Elastic Shows Automated Triage Workflow for Chrysalis Backdoor Alerts
Summary
Elastic describes combining Attack Discovery, Workflows and Agent Builder to validate and triage alerts tied to the Chrysalis backdoor, using VirusTotal, ES|QL, case creation and Slack coordination. Elastic says the process took under four minutes.
Key points
- The article describes a Lotus Blossom campaign that compromised Notepad++ WinGUp update infrastructure to deliver the Chrysalis backdoor, citing Rapid7 research.
- Chrysalis reportedly used DLL sideloading through a legitimate Bitdefender binary, BluetoothService.exe, and persistence as a Windows service.
- Elastic says Attack Discovery correlated five related alerts from a larger alert queue into one attack narrative and triggered a workflow.
- The workflow passes the discovery to Agent Builder, which can check file hashes with VirusTotal, search logs with ES|QL, consult documentation, and check the on-call schedule.
- The agent can create an incident case and Slack channel; optional response actions include host isolation, user suspension, network blocking, and an IOC sweep.
- Elastic reports that its example pipeline completed confirmation and triage in under four minutes, compared with an estimated two to six hours for a manual process.
Article Details
- Defense Focus
- Automate the detection, confirmation, and triage of Chrysalis-related activity by correlating alerts, hunting for indicators, validating hashes, and coordinating incident response.
- Detection Methods
- Run Attack Discovery hourly to correlate related security alerts into a single attack narrative.
- Use ES|QL searches across file, network, and process event logs to hunt for Chrysalis indicators and related activity.
- Check available malware hashes with VirusTotal and correlate findings with threat intelligence.
- Sweep the fleet for Chrysalis indicators, including the reported C2 domain.
- Data Sources
- Security alerts analyzed by Attack Discovery
- File, network, and process event logs
- VirusTotal hash-analysis results
- Threat intelligence matches
- On-call schedule index
- Rule Types
- ES|QL queries
- Platforms
- Security information and event management
- Endpoint detection and response
- Incident case management
- Incident collaboration
- Defensive Actions
- Configure scheduled Attack Discovery to surface coordinated activity and trigger triage workflows.
- Verify available malware hashes, search relevant logs, and create a case with the findings.
- Notify the on-call responder and coordinate incident handling through an incident channel.
- If warranted, isolate the affected host, suspend the associated user, add the C2 domain to a firewall blocklist, and run a fleet-wide indicator sweep; the article presents these as optional response actions.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | api[.]skycloudcenter[.]com | Confirmed command-and-control domain used for Chrysalis DNS beaconing. |
MITRE ATT&CK
T1071.004 · DNSChrysalis used DNS beaconing to communicate with the confirmed C2 domain api[.]skycloudcenter[.]com.T1195.002 · Compromise Software Supply ChainLotus Blossom hijacked the Notepad++ update mechanism (WinGUp) to redirect targeted users to malicious update servers.T1204.002 · Malicious FileVictims executed a malicious NSIS installer from the Desktop, which dropped attacker files.T1543.003 · Windows ServiceBluetoothService.exe was registered as a Windows service and ran under SYSTEM to establish persistence.T1574.002 · DLL Side-LoadingThe attack used a legitimate signed Bitdefender binary, BluetoothService.exe, to sideload the malicious Chrysalis loader log.dll.
Threat Actors
Lotus BlossomThe article attributes the Notepad++ update infrastructure supply-chain compromise and delivery of the Chrysalis backdoor to Lotus Blossom.Raspberry TyphoonThe article explicitly identifies Raspberry Typhoon as an alias of Lotus Blossom, which it attributes with the Notepad++ update infrastructure compromise and Chrysalis delivery.
Malware
Vendors
BitdefenderChrysalis uses reflective DLL loading, API hashing, custom encryption, and DLL sideloading via a legitimate Bitdefender binary (BluetoothService.exe) to achieve persistence and evade defenses.ElasticElastic Security’s AI-powered automation stack transforms this workflow from manual hunting to automated confirmation.
Products
Agent BuilderAttack Discovery, Workflows, and Agent Builder were combined to automatically detect, confirm, and triage a Chrysalis backdoor campaign delivered via a Notepad++ update supply-chain compromise, collapsing dozens ofAttack DiscoveryAttack Discovery, Workflows, and Agent Builder were combined to automatically detect, confirm, and triage a Chrysalis backdoor campaign delivered via a Notepad++ update supply-chain compromise, collapsing dozens ofElastic DefendHost Isolation: Isolate srv-win-defend-01 via Elastic DefendElastic SecurityElastic Security’s AI-powered automation stack transforms this workflow from manual hunting to automated confirmation.Microsoft Active DirectoryUser Suspension: Disable james_spiteri in Active DirectoryNotepad++combined to automatically detect, confirm, and triage a Chrysalis backdoor campaign delivered via a Notepad++ update supply-chain compromise, collapsing dozens of alerts into a single verified incident and creatingSlackcompromise, collapsing dozens of alerts into a single verified incident and creating a case and Slack channel with on-call responders already added.WinGUPLotus Blossom (aka Billbug/Raspberry Typhoon/Spring Dragon) conducted a Notepad++ update infrastructure supply-chain compromise (WinGUp) delivering the previously undocumented Chrysalis backdoor.
Countries
Industries
AviationGovernment, Telecom, Aviation, Critical Infrastructure, MediaCritical infrastructureGovernment, Telecom, Aviation, Critical Infrastructure, MediaGovernmentGovernment, Telecom, Aviation, Critical Infrastructure, MediaMediaGovernment, Telecom, Aviation, Critical Infrastructure, MediaTelecommunicationsGovernment, Telecom, Aviation, Critical Infrastructure, Media