Full Report
Known as Glutton, researchers at QiAnXin’s XLab believe Winnti is responsible for the malware. The post PHP backdoor looks to be work of Chinese-linked APT group appeared first on CyberScoop.
Analysis Summary
# Threat Actor: Winnti (APT41)
## Attribution & Identity
**Attribution:** Chinese-linked Advanced Persistent Threat (APT) group.
**Aliases and Groups:** Winnti, APT41.
**Known Association:** Long linked to China; previously reported to carry out operations on behalf of the Chinese government while also engaging in cybercrime (dual espionage and cyber-crime operation).
## Activity Summary
Researchers at QiAnXin’s XLab discovered a new, advanced PHP backdoor named **Glutton**.
The malware appears to have been active and "undetected in the cybersecurity landscape for over a year" prior to its April discovery (2024).
The attacker's objective included "poisoning operations," deliberately targeting systems within the cybercrime market to use cybercriminals' tools against them (a "no honor among thieves" scenario) to spread the malware widely.
Initial clues surfaced in December 2023, tracing activity back to an IP address distributing ELF-based malware (targeting Unix-like operating systems), which later revealed a related malicious PHP file.
## Tactics, Techniques & Procedures
- **Infection Vector:** Utilizes a PHP backdoor (Glutton).
- **Evasion:** Modular design allows it to operate without leaving traditional digital footprints.
- **Execution:** All code execution occurs within PHP or **PHP-FPM** (FastCGI), ensuring no file payloads are left behind.
- **Post-Exploitation:** Can be used to exfiltrate data or inject malicious code into popular PHP frameworks.
- **C2/Communication:** Historical connection with Winnti activities noted, though Glutton exhibited simplstic, plaintext C2 communication protocols, which researchers found "uncharacteristically subpar" for the group.
- **Technique Link:** Connection noted between Glutton's initial discovery and ELF-based malware targeting Unix-like operating systems.
*Note: Specific MITRE ATT&CK IDs were not provided in the source text.*
## Targeting
**Sectors:** Systems within the cybercrime market were deliberately targeted for initial compromise/poisoning operations to aid spread. The malware can inject code into widely used PHP frameworks.
**Geography:** China, the United States, Cambodia, Pakistan, and South Africa.
**Victims:** Targeting systems running mainstream PHP frameworks: Baota, ThinkPHP, Yii, and Laravel. Specific organization names were not detailed.
## Tools & Infrastructure
**Malware Families Used:** Glutton (advanced PHP backdoor).
**Infrastructure:** Initial discovery traced to an IP address distributing ELF-based malware used for C2/distribution. The researchers noted a connection to an intricate attack infrastructure network composed of related malicious PHP payloads.
**URLs/IPs (Defanged):** Not explicitly listed or used in a persistent manner that requires defanging in the summary details, other than the initial IP address reference.
## Implications
The discovery of Glutton suggests that Winnti maintains an actively developed, covert set of tools, despite some observed shortcomings in the Glutton samples (plaintext C2). Their strategy of "poisoning" the cybercrime market infrastructure indicates an effort to achieve broad initial infection through supply chain-like contamination or exploiting common third-party tools. Winnti remains a significant state-aligned threat actor capable of sophisticated espionage operations.
## Mitigations
- Harden and secure all deployed PHP web servers, specifically monitoring for unusual activity within PHP or PHP-FPM processes.
- Review systems for previously deployed/hidden malware that operates solely in memory or via PHP execution environments.
- Patch and secure deployments of major PHP frameworks (Baota, ThinkPHP, Yii, Laravel) against injection vulnerabilities.
- Enhance detection capabilities for command-and-control communications that may utilize simplistic or plaintext protocols, as these occasionally appear even in sophisticated operations.