Analyzing the Stealthy Tactics of the ToddyCat APT Group: Exploit Techniques and Detection Challenges

Advanced Persistent Threat (APT) groups such as ToddyCat continually evolve their strategies to hide their malicious activities within compromised systems. They leverage various techniques to bypass endpoint protection platforms (EPP) and endpoint detection and response (EDR) tools. Notably, the use of kernel-level rootkits to manipulate Windows systems remains a primary tactic. Currently, legitimate kernel-mode drivers require Microsoft digital signatures to load on most recent Windows versions, forcing attackers to adopt innovative methods for evasion.

Instead of directly introducing malicious drivers, ToddyCat attackers utilize legitimate drivers that, while properly signed, exhibit vulnerable code functions. This allows their payloads to execute unnoticed. Traditional monitoring tools typically track patterns involving suspicious driver installations, but when malicious software masquerades as trusted security applications, it can escape scrutiny.

Discovery and Initial Detection

In early 2024, a significant breakthrough occurred during the investigation of ToddyCat-related incidents when researchers uncovered a suspicious file named version.dll in the temporary directories of affected devices. This 64-bit dynamic link library (DLL), crafted in C++, turned out to be a sophisticated payload called TCESB, designed to execute other malicious operations while disguised from traditional protective measures.

Kaspersky's products flagged this as Trojan.Win64.ToddyCat.a and Trojan.Win64.ToddyCat.b, unveiling the malicious nature of TCESB.

Mechanisms Behind TCESB

DLL Proxying Technique

Static analysis of TCESB revealed a key tactic: DLL proxying. Each function exported by TCESB directly imports functions of the legitimate version.dll, maintaining the facade of normal operations. This technique, known as Hijack Execution Flow (T1574), allows the execution of malicious code in the background while the original application operates normally.

List of functions exported by TCESB

The malicious DLL does require a vulnerable application to load it, which checks specific folders for dynamically linked libraries. If a malign DLL is found in an unexpected place, the application loads it instead of a legitimate file, as specified in Microsoft's advisory on preventing unsafe DLL loading.

Vulnerability Exploitation through ESET Software

Finding a specific system component that calls the TCESB tool led investigators to an extensionless executable, ecls, an ESET Command Line Scanner. This EPP solution was discovered to insecurely load version.dll, leading to potential exploitation when the attacker's malicious library was loaded instead of the legitimate one.

Upon reporting this security oversight to ESET, they acknowledged CVE-2024-11859, implementing a patch to rectify the vulnerability by January 21, 2025. A security advisory was released shortly after detailing this flaw.

Analyzing TCESB in a controlled environment revealed two version.dll files in memory during the operation of the ESET scanner—one from the system and the other the manipulated TCESB DLL.

Malicious and legitimate libraries in the memory of the ecls.exe process

Examining TCESB's Functionalities

To gain insight into TCESB's capabilities, researchers analyzed non-obfuscated strings from within the DLL. A significant finding was the link to an open-source tool called EDRSandBlast, known for bypassing security solutions. Detecting modifications to core functionalities of this open-source tool has raised alarms in the cybersecurity community, as ToddyCat adapted it to enhance its methods.

Among TCESB's capabilities is its ability to modify core operating system structures to silence notifications about new processes or library loads, thus evading detection.

Kernel Memory Addressing

By determining the version of the Windows kernel it operates in, TCESB uses system function calls to search for kernel structure addresses within kernel memory. It leverages internal data, such as CSV or PDB files, searching for the necessary structure offsets associated with the running kernel version.

The tool employs a CSV file that holds kernel data—a snapshot taken from EDRSandBlast's earlier version—and if this proves insufficient, TCESB accesses Microsoft's server for a PDB file, utilizing HTTP requests to retrieve this critical information.

Exploiting Known Vulnerabilities

To execute its agenda, TCESB employs the Bring Your Own Vulnerable Driver (BYOVD) technique—an advanced method that involves installing drivers known to have vulnerabilities. This is achieved by integrating a known vulnerable driver, Dell's DBUtilDrv2.sys, whose vulnerabilities have been documented under CVE-2021-36276.

Payload Execution Loop

After establishing the environment and deploying the vulnerable driver, TCESB actively checks for an encrypted payload file in a specified directory. Presumably, attacking operators execute this check in a timed loop, ready to deploy the payload only when it is confirmed as available, including tools for detailed logging of execution processes.

Snippet of decompiled TCESB code

Among the examined sample payloads, differing names were evident, like kesp and ecore, both of which are devoid of extensions. Additionally, the encrypted data is safeguarded with AES-128 encryption, with the decryption key contained within the payload’s first 32 bytes, providing functionality to subsequently decrypt and execute the nested data.

Snippet of code for determining the encryption algorithm

Recommendations and Future Observations

The analysis uncovered a sophisticated tool that the ToddyCat APT employs to execute operations stealthily within infected systems. By exploiting various vulnerabilities and leveraging modified versions of existing malware, they extend their operational capabilities. Organizations should be vigilant about monitoring for installation events involving known vulnerable drivers, utilizing resources available through the loldrivers initiative. Additionally, vigilance in tracking Windows kernel debug symbol loads can help identify unsafe activity across systems.

Indicators of Compromise

Malicious Files Hashes

D38E3830C8BA3A00794EF3077942AD96   version.dll
008F506013456EA5151DF779D3E3FF0F   version.dll

Legitimate File for DLL Proxying

8795271F02B30980EBD9950FCC141304  ESET Command-line scanner

Legitimate Files for BYOVD

B87944DCC444E4C6CE9BB9FB8A9C0DEF  dbutildrv2.INF
DE39EE41D03C97E37849AF90E408ABBE  DBUtilDrv2.cat
DACB62578B3EA191EA37486D15F4F83C  dbutildrv2.sys