Malicious tools are trying to get lost among conventional network traffic, but the new Miraak framework has gone further and turned the PostgreSQL cloud base into a full-fledged channel for managing infected computers. The specialists of Blackpoint Cyber discovered a previously unknown set of tools after the intruders themselves were mistaken and left part of the infrastructure open on the Internet.
Miraak is designed to work after initial penetration into the system and gives the operator a wide range of capabilities. The framework executes commands, collects computer and user information, manages processes, takes screenshots, downloads and uploads files, changes server communication intervals, and runs long tasks in the background.
The main feature of Miraak is related to command infrastructure. Instead of the usual HTTP requests, the agent directly connects to PostgreSQL and uses base tables as a queue of commands. Through records in the database, the infected computer registers, receives new tasks and returns the results. To connect, the agent uses the standard libpq library, and in the studied configuration the server was in the Tiger Data cloud infrastructure with mandatory SSL encryption.
Because of this scheme, it is more difficult to find a server on the traditional characteristics of command servers. Network exchange can look like a common encrypted connection to cloud PostgreSQL. Therefore, protective systems have to take into account not only the destination address, but also the process that the connection has established, DNS requests and atypical outgoing connections.
To run Miraak, attackers mask malicious components to the usual environment files. NET. Several samples were named hostfxr.dll, which in the normal installation belongs to the launch library. NET. Large versions of such DLL decrypt the built-in agent, save it in the Windows temporary folder under the name msedgeupdate.exe, launch and soon delete the file. A more compact version reads the settings from the miraak.conf and runs the configurationed executable.
The framework also supports BOFs, small Beacon Object File modules from the Cobalt Strike ecosystem. Miraak developers have replicated the necessary Beacon interfaces, so the operator can run existing BOF modules directly inside the agent without deploying a separate Beacon.
While the specialists analyzed Miraak, they found a related tool for reverse TCP tunneling. The component on F# turns the infected computer into an intermediate node and allows you to access other internal services through it. Communication with Miraak confirms the overall infrastructure and self-signed TLS certificate with the name miraak-socks, although Blackpoint Cyber considers the tunnel a separate related component rather than the built-in framework module.
Miraak was able to study in detail primarily because of the errors of its operators. In open directories there were bootloaders, agents and auxiliary files, and the lack in the control panel allowed you to see part of the interface before the authorization check was completed.
Blackpoint Cyber does not associate Miraak with a specific group and does not disclose information about the affected organizations, but the set of functions shows that the framework was created as a full-fledged platform for long-term control over compromised networks.
Miraak is designed to work after initial penetration into the system and gives the operator a wide range of capabilities. The framework executes commands, collects computer and user information, manages processes, takes screenshots, downloads and uploads files, changes server communication intervals, and runs long tasks in the background.
The main feature of Miraak is related to command infrastructure. Instead of the usual HTTP requests, the agent directly connects to PostgreSQL and uses base tables as a queue of commands. Through records in the database, the infected computer registers, receives new tasks and returns the results. To connect, the agent uses the standard libpq library, and in the studied configuration the server was in the Tiger Data cloud infrastructure with mandatory SSL encryption.
Because of this scheme, it is more difficult to find a server on the traditional characteristics of command servers. Network exchange can look like a common encrypted connection to cloud PostgreSQL. Therefore, protective systems have to take into account not only the destination address, but also the process that the connection has established, DNS requests and atypical outgoing connections.
To run Miraak, attackers mask malicious components to the usual environment files. NET. Several samples were named hostfxr.dll, which in the normal installation belongs to the launch library. NET. Large versions of such DLL decrypt the built-in agent, save it in the Windows temporary folder under the name msedgeupdate.exe, launch and soon delete the file. A more compact version reads the settings from the miraak.conf and runs the configurationed executable.
The framework also supports BOFs, small Beacon Object File modules from the Cobalt Strike ecosystem. Miraak developers have replicated the necessary Beacon interfaces, so the operator can run existing BOF modules directly inside the agent without deploying a separate Beacon.
While the specialists analyzed Miraak, they found a related tool for reverse TCP tunneling. The component on F# turns the infected computer into an intermediate node and allows you to access other internal services through it. Communication with Miraak confirms the overall infrastructure and self-signed TLS certificate with the name miraak-socks, although Blackpoint Cyber considers the tunnel a separate related component rather than the built-in framework module.
Miraak was able to study in detail primarily because of the errors of its operators. In open directories there were bootloaders, agents and auxiliary files, and the lack in the control panel allowed you to see part of the interface before the authorization check was completed.
Blackpoint Cyber does not associate Miraak with a specific group and does not disclose information about the affected organizations, but the set of functions shows that the framework was created as a full-fledged platform for long-term control over compromised networks.
