Elastic Security Labs hat die Banking-Malware KREMLIN enttarnt, die bösartige Erweiterungen in Chrome und Edge einschleust und Verschlüsselungen umgeht.
Researchers at Elastic Security Labs have released a comprehensive threat investigation uncovering a previously undocumented Brazilian cybercrime syndicate tracked as REF9334. The group operates an intricate malware suite dubbed KREMLIN (named after the author's handle, Kr3mlin4rt1st). Despite its moniker, forensic artifacts, developer comments, and telemetry timestamps demonstrate unequivocally that the threat group operates out of Brazil.
The KREMLIN campaign specializes in weaponizing Chromium-based browsers, predominantly Google Chrome and Microsoft Edge. Initial delivery utilizes spear-phishing emails bearing masqueraded JavaScript invoice attachments. Upon execution, a multi-stage loader initiates anti-analysis and virtual machine checks before securing persistence via Windows Task Scheduler.
To evade host defenses, the installer leverages DLL sideloading by hijacking a legitimate, digitally signed binary from SentinelOne (`SentinelMemoryScanner.exe`) to reflectively load an unsigned, encrypted C++ payload in memory.
The core threat mechanism involves bypassing recent Chromium security hardening. Google introduced App-Bound Encryption to prevent unauthorized third-party processes from extracting session cookies or tampering with extensions. KREMLIN circumvents this by programmatically rewriting Chrome's `Secure Preferences` configuration file. By recalculating the required Hash-based Message Authentication Codes (HMAC) and reconstructing App-Bound hashes, the trojan forces the browser engine to load a malicious extension without triggering integrity validation errors.
Once embedded as a Man-in-the-Browser (MitB) component, KREMLIN intercepts financial portal interactions, extracts active authentication tokens, and bypasses Multi-Factor Authentication (MFA) mechanisms via session hijacking (Pass-the-Cookie). Furthermore, the operators utilize Ethereum smart contracts as dead-drop resolvers to dynamically relay Command-and-Control (C2) endpoint changes, frustrating traditional domain-takedown efforts. Over 1,500 enterprise endpoints were identified in a single intrusion wave before researchers deployed a network kill-switch sinkhole.
Recommended Mitigation for Users and Enterprise Administrators
- Audit Browser Extensions Regularly: Inspect `chrome://extensions` and `edge://extensions` for unverified add-ons demanding unrestricted permissions to read and modify web content.
- Revoke Active Enterprise and Banking Sessions: From a known-clean device, execute global session sign-outs across financial institutions, cloud identity providers (IDaaS), and productivity suites to invalidate stolen cookies.
- Mandate Enterprise Extension Allowlisting: Deploy Group Policy Objects (GPO) or MDM configurations enforcing strict extension allowlists across all fleet workstations.
- Hunt for Abnormal DLL Sideloading Behavior: Monitor EDR telemetry for signed diagnostic binaries executing from temporary user paths or loading unsigned dynamic libraries.
Empfohlene Maßnahmen für IT-Sicherheitsverantwortliche
- Zeitnahe Installation der bereitgestellten Sicherheitsupdates.
- Laufende Überwachung der Netzwerktelemetrie und Protokolldateien.