BINDCLOAK Backdoor Targets Middle East Government Entities
Summary
Zscaler analyzes BINDCLOAK, a modular Windows backdoor deployed in attacks targeting Middle East government entities. The report details its C2 protocol, commands, plugin loading, and links to the OctLurk backdoor.
Key points
- BINDCLOAK is a 64-bit C++ backdoor that MIXEDKEY decrypts and reflectively loads during a multi-stage campaign.
- Zscaler assesses with high confidence that BINDCLOAK is an OctLurk variant, citing code similarities and shared C2 infrastructure.
- The backdoor sends host details to its C2 server over TLS/TCP using a custom message format and compression-and-XOR encryption.
- Its commands support token collection, module control, process-token use, and loading plugin DLLs from the C2 server.
- The plugin loader uses reflective loading and techniques intended to evade EDR detection of calls from unbacked executable memory.
- The report provides file hashes and identifies cert.hypersnet[.]com as a C2 domain.
Article Details
- Attack Vectors
- BINDCLOAK, a 64-bit Windows backdoor, was deployed on victim machines during post-compromise activity and was decrypted and reflectively loaded by the MIXEDKEY loader.
- The backdoor communicates with its command-and-control server over TLS/TCP, sending an encrypted beacon containing host information.
- The C2 server can deliver plugin modules as DLLs; BINDCLOAK reflectively loads them into RWX memory.
- BINDCLOAK can collect user credentials and tokens, inspect process tokens, and start modules using user or process tokens to obtain elevated privileges.
- Defensive Notes
- The plugin loader uses RtlQueueWorkItem with LoadLibraryW to evade EDR detection of LoadLibraryW calls originating from unbacked executable memory regions.
- Zscaler reports that its multilayered cloud security platform detects indicators related to this campaign.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cert[.]hypersnet[.]com | C2 domain listed as a network indicator. |
| MD5 | 7a14a99d70d42d3f7bf72f843185fc07 | MD5 hash of a BINDCLOAK DLL sample. |
| SHA1 | 577b1cc894636f4ac5ad670b0079b9b7ade137c3 | SHA-1 hash identified as BINDCLOAK. |
| SHA256 | 3b0c658ebaa2bae80af97f390b9b2bb20a2f815eb584b2251255e84da4fa669d | SHA-256 hash identified as BINDCLOAK. |
MITRE ATT&CK
T1027.002 · Software PackingBINDCLOAK encrypts and compresses its C2 messages using rolling XOR keys and zlib compression.T1033 · System Owner/User DiscoveryThe beacon collects the computer name, username, and hostname from the infected machine.T1055 · Process InjectionBINDCLOAK reflectively loads plugin DLLs into allocated memory.T1055.002 · Portable Executable InjectionThe backdoor uses reflective loading to load plugin DLLs into memory.T1057 · Process DiscoveryThe GET_STATUS command collects information about running processes.T1071.001 · Web ProtocolsBINDCLOAK communicates with its C2 server over TLS/TCP.T1105 · Ingress Tool TransferThe C2 server delivers plugin modules as DLLs in message blobs.T1106 · Native APIBINDCLOAK uses Windows APIs including LogonUserW, VirtualAlloc, and process-token functions to carry out its operations.T1134.001 · Token Impersonation/TheftBINDCLOAK duplicates user tokens and starts modules with the resulting token.T1134.002 · Create Process with TokenBINDCLOAK can start a module using the process token of a specified process.
Malware
BINDCLOAKreporting. Building upon our initial findings, Part 2 dives into a detailed technical analysis of BINDCLOAK, a new modular stage 3 backdoor uncovered during our investigation. As detailed later in our threatMIXEDKEYgovernment entities in the Middle East. After ThreatLabz published Part 1 on the TELESHIM backdoor and MIXEDKEY loader, Kaspersky highlighted a related campaign in recent reporting. Building upon our initialOctLurkAs detailed later in our threat attribution section, key code similarities between BINDCLOAK and OctLurk as well as shared command-and-control (C2) infrastructure directly connect the threat actor behindTELESHIMthreat actor targeting government entities in the Middle East. After ThreatLabz published Part 1 on the TELESHIM backdoor and MIXEDKEY loader, Kaspersky highlighted a related campaign in recent reporting. Building