Article
Sandworm’s New Arsenal: Kapeka Backdoor Technical Analysis
Kapeka backdoor explained: a C++ backdoor used in Eastern Europe since mid-2022 and linked by researchers to Sandworm. See what the report covers.
Read more
Malware profile
Infamous Chisel
Infamous Chisel is a collection of components that targets Android devices.
In short
Infamous Chisel is a collection of components that targets Android devices. A joint report of 31 August 2023 says it was used by the actor Sandworm in a campaign against Android devices used by the Ukrainian military. It gives lasting remote access over the Tor network and regularly collects and sends out information from the device.
- Names1names in public reportsInfamous Chisel
- Techniques6ATT&CK techniques listedPersistence · Credential Access · Discovery
- Infection Steps5in the delivery chainReplace the system file · Start at boot
- Linked Groups1groups that use itSandworm
In one minute
- What it is
- A collection of components for Android devices that gives lasting remote access over Tor and collects information from the device.
- What it does
- Scans the device for files of interest, scans the local network, and gives the actor a hidden Tor service with SSH access. It also includes network monitoring and file transfer tools.
- Who uses it
- Attributed by CISA and its partner agencies, in a joint report of 31 August 2023, to Sandworm. CISA says the UK and the US have previously attributed Sandworm to the Russian GRU's Main Centre for Special Technologies (GTsST).
- How it gets in
- The sources do not say how the malware first reaches a device. The report says the swap of a system file it relies on is not done by the malware itself and would need raised privileges.
- What to do first
- Read the joint report, run its YARA rules against device data and check devices against its indicators.
What it does
The joint report says the information taken is a mix of system details, commercial application data and data from applications specific to the Ukrainian military. The report calls the components low to medium sophistication, built with little regard for hiding their activity.
Components the report describes include the following. netd does automated device information collection and exfiltration. killer stops the malicious netd process. blob is run by netd and sets up and starts the Tor utility. td is Tor with no obvious modifications. db is a multi-call binary that bundles an SSH server and client, SCP, a network scanner and custom utilities.
For persistence, the malware replaces the legitimate netd binary in the system folder. When the system starts it, the malicious program forks and runs a backup of the genuine process so the device keeps working normally. Every 86,400 seconds (once a day) it searches set folders for files with extensions such as .dat, .bak, .xml, .txt, .ovpn, .pdf, .xlsx, .csv, .zip and images. It also gathers device identifiers, installed packages, network configuration, location data and data from military-related applications.
Remote access runs through a Tor hidden service on port 34371 that relays connections to a modified Dropbear SSH server. netd also has a built-in network scanner that checks local subnets and logs responsive hosts.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| Infamous Chisel | Name used in the joint Malware Analysis Report AR23-243A of 31 August 2023[1, 2] |
What it can do
What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Persistence
Credential Access
Discovery
Collection
How an infection runs
The order of steps in a typical infection, as the sources describe it.
Replace the system file
The malware replaces the legitimate netd binary, keeping a backup copy of the original that it also runs. This swap is not done by the malware itself and needs raised privileges.[1, 2]
Start at boot
init runs the malicious netd with root privileges.[2]
Collect
Every 86,400 seconds netd searches set folders for files of interest and gathers device and application data.[2]
Open a hidden door
netd runs blob, which configures and starts Tor and the SSH server, giving the actor a hidden service on port 34371.[2]
Scan and send out
netd can scan the local network and sends collected data out at regular intervals.[2]
Timeline
- August 2023
Campaign uncovered by Ukraine's SBU
CISA says the campaign was publicly uncovered by Ukraine's security agency, the SBU, earlier in the month of its 31 August release, and attributed to Sandworm.[4]
- 31 August 2023
Joint Malware Analysis Report published
The UK NCSC, US NSA, CISA and FBI, New Zealand's NCSC, Canada's CCCS and Australia's ASD report that Sandworm used a new mobile malware against Android devices used by the Ukrainian military.[1]
- 31 August 2023
CISA releases AR23-243A
CISA publishes the report as analysis report AR23-243A with downloadable indicator files in STIX format.[2]
- 31 August 2023
Who uses it
Detection and defense
Review the report to check for compromise
CISA and its partners urge defenders to review the report for indicators of compromise, detection rules and signatures to determine whether a system is compromised.[3]
Report what you find
NCSC New Zealand asks organizations that find malicious activity after reading the advisory to contact it by email.[5]
Questions
What is Infamous Chisel?
A collection of components targeting Android devices, described in a joint Malware Analysis Report of 31 August 2023.
Who is behind it?
The report authors, including CISA and the UK NCSC, attribute it to Sandworm. CISA says the UK and US have previously attributed Sandworm to the Russian GRU's GTsST.
Who was targeted?
The report says Android devices used by the Ukrainian military. NCSC New Zealand says it was not aware of New Zealand organizations being affected.
What does it take from a device?
System device information, commercial application information and data from applications specific to the Ukrainian military.
How do defenders look for it?
The report has YARA rules and indicators. CISA also offers the indicators as STIX files.
How does Infamous Chisel stay on a device?
By replacing the legitimate netd binary and running a backup of the original process alongside it. This needs raised privileges.
How sophisticated is it?
The report calls the components low to medium sophistication, built with little regard for evading defenses or hiding activity.
How often does it collect data?
netd searches its set folders every 86,400 seconds, which is once a day.
In our research
- Sandworm’s New Arsenal: Kapeka Backdoor Technical Analysis October 2024
- SandWorm APT Group Cyber Intelligence Report September 2023
- Sandworm Threat group
Sources
- Infamous Chisel Malware Analysis Report UK NCSC with NSA, CISA, FBI, NCSC-NZ, CCCS and ASDSupports: Components, behaviour, Sandworm association, persistence, YARA rules and indicators.
- Infamous Chisel Malware Analysis Report, AR23-243A CISASupports: Same report with STIX indicator files, released 31 August 2023.
- CISA and International Partners Release Malware Analysis Report on Infamous Chisel Mobile Malware CISASupports: Attribution by the authoring organisations and the call to review indicators and detection rules.
- U.S. and International Partners Release Report on Russian Cyber Actors Using "Infamous Chisel" Malware CISASupports: SBU uncovered the campaign, Sandworm attribution, earlier UK and US attribution to GTsST.
- Support for Ukraine calling out Russia's GRU for new malware campaign NCSC New ZealandSupports: Joint issuers, no known New Zealand impact, advice to review the techniques and report activity.
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.