From HiatusRAT to Cuttlefish: advances in credential theft through the router

From HiatusRAT to Cuttlefish: advances in credential theft through the router

Speakers: Danny Adamitis, Researcher, Lumen Technologies

Conference: BSides NYC

YouTube: https://www.youtube.com/watch?v=Oi-x_YPtHZA

Overview

In a revealing presentation at BSides NYC, Danny Adamitis, a researcher from Lumen Technologies' Black Lotus Labs, unveiled a detailed case study of persistent and sophisticated Chinese espionage campaigns known as HiatusRAT and Cuttlefish. This talk illuminated how advanced persistent threat (APT) groups are shifting their focus from traditional endpoints, which are increasingly well-defended, to overlooked network infrastructure like routers and cloud services. The research, which spans from 2021 and continues to the present day, demonstrates an alarming level of brazenness and resilience from the adversaries, who often ignore public disclosures and continue operations with minimal changes.

The significance of this research extends beyond the realm of nation-state espionage. As Adamitis highlighted, techniques pioneered by APTs frequently trickle down to cybercriminal groups within six to eighteen months, eventually appearing in ransomware campaigns and other financially motivated attacks. By compromising critical infrastructure like routers, these groups gain an unmonitored foothold, enabling the theft of intellectual property, sensitive communications, and cloud credentials, ultimately leading to substantial economic impact and increased costs for consumers. The talk serves as a critical warning for organizations and individuals to expand their understanding of network perimeters and adopt more robust defensive strategies for devices often considered "set and forget."

Background

▶ Watch: Introduction to HiatusRAT and Cuttlefish Chinese espionage (0:00)

The problem of nation-state espionage, particularly from Chinese threat groups, has been a persistent concern for over a decade. General Keith Alexander, former Director of the NSA, famously stated in 2012 that the loss of industrial information and intellectual property through cyber espionage constitutes "the greatest transfer of wealth in human history." Despite repeated warnings from government agencies like the ODNI, the threat has only broadened, becoming more active and persistent. A key challenge for defenders is the financial and temporal investment required to secure complex environments, often leading to neglect of critical, yet seemingly mundane, infrastructure.

This talk spotlights a significant evolution in APT tactics: the pivot from targeting traditional endpoints (like Windows workstations) to routers and end-of-life (EOL) devices. Endpoint Detection and Response (EDR) solutions and other security measures have significantly improved on modern operating systems, making it harder for adversaries to maintain persistence and evade detection. Routers, however, present a stark contrast. They often lack sophisticated monitoring or logging capabilities, are rarely manually inspected, and frequently run outdated, unpatched firmware, especially if they are EOL. The "golden rule" of IT operations – "if it works, don't touch it" – creates a fertile ground for adversaries who exploit the reluctance to patch or replace operational, albeit vulnerable, devices. This oversight allows threat actors to establish covert, long-term access, operating beneath the radar of conventional security tools and practices. The speaker emphasized that the lack of attention to these devices has even led to cybercriminal groups offering bounties for exploits against EOL routers to build free proxy networks.

Key Findings

▶ Watch: Lumen's Black Lotus Labs: unique global network data (2:30)

Lumen’s Black Lotus Labs identified two distinct yet linked Chinese espionage campaigns: HiatusRAT and Cuttlefish. The initial HiatusRAT campaign began in July 2021, targeting Drytech Vygo routers, which are small to medium-sized business devices capable of supporting up to 500 VPN connections. Subsequent observations revealed targeting of Ruckus and QNAP devices, indicating a cross-compiled codebase for various architectures like ARM, MIPS, MIPSOL, and i386. A critical insight was that the specific router make or model was less important than the processor architecture and the lack of monitoring. The campaign's persistence was notable: despite public disclosures and null-routing efforts by Lumen, the adversaries rebuilt their infrastructure on different Autonomous System Numbers (ASNs) with minimal changes, sometimes within weeks, effectively saying, "nice report, get back to work." They even shifted targeting to include Taiwanese entities and U.S. military assets, demonstrating brazenness and a long-term strategic outlook.

