cyber.hendryadrian.com
Threat Research · hunt.io

BlueShell Backdoor Remains in Use, With Attackers Modifying Its Capabilities

· Original article ↗

Summary

Researchers describe BlueShell’s continued use, tracked C2 servers, and a customized Linux ELF sample with added file-server and reverse-shell features. The backdoor has been reported in attacks targeting organizations in South Korea and Thailand.

Key points

  • BlueShell is a Go-based backdoor that supports Windows, Linux, and macOS, communicating with victim systems over TCP and TLS.
  • Its standard capabilities include remote shell commands, file uploads and downloads, and SOCKS5 proxying.
  • The article associates BlueShell campaigns with Dalbit and cites prior reporting of targets in South Korea and Thailand.
  • Researchers tracked servers using BlueShell’s default TLS certificate, while warning that attackers can change certificates and ports.
  • A customized 7.7 MB, 64-bit ELF sample communicated with 8.218.243[.]239:8443 and contained client credentials, an embedded image, and added file-server and reverse-shell functionality.
  • The sample also checks a hardcoded password-derived value before running additional system-utility commands.

Article Details

Attack Vectors
  • BlueShell backdoor communicates with victim systems over TCP sockets and encrypts messages using TLS.
  • BlueShell can run commands and upload or download files on victim systems.
  • The customized ELF sample adds file-server and reverse-shell functionality.
Defensive Notes
  • Do not rely solely on BlueShell's default TLS certificate; attackers may change certificates and server ports.
  • When identifying suspected BlueShell C2 servers, combine indicators with third-party intelligence and consider non-HTTP ports, geographic location, and service provider.
  • The listed IP addresses may no longer host the identified indicators by publication time.

Indicators of compromise

TypeIndicatorContext
IPV4103[.]140[.]186[.]8BlueShell C2 server listed among the infrastructure monitored by Hunt.
IPV4141[.]98[.]212[.]34BlueShell C2 server listed among the infrastructure monitored by Hunt.
IPV4204[.]194[.]65[.]48BlueShell C2 server listed among the infrastructure monitored by Hunt.
IPV439[.]98[.]81[.]60BlueShell C2 server listed among the infrastructure monitored by Hunt.
IPV439[.]98[.]91[.]83BlueShell C2 server listed among the infrastructure monitored by Hunt.
IPV48[.]218[.]243[.]239BlueShell C2 server communicating with the analyzed ELF sample; listed as monitored adversary infrastructure.
MD57d960f77fda453c8f0c7f6c7448a35b4MD5 hash of the analyzed BlueShell ELF sample.
SHA1ee0257a6645aca2232ad270f2c08ac6b1b9cfc68SHA1 hash of the analyzed BlueShell ELF sample.
SHA2565dc72a9b98b3293f10e294c4fc7a6881776c38e8bf2d8ed6073dea5c773927fdSHA256 hash of the analyzed BlueShell ELF sample.

MITRE ATT&CK

T1059 · Command and Scripting InterpreterBlueShell's Shell feature runs commands on the victim system.T1095 · Non-Application Layer ProtocolBlueShell's server communicates with victim systems over TCP sockets.

Threat Actors

DalbitIdentified by the article as the only threat actor publicly associated with deploying BlueShell in an attack campaign; believed to originate from China.

Malware

BlueShellThis week, we're turning our attention to BlueShell, an open-source backdoor hosted on GitHub for about four years but still seeing plenty of use by attackers in 2024. In this post, we'll highlight some recent BlueShell

Products

GitHubPlatforms like GitHub offer a valuable resource for developers and the open-source community. However, these sites also create a potential avenue for threat actors to distribute malicious tools.

Tools

GhidraFigure 8: Decompiled code in Ghidra displaying customized featuresFigure 9: Snippet of standard BlueShell source codeFinally, the file uses a hardcoded password check before starting a service and executing commands

Countries

Chinaof targeting aligns with the operational profile of Dalbit, a threat group believed to originate from China and the only threat actor publicly associated with the deployment of BlueShell in an attack campaign.South Koreato insights from AhnLab, the BlueShell backdoor has predominantly targeted organizations within South Korea and Thailand, spanning various industry verticals. This pattern of targeting aligns with theThailandfrom AhnLab, the BlueShell backdoor has predominantly targeted organizations within South Korea and Thailand, spanning various industry verticals. This pattern of targeting aligns with the operational profile of

Related Articles