October 13, 2022 Ravie Lakshmanan
A previously undocumented command-and-control (C2) framework dubbed Alchimist is likely being used in the wild to target Windows, macOS, and Linux systems.
"Alchimist C2 has a web interface written in Simplified Chinese and can generate a configured payload, establish remote sessions, deploy payload to the remote machines, capture screenshots, perform remote shellcode execution, and run arbitrary commands," Cisco Talos said in a report shared with The Hacker News.
Written in GoLang, Alchimist is complemented by a beacon implant called Insekt, which comes with remote access features that can be instrumented by the C2 server.
The discovery of Alchimist and its assorted family of malware implants comes three months after Talos also detailed another self-contained framework known as Manjusaka, which has been touted as the "Chinese sibling of Sliver and Cobalt Strike."
Even more interestingly, both Manjusaka and Alchimist pack in similar functionalities, despite the differences in the implementation when it comes to the web interfaces.
Alchimist C2 panel further features the ability to generate PowerShell and wget code snippets for Windows and Linux, potentially allowing an attacker to flesh out their infection chains to distribute the Insekt RAT payload.
The instructions could then be embedded in a maldoc attached to a phishing email that, when opened, downloads and launches the backdoor on the compromised machine.
The trojan, for its part, is equipped with features typically present in backdoors of this kind, enabling the malware to get system information, capture screenshots, run arbitrary commands, and download remote files, among others.
What's more, the Linux version of Insekt is capable of listing the contents of the .ssh directory and even adding new SSH keys to the ~/.ssh/authorized_keys file to facilitate remote access over SSH.
But in a sign that the threat actor behind the operation also has macOS in their sights, Talos said it uncovered a Mach-O dropper that exploits the PwnKit vulnerability (CVE-2021-4034) to achieve privilege escalation.
"However, this [pkexec] utility is not installed on MacOSX by default, meaning the elevation of privileges is not guaranteed," Talos noted.
The overlapping functions Manjusaka and Alchimist points to an uptick in the use of "all-inclusive C2 frameworks" that can be used for remote administration and command-and-control.
"A threat actor gaining privileged shell access on a victim's machine is like having a Swiss Army knife, enabling the execution of arbitrary commands or shellcodes in the victim's environment, resulting in significant effects on the target organization," the researchers said.
In iOS, apps can only acces a directory specific to them that no other app can read, there are no shared directories that all apps can acces or a way to make symlinks or something would help (at least i'm not aware of them). So I have to move my files from wherever i need them to use them (like a video player app whose directory is not visible to the file sharing app) to the directory of the app I use to share files, and viceversa when I share files from a computer to the phone.
In android, I can give apps permission to read and write files on the general storage.
I'm talking about files in general, I never tried to share voice notes specifically. If you only want to transfer files to the PC and not to the phone, I think the files app supports FTP. If you can access your voice notes from the files app, this is probably the best solution. File transfers lver USB on iphoes are extremely slow anyway.