Cuttlefish emerged as a related campaign, focusing on cloud credential theft. This malware was designed to harvest API keys and authentication tokens from traffic destined for cloud services like AWS and AliCloud. A particularly stealthy technique involved loading the malware directly into memory, binding it to a process, and then deleting the file from disk, making forensic recovery significantly harder as it would disappear upon power cycling. The link between HiatusRAT and Cuttlefish was solidified by the discovery of identical build paths embedded in their binaries, alongside shared certificate patterns and even a humorous, trolling filename, .putin, suggesting a common development shop. The threat actor's patience and strategic intent were evident in their long-term data collection, including encrypted traffic, with the clear implication of "steal it now, decrypt it later" and the capacity to process intelligence from numerous languages.

Technical Deep Dive

▶ Watch: ODNI: Chinese APTs are broadest, most active, persistent (4:10)

The technical sophistication of both HiatusRAT and Cuttlefish reveals a deep understanding of network architecture, operational blind spots, and adversarial psychology.

HiatusRAT: Router-Based Persistence and Data Exfiltration

HiatusRAT's modus operandi revolved around establishing persistent access on routers and exfiltrating sensitive data in transit. The initial compromise typically involved exploiting CVEs in EOL or unpatched router firmware. Once on the device, the attackers would drop two custom-compiled binaries: a variant of TCP dump and the hiatus RAT itself.

1. Host-Based Enumeration and Persistence:

• The malware first performed enumeration to confirm it was on a legitimate victim device, checking for specific characteristics to avoid sandboxes.
• To ensure only one instance of the RAT ran, preventing self-DDoS on resource-constrained routers, it would open a listening port (e.g., port 8816) as a mutex.
• It collected system information, including MAC address, kernel version, architecture, and firmware details, to identify the host.
• Further reconnaissance involved gathering IP config (public IP), ARP cache (Layer 2 connections to enumerate devices behind the router, like Zimbra or Outlook servers), and mounted points (to detect co-habitation with other malware).
• Process enumeration was also performed to understand the running environment.

1. Command and Control (C2) and Data Collection:

• HiatusRAT's configuration files (config) revealed a modular design, including a "tick" interval for its heartbeat. Notably, the observed heartbeat was eight hours, indicating a desire for stealth and long-term, low-profile operations, contrasting with the more frequent beaconing seen in cybercrime.
• The malware utilized two redundant C2 servers, ensuring continued operation even if one was taken offline.
• The tcpdump variant was used to capture packets one hop out from internal servers, specifically targeting ports associated with email protocols: SMTP (port 25), IMAP (port 143), and POP3 (port 110). This allowed the collection of email content in transit, bypassing endpoint detection logic on mail servers like Microsoft Defender.

1. Advanced Network Functionality:

• Two key functions highlighted the RAT's redirector capabilities:
• TCP forward: This function would open a listening port (e.g., port 123) and forward all incoming connections to a remote IP address over another port (e.g., port 431). This creates a redirector chain to obfuscate the true C2 server, making it harder for threat intelligence teams to identify and disrupt the upstream infrastructure.
• SOCKS5: Offering more modularity than TCP forward, SOCKS5 allowed for UDP and IPv6 traffic forwarding and could enforce token-based authentication. This meant that even if the SOCKS5 proxy was discovered via internet scans (e.g., SHODAN, Census, BinaryEdge), it would not respond without the correct embedded token, further enhancing stealth.

Cuttlefish: Memory-Resident Cloud Credential Theft

Cuttlefish represented an evolution, focusing on the highly lucrative target of cloud services.

1. Memory-Only Malware:

• Unlike HiatusRAT, Cuttlefish prioritized stealth by loading its payload directly into memory, binding it to a process, and then deleting the original file from the disk. This technique, often referred to as fileless malware, significantly complicates forensic analysis, as the malware leaves no persistent trace on the file system and disappears upon system reboot or power cycle. Recovery requires a memory image, process identification, and carving out the binary, a "giant pain."

