the format of the initial message sent to the C&C server, and program database (PDB) paths in Kivars containing the string “BR,” likely a reference to Bifrose RAT.
Another backdoor developed by the threat actor based on Bifrose has been dubbed Xbow. The malware, which has been used since mid-2010, contains folder paths that are similar to Bifrose and Kivars, and some variants include functionality that is also present in Bifrose.
The operation monitored by Trend Micro, dubbed Shrouded Crossbow, has focused on Asian government contractors, privatized government agencies, and companies in the financial, healthcare, computer and consumer electronics sectors.
Based on mutexes created by Xbow and other evidence, the security firm believes the threat group has separate teams for each activity. One team, which has at least 10 members, is responsible for developing the malware. Another team is in charge of infiltrating the targeted organizations via spear-phishing emails that contain malicious attachments.
A third team is believed to be in charge of maintaining the group’s extensive C&C infrastructure. Experts have uncovered more than 100 C&C server and the attackers keep expanding it with new domains.