Researchers Fingerprint Exploit Developers Who Help Several Malware Authors

Producing innovative malware for a risk actor necessitates various groups of folks with diverse specialized experience to set them all jointly. But can the code depart adequate clues to reveal the human being at the rear of it?

To this impact, cybersecurity scientists on Friday in depth a new methodology to identify exploit authors that use their unique characteristics as a fingerprint to keep track of down other exploits made by them.

By deploying this technique, the researchers ended up ready to url 16 Home windows neighborhood privilege escalation (LPE) exploits to two zero-day sellers “Volodya” (beforehand referred to as “BuggiCorp”) and “PlayBit” (or “luxor2008”).

“As an alternative of focusing on an overall malware and searching for new samples of the malware relatives or actor, we preferred to provide yet another point of view and made a decision to focus on these handful of capabilities that were created by an exploit developer,” Check Point Research’s Itay Cohen and Eyal Itkin mentioned.

Fingerprinting an Exploit Writer’s Traits

The idea, in a nutshell, is to fingerprint an exploit for specific artifacts that can uniquely tie it to a developer. It could be in utilizing hard-coded values, string names, or even how the code is structured and sure capabilities are applied.

Examine Place stated their investigation began in reaction to a “difficult assault” towards a single of its prospects when they encountered a 64-little bit malware executable that exploited CVE-2019-0859 to attain elevated privileges.

Noticing the simple fact that the exploit and the malware have been composed by two various sets of men and women, the scientists employed the binary’s houses as a one of a kind looking signature to come across at the very least 11 other exploits made by the exact developer named “Volodya” (or “Volodimir”).


“Getting a vulnerability, and reliably exploiting it, will most likely be accomplished by particular teams or folks who focus in a particular part. The malware developers for their element don’t truly treatment how it works at the rear of the scenes, they just want to combine this [exploits] module and be accomplished with it,” the researchers said.

Apparently, Volodya — possible of Ukrainian origin — has been previously linked to providing Windows zero-times to cyberespionage teams and crimeware gangs for anywhere in between $85,000 to $200,000.

Main among them was an LPE exploit that leveraged a memory corruption in “NtUserSetWindowLongPtr” (CVE-2016-7255), which has been widely employed by ransomware operators like GandCrab, Cerber, and Magniber. It’s now considered that Volodya advertised this LPE zero-day on the cybercrime discussion board in Could 2016.

In all, five zero-day and six one particular-day exploits were being determined as produced by Volodya about a period of time of 2015-2019. Subsequently, the exact same strategy was utilized to discover 5 a lot more LPE exploits from yet another exploit writer regarded as PlayBit.

An Considerable Clientele

Stating the exploit samples shared code amount similarities to grant Procedure privileges to the preferred method, the scientists mentioned, “both of those of our actors were very regular in their respective exploitation routines, each and every sticking to their preferred way.”

What is actually extra, Volodya also seems to have switched up his practices through the intervening several years, with the developer shifting from offering the exploits as embeddable supply code in the malware to an external utility that accepts a distinct API.

Besides ransomware teams, Volodya has been discovered to cater to an intensive clientele, together with the Ursnif banking trojan, and APT teams such as Turla, APT28, and Buhtrap.


“The APT shoppers, Turla, APT28, and Buhtrap, are all frequently attributed to Russia and it is interesting to uncover that even these state-of-the-art teams acquire exploits instead of building them in-property,” Verify Issue observed in its examination. “This is a different issue which more strengthens our speculation that the published exploits can be addressed as a separate and distinct component of the malware.”

With cyberattacks growing in scope, frequency, and magnitude, making use of an exploit developer’s code signature as a usually means to keep track of down poor actors could deliver useful insight into the black exploit market place.

“When Look at Level finds a vulnerability, we demonstrate its severity, report it to the ideal seller, and make absolutely sure it is really patched, so it does not pose a risk,” Cohen stated. “Nevertheless, for folks investing these exploits, it is really a entirely different tale. For them, finding the vulnerability is just the beginning. They need to have to reliably exploit it on as several versions as feasible, in get to monetize it to a customer’s satisfaction.”

“This research provides insight into how that is reached, and the consumers in this market place, which typically include things like country-condition actors. We imagine that this investigation methodology can be utilized to detect supplemental exploit writers.”

Fibo Quantum