1. Cloud Credential Sniffing:

• The primary function of Cuttlefish was to act as a sniffer for cloud resources. It would identify public IP addresses and use an allow-list for specific IP ranges.
• It actively searched for credential markers within URLs and HTTP traffic, such as "API token," "auth_token," and "API keys."
• Upon detection, these credentials would be written to disk on the router. Once a certain size was reached, the file would be zipped, tarred, and exfiltrated via VPN or SOCKS5.
• The shift to cloud targeting reflects the industry-wide move towards cloud services, where traditional EDR, network segmentation, and identity management solutions are often less effective or non-existent, making authorized token access extremely difficult to detect.
• An intriguing, unresolved aspect was the attempt to sniff port 443 (TLS/HTTPS), despite no observed decryption or downgrade capabilities. This suggests either a future capability, a passive collection strategy for later decryption, or an attempt to identify encrypted traffic patterns.

1. Internal Hijacking with 302 Errors:

• Cuttlefish also focused on internal hijacking, specifically targeting unencrypted protocols like DNS (UDP 53) and HTTP (TCP 80).
• A sophisticated technique involved local DNS hijacking using HTTP 302 temporary redirection errors. If the malware encountered traffic it couldn't intercept, it would introduce a 302 error, redirecting the traffic to an adversary-controlled monitoring point. This man-in-the-middle technique is entirely invisible to the end-user and requires no user interaction, making it highly effective for credential harvesting within private networks.

Linkage and Attribution

The connection between HiatusRAT and Cuttlefish was strongly established through:

• Identical Build Paths: The presence of the exact same build paths (e.g., build/route/2020/0/02/0/04/ARM/output) in both malware families indicated they originated from the same development environment, likely the same threat actor or development shop.
• Certificate Reuse/Pattern: Initial HiatusRAT infrastructure used certificates with a common name of 127.0.0.1. Later iterations and Cuttlefish infrastructure shifted to 127.0.0.2 and changed serial numbers (e.g., from 1 to 3), maintaining a consistent, albeit slightly modified, pattern.
• Trolling Naming Convention: The discovery of a hidden file named .putin in a prior iteration of HiatusRAT suggested an attempt to misdirect attribution, a common tactic among nation-state actors.

The targeting shifts observed from the threat actor were also telling. Initially focused on general email traffic, they later expanded to specific geopolitical targets. The use of Turkish-based IP addresses for C2 infrastructure, particularly affecting satellite and telecommunications providers, hinted at intelligence collection on US military assets operating in regions like Syria and Iraq, leveraging Turkey's role as a communications hub. The subsequent targeting of Taiwan and US DoD further solidified the nation-state espionage motive and the strategic objectives of the threat actor.

Demo / Proof of Concept

▶ Watch: Gen. Alexander's "greatest transfer of wealth" cyber espionage quote (5:50)

While the talk did not feature a traditional software demonstration, Danny Adamitis provided compelling live evidence of the threat actor's continued operations and brazenness. During the presentation, a "live check" was performed, showing an active certificate associated with the HiatusRAT campaign. A screenshot from Adamitis's MacBook, timestamped October 19th, 10:46 AM (the day of the talk), displayed an active certificate and an IP address (22.227.22.228) that was a sequential increment from previously identified C2 infrastructure (22.227.22.227).

This live demonstration underscored the key finding that the adversaries, despite public disclosure and blocking efforts, simply re-established their infrastructure with minimal changes, often just incrementing IP addresses or serial numbers. This "level of brazenness" highlights their confidence in operating largely unhindered, a stark reminder that simply publishing IOCs or null-routing C2s is often insufficient to deter a well-resourced and determined nation-state adversary. It visually reinforced the "they don't care who catches them" sentiment, showing that the campaign, which started in 2021, was still actively beaconing on the very day of the conference.

