In addition, the backdoor supports a command that sends information about the current sessions on the system to the server. For the CMD command, for example, some variants first copy cmd.exe to dllhost.exe to avoid detection by security products that monitor CMD executions.

There are also differences in the C2 commands. The difference, however, is that the backdoor handles its C2 communication uncompressed, unlike Gh0st RAT communication, which is zlib-compressed. Overall, the backdoor has similar capabilities to Gh0st RAT. Several other service names and descriptions were observed in various samples. The backdoor copies itself to %APPDATA% ewdev.dll and creates a service called msupdate2 by creating the service entry directly in the registry. Its code is based on the leaked source code of Gh0st RAT/Netbot Attacker and is packed with Themida. This is a backdoor that security researchers have named Milestone. The file 1.dll is the last payload to be downloaded and installed. The whole thing ends with the installation of a malicious DLL (see above diagram in tweet). It then attempts to download and execute a chain of scripts. An encrypted PowerShell command downloads and executes another PowerShell script from a remote server.

The campaign executes the attacks via a new PowerShell process. The security researchers found that the same certificate was also used by another Chinese APT group called Winnti to sign some of their tools. This is signed with a stolen digital certificate.

Forensic traces of the backdoor led to the discovery of a novel kernel rootkit. Via Log4Shell to a backdoorĪfter infecting the VMware Horizon server via the Log4Shell vulnerability, Deep Panda deployed a backdoor on the infected computers. The infections are spread across different countries. The victims come from the finance, higher education, cosmetics and travel industries. The group exploited the Log4Shell vulnerability in VMware Horizon servers. The campaign by Deep Panda, a Chinese APT group, was already discovered by FortiEDR last month. I became aware of the situation via the following tweet, which Fortinet describes in the article New Milestones for Deep Panda: Log4Shell and Digitally Signed Fire Chili Rootkits.

Vmware horizon servers are exploit by