A new post-exploitation red team tool titled Splinter has been discovered by cybersecurity researchers. Palo Alto Networks Unit 42 revealed this tool after finding it on multiple customers’ systems. Developed using the Rust programming language, Splinter is not as advanced as other tools like Cobalt Strike but still poses a potential threat if misused. These penetration testing tools are commonly used for red team operations to identify security vulnerabilities in a network but can also be weaponized by threat actors.
Unit 42 has not detected any threat actor activity associated with Splinter yet, and the developer of the tool remains unknown. The tool’s artifacts are notably large, around 7 MB, due to the presence of 61 Rust crates within it. Splinter operates similarly to other post-exploitation frameworks, with a configuration for a command-and-control server to establish contact via HTTPS. It operates on a task-based model to receive tasks from the C2 server defined by the attacker.
Some functions of Splinter include executing Windows commands, remote process injection, file uploads and downloads, collecting cloud service account information, and self-deletion from the system. As cybercriminals continue to evolve their techniques, staying updated on prevention and detection capabilities is crucial. Deep Instinct recently detailed two attack methods involving stealthy code injection and privilege escalation using Microsoft Office and a malicious shim.
In another discovery, Check Point highlighted a new process injection technique called Thread Name-Calling, which implants shellcode into a running process by manipulating thread descriptions. Security researcher Aleksandra “Hasherezade” Doniec emphasized the importance of considering older threat components like APC injections and the manipulation of access rights within a remote process. As new APIs are added to Windows, new injection techniques continue to emerge, posing challenges for endpoint protection products.
Source link