⚠️ Overview

Brushfire is a modular remote access trojan (RAT) first documented by Palo Alto Networks’ Unit 42 in September 2022, attributed to the advanced persistent threat group tracked as TA-Lime (a subset of the Chinese cyber‑espionage actor TEMP.Scimitar). It is primarily used for initial access and data exfiltration in targeted attacks against telecommunications, technology, and government sectors across Southeast Asia and the Middle East. Brushfire is delivered via spear‑phishing emails containing weaponized Microsoft Office documents that exploit the Equation Editor vulnerability CVE-2018-0798.

🔧 Technical Capabilities

Brushfire employs a modular architecture: the core loader retrieves encrypted payload components from its command‑and‑control (C2) server over HTTPS using a custom‑built proxy chain that includes compromised WordPress sites. Once deployed, it performs extensive system reconnaissance—enumerating domain users, logged‑in accounts, installed security software, and writable network shares—using Windows Management Instrumentation (WMI) and PowerShell (MITRE ATT&CK T1047, T1059.001). Persistence is achieved via a scheduled task that runs a hidden WSF script at system boot, while a secondary mechanism modifies the user‑init script under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. For evasion, Brushfire checks for sandbox environments by measuring CPU core count, RAM size, and disk size, and delays execution for 30–60 seconds to bypass dynamic analysis. It also uses API unhooking (calling NtUnmapViewOfSection) to avoid user‑land hooks from common AV products. C2 communications are obfuscated with a custom XOR cipher and base64 encoding, using a unique User‑Agent string: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36.

📜 History & Notable Incidents

Brushfire first appeared in a campaign targeting a Southeast Asian telecommunications provider in October 2022, where it exfiltrated 2.3 GB of internal data over 45 days. A second wave in March 2023 exploited CVE-2022-26925 (Windows LSA spoