Open Source Hacking Tool Grows Up

Koadic toolkit gets upgrades — and a little love from nation-state hackers.

An open source white-hat hacking tool that nation-state hacking teams out of China, Iran, and Russia have at times employed to avoid detection has been updated with new features that allow attacks to persist and spread more efficiently.
Sean Dillon, creator of the so-called Koadic tool that works like a remote access Trojan (RAT), says the software he first released two years ago at DEF CON can now extract information and intelligence about a targeted Windows environment, more efficiently scrape user credentials, and more easily spread around a network. Its much more efficient now. It can be used to compromise entire networks in a matter of minutes, says Dillon, who plans to show off
Koadics
new features next month at the Black Hat USA Arsenal in Las Vegas.
Koadic is basically a RAT based on VBScript and JScript that uses Windows executables such a PowerShell rather than malware, so it mimics a growing trend of sophisticated
attackers employing legitimate tools
instead of writing or burning their own exploits. The trend, known as living off the land, also allows attackers to remain under the radar as they run internal Windows tools like PowerShell to hack their way through networks.
Koadic uses built-in Windows executables and most recently added a Windows Management Interface and SysAdmin to its quiver. These are binaries that are shipped by default with all versions of Windows, Dillon notes, and they are signed by Microsoft so they can slip past most whitelisting applications. The original version of Koadic targeted a single machine and had little ability to move laterally to other machines.
We now have several different ways to poke into the system, and when a computer is back up from a restart the attack will continue, he notes.
Among some of the newer features: UAC (user account control) bypasses, automated file-discovery, and credential storage that converts Mimikatz outputs into a searchable form.
Nation-state groups, such as Chinas Stone Panda, Irans MuddyWater, and Russias Fancy Bear, all have been spotted using Koadic in their hacking campaigns. In the past year or two, APT groups have been using open source tools in order to hide out, Dillon says. If they write custom malware, the attack could be attributed to them. ... If they use something open source, its hard to see who is attacking an organization.
But Dillons intent for the tool is to help professional penetration testers find holes before the bad guys do. Still, Koadic today continues to easily bypass most endpoint security tools: Every time [the vendors] come up with a detection for it, we come up with another evasion, he says. Sometimes its only a matter of changing a comma or a word in the string, and it breaks the anti-malware vendors detection signature, he notes.
That underscores the need for better behavioral detection methods for defenses, he adds.
Related Content:
The Rise of Purple Teaming
Effective Pen Tests Follow These 7 Steps
Too Many Tools? Tidy Up in KonMari Style
The State of IT Operations and Cybersecurity Operations

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the
conference
and
to register.

Last News
▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security	▸ Criminal Possession of Government-Grade Stealth Malware ◂ Discovered: 23/12/2024 Category: security	▸ Senate wants changes to cybercrime law. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Open Source Hacking Tool Grows Up