#threatreport #HighCompleteness
Turtles, Clams, and Cyber Threat Actors: Shell Usage | 11-04-2025
Source:
socket.dev/blog/shell-usage
Key details below ↓
🧑💻Actors/Campaigns:
Fancy_bear
Oceanlotus
Hafnium
💀Threats:
Ngrok_tool, Metasploit_tool,
🌐Geo: Vietnamese, Russia, China
📚TTPs:
🤖LLM extracted TTPs:`
T1505.003, T1059, T1071.001, T1219, T1027, T1203, T1105
🧨IOCs:
- File: 32
- Domain: 1
- IP: 2
- Url: 2
💽Software: Oracle WebLogic Server, Jupyter Notebook, Node.js, curl
🔢Algorithms: base64
🔠Functions: createConnection, hrDrKbx, vMilIZxI, getShell
🗂️Win API: readFile, writeFile
📜Programming Languages: python, groovy, java
#threatreport:
APT28 and APT32 are notable threat actors associated with Russia and Vietnam, respectively, both known for utilizing web shells to maintain persistence within compromised environments. HAFNIUM, a Chinese threat actor, has demonstrated a focused interest in U.S. entities, utilizing web shells for server control and the exfiltration of sensitive information across various industries. A web shell is a malicious code uploaded to a web server, typically exploiting file upload vulnerabilities, which grants attackers unauthorized access.
Recent observations from Socket indicate that malicious actors are deploying web shells across multiple open source package ecosystems, including npm, PyPI, and Go. Most notably, the analysis uncovered several packages exhibiting reverse shell capabilities. One particular implementation utilizes the `os` module to create a reverse shell by establishing a TCP connection to an attacker-controlled IP address on port 7777, redirecting standard input, output, and error to this connection. The usage of non-standard ports like 7777 often indicates developers’ configurations, inadvertently leaving them open for exploitation. VirusTotal flagged this IP as malicious, linking it back to a Vietnamese technology firm.
Moreover, tunneling services such as ngrok complicate detection efforts by masking connections, while enabling enhanced interactivity in reverse shells through the use of pseudo-terminals. The illicit access often employs port 4444, commonly associated with various services including Oracle WebLogic and the Metasploit framework, which provides an efficient means of establishing remote access via reverse shells. One npm package evaluated attempted to connect through this port, masquerading itself as a remote client updater for Node.js, thus concealing its malicious intent.
The Go examples revealed comparable functionalities, wherein a command uses `curl` to download a remote shell script that executes silently. This tactic of hiding malicious actions within shell-based downloads enables attackers to bypass defensive measures and evade detection. Additionally, some code samples showcased the download and execution of Groovy scripts, a flexible alternative to Java, directly in memory, allowing attackers to exploit system permissions effectively.
These techniques highlight the evolving nature of cyber threats, underscoring the importance of vigilance in monitoring web servers and package registries for signs of compromise, while also reflecting the complexity of contemporary cyberattack strategies embraced by threat actors.