Defensive Implications

▶ Watch: Transition to technical details: What is HiatusRat? (7:50)

The insights from HiatusRAT and Cuttlefish provide critical lessons for defenders, urging a fundamental rethinking of network security strategies:

• Expand the Perimeter: The traditional network perimeter, often defined by firewalls, is insufficient. Corporate routers, especially those at remote sites or used by remote employees, are now critical components of the attack surface. Organizations must extend their security posture to include these devices.
• Patch and Update Routers: Prioritize updating router firmware, even for EOL devices where possible. If updates are unavailable, replace EOL devices. Downtime costs money, but the cost of compromise is far greater.
• Monitor Router Logs: The absence of monitoring on routers is a significant blind spot. Implement logging and analysis for router activity. If native logging is poor, explore external solutions or specialized network monitoring tools.
• Implement VPNs: Any VPN is better than no VPN. Encrypting traffic between remote users/sites and corporate resources significantly raises the bar for adversaries trying to sniff data in transit. While not a complete panacea (encrypted traffic can still be collected for later decryption), it's a crucial first step.
• Network Segmentation: Create robust network segmentation to contain potential breaches and limit lateral movement if a router or remote device is compromised.
• Identify and Protect Crown Jewels: Focus security efforts on the most critical assets. Understand what data is truly valuable and implement layered defenses around it, including strong authentication, encryption, and access controls.
• Challenge Geoblocking Assumptions: Geoblocking is not a silver bullet. Adversaries routinely use local infrastructure (e.g., an ice cream shop next door) or compromised devices within target countries, bypassing geographical restrictions.
• Address Cloud Security Gaps: The shift of data to the cloud necessitates a re-evaluation of cloud security. Traditional EDR and network segmentation paradigms often don't apply directly. Implement robust identity and access management (IAM), monitor cloud API calls, and audit cloud configurations diligently.
• Beware of Memory-Only Malware: The use of memory-resident malware like Cuttlefish demands advanced forensic capabilities, including memory analysis, rather than relying solely on disk-based artifact collection. Organizations should train incident responders in these techniques.
• Prioritize Foundational Security: The brazenness of these actors highlights that many organizations are still struggling with fundamental security hygiene. While advanced tools are important, ensuring basic patching, configuration management, and monitoring across all network devices remains paramount.

Key Takeaways

• Routers are the New Endpoint: Advanced threat actors are consistently targeting routers, especially end-of-life devices, as unmonitored footholds to bypass traditional endpoint security.
• Data in Transit is the Target: Adversaries are shifting from directly attacking email servers to passively collecting sensitive communications (SMTP, IMAP, POP3) and cloud credentials (API keys, auth tokens) as they traverse the network.
• Brazen Persistence: These Chinese APTs demonstrate extreme persistence and a lack of concern for public disclosure, often rebuilding infrastructure with minimal changes within weeks.
• Cloud is the Next Frontier: The ubiquity of cloud services makes them a prime target for credential theft, with actors employing sophisticated techniques like memory-only malware and local DNS hijacking.
• Expand Your Perimeter Definition: Organizations must recognize that their security perimeter extends to all network-connected devices, including remote employee routers, and prioritize their security and monitoring.
• Foundational Security is Paramount: Basic security hygiene, such as patching, monitoring, and using VPNs, remains the most effective defense against sophisticated adversaries exploiting fundamental operational blind spots.

About the Speaker(s)

Danny Adamitis is a researcher at Lumen Technologies, where he works with the threat intelligence team, Black Lotus Labs. With a decade of experience in cybersecurity, Danny has a strong interest in areas such as DNS hijacking, router-based exploitation, and campaigns targeting Unix and Solaris devices, focusing on often-forgotten parts of the internet infrastructure that adversaries frequently target.

Ryan English is also a researcher at Lumen Technologies, contributing to the work of Black Lotus Labs.