AI Security AI安全 4h ago Updated 2h ago 更新于 2小时前 46

Golden Chickens Resurfaces With Four New Malware Families and Modular Implants Golden Chickens携四个新恶意软件家族和模块化植入物重现

The Golden Chickens (TAG-195) MaaS ecosystem has evolved with four new malware families: TinyEgg, ChonkyChicken, a modular variant of ChonkyChicken, and ChromEggscalator. A significant architectural shift toward modularity allows on-demand loading of 14 discrete capability modules, reducing static detection exposure and enhancing defense evasion. TinyEgg serves as a lightweight initial-access backdoor using WebSockets for C2, while the modular ChonkyChicken expands into full post-exploitation ca 恶意软件即服务(MaaS)组织“Golden Chickens”(TAG-195)发布四个新恶意软件家族,显示其持续活跃且技术不断演进。 新工具包括轻量级后门TinyEgg、全功能植入体ChonkyChicken、模块化变体及浏览器凭证窃取工具ChromEggscalator。 架构向模块化转型,支持按需加载14种能力模块,旨在降低静态检测风险并提升防御规避能力。 攻击链利用ClickFix社会工程学诱导用户执行恶意命令,通过WebSocket建立C2通信并分阶段部署载荷。 该MaaS生态已被Cobalt Group、Evilnum等多个知名网络犯罪团伙使用,具有广泛的行业危害性。

65
Hot 热度
70
Quality 质量
60
Impact 影响力

Analysis 深度分析

TL;DR

  • The Golden Chickens (TAG-195) MaaS ecosystem has evolved with four new malware families: TinyEgg, ChonkyChicken, a modular variant of ChonkyChicken, and ChromEggscalator.
  • A significant architectural shift toward modularity allows on-demand loading of 14 discrete capability modules, reducing static detection exposure and enhancing defense evasion.
  • TinyEgg serves as a lightweight initial-access backdoor using WebSockets for C2, while the modular ChonkyChicken expands into full post-exploitation capabilities including credential theft and live browser control.
  • Delivery mechanisms heavily rely on social engineering tactics like ClickFix to trick users into executing malicious OCX payloads, often in collaboration with other threat groups like TAG-127.

Why It Matters

This development highlights a critical trend in the Malware-as-a-Service industry where operators are moving from monolithic implants to highly modular, dynamic architectures to evade security controls. For defenders, understanding this shift is essential because it means traditional signature-based detection will be less effective against these evolving tools. It also underscores the interconnected nature of cybercrime ecosystems, where tool sharing between groups like TAG-195 and TAG-127 amplifies the reach and sophistication of attacks.

Technical Details

  • TinyEgg: A lightweight initial-access backdoor that performs host profiling and establishes persistent interactive shell access via WebSockets. It includes anti-analysis features to terminate execution if sandbox environments are detected.
  • ChonkyChicken: A comprehensive implant extending TinyEgg’s functionality with browser credential theft, live session control via Chrome DevTools Protocol (CDP), network reconnaissance, and sustained surveillance.
  • Modular ChonkyChicken: Introduces a controller-and-plugin architecture capable of fetching and loading 14 specific modules on demand, such as keylogging, screen capture, audio capture, and file manipulation, without requiring full updates to the base implant.
  • ChromEggscalator: A modified credential theft utility succeeding TerraStealerV2, derived from the open-source ChromElevator tool, specifically designed to bypass Chrome encryption mechanisms.
  • Delivery and C2: Attacks utilize ClickFix social engineering to execute OCX payloads staged on attacker-controlled infrastructure. Command and Control communications are facilitated through WebSockets, allowing real-time interaction and dynamic payload staging.

Industry Insight

  • Security teams should prioritize behavioral detection and monitoring for WebSocket connections and unusual process creation patterns associated with OCX executions, rather than relying solely on static file analysis.
  • Organizations must enhance user awareness training specifically around "ClickFix" style lures, as these social engineering techniques are becoming a primary vector for initial access by sophisticated MaaS providers.
  • Threat intelligence sharing regarding shared infrastructure and common architectural traits among MaaS providers can help predict future capabilities and identify compromised systems earlier in the attack chain.

TL;DR

  • 恶意软件即服务(MaaS)组织“Golden Chickens”(TAG-195)发布四个新恶意软件家族,显示其持续活跃且技术不断演进。
  • 新工具包括轻量级后门TinyEgg、全功能植入体ChonkyChicken、模块化变体及浏览器凭证窃取工具ChromEggscalator。
  • 架构向模块化转型,支持按需加载14种能力模块,旨在降低静态检测风险并提升防御规避能力。
  • 攻击链利用ClickFix社会工程学诱导用户执行恶意命令,通过WebSocket建立C2通信并分阶段部署载荷。
  • 该MaaS生态已被Cobalt Group、Evilnum等多个知名网络犯罪团伙使用,具有广泛的行业危害性。

为什么值得看

本文揭示了高级持续性威胁(APT)与网络犯罪集团之间技术共享和演进的深层联系,特别是MaaS模式如何推动恶意软件的模块化和服务化。对于安全从业者而言,理解这种从单体到模块化架构的转变,有助于优化基于行为而非仅基于签名的检测策略,应对日益复杂的混合攻击链。

技术解析

  • TinyEgg:作为初始访问后门,具备主机画像、交互式Shell访问和持久化管理功能。它通过WebSocket与C2服务器通信,设计有沙箱检测机制,若检测到自动化分析环境则终止执行。
  • ChonkyChicken:全功能植入体,扩展了TinyEgg的功能,包括浏览器凭证窃取、通过Chrome DevTools Protocol (CDP)控制浏览器会话、凭据支持的远程执行、网络侦察和持续监控。
  • 模块化ChonkyChicken:引入控制器-插件架构,支持从C2按需加载14个离散能力模块(如进程管理、屏幕捕获、键盘记录、音频捕获等),而非嵌入所有功能,从而减少静态特征暴露并允许灵活更新。
  • ChromEggscalator:TerraStealerV2的继任者,基于公开的ChromElevator工具修改而成,专门用于绕过Chrome浏览器的加密保护以窃取凭证。
  • 攻击交付与基础设施:利用ClickFix社会工程学诱饵执行OCX载荷,从攻击者控制的暂存基础设施下载。TAG-127作为操作者和客户,使用VenomLNK或ClickFix进行分发,形成了复杂的MaaS供应链。

行业启示

  • MaaS架构演进趋势:恶意软件正从单体架构向高度模块化、可插拔的服务化架构转变,这要求防御方从关注单一文件特征转向监控动态行为序列和模块加载过程。
  • 社会工程学武器化:ClickFix等新型社会工程学技巧被广泛用于绕过用户警惕性和部分安全控制,企业需加强针对此类特定交互模式的员工培训和终端行为监控。
  • 威胁情报共享的重要性:鉴于Golden Chickens工具被多个不同犯罪团伙(如FIN6、Evilnum)复用,跨组织的情报共享和联合防御对于遏制大规模MaaS生态系统的扩散至关重要。

Disclaimer: The above content is generated by AI and is for reference only. 免责声明:以上内容由 AI 生成,仅供参考。

Security 安全 Research 科学研究