SUNSHUTTLE Backdoor
First observed in August 2020, SUNSHUTTLE is UNC2452’s C2 implant. Written in Go, it appears to have been used in combination with a number of other UNC2452 tools as part of their SolarWinds Orion compromise.
Summary
First observed in August 2020, SUNSHUTTLE is UNC2452’s C2 implant. Written in Go, it appears to have been used in combination with a number of other UNC2452 tools as part of their SolarWinds Orion compromise.
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
SUNSHUTTLE, also known as GoldMax, is a sophisticated second-stage backdoor used by the UNC2452 advanced persistent threat group. This backdoor was used in conjunction with other UNC2452 tools such as GoldFinger and Sibot during the SolarWinds Orion supply chain compromise.
Delivery
At the time of publication, it is unclear how SUNSHUTTLE is delivered. However, based on UNC2452’s known activity, it is likely that SUNSHUTTLE is delivered to target systems via compromised Orion installations.
Activities
Once executed, SUNSHUTTLE enumerates the user’s MAC address and compares it to a hard-coded MAC address as an anti-analysis check. It then creates a configuration file containing encoded and encrypted data. The data contained within the configuration file determines whether SUNSHUTTLE disguises its network activity within legitimate traffic, as well as the domains it will use to do this. SUNSHUTTLE then attempts to connect to a command and control (C2) server in order to obtain an RSA-encrypted session key, believed to be used to encrypt its communications.
After successfully connecting to a C2 server, SUNSHUTTLE will begin beaconing for new commands. At the time of publication, SUNSHTTLE is able to upload or download files, execute commands, or update its configuration file.
Remediation advice
To prevent and detect an infection, NHS Digital advises that:
- Secure configurations are applied to all devices.
- Security updates are applied at the earliest opportunity.
- Tamper protection settings in security products are enabled where available.
- Obsolete platforms are segregated from the rest of the network.
- IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
- Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
- Administrative accounts are only used for necessary purposes.
- Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
- Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.
Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.
Indicators of compromise
Last edited: 18 March 2021 3:44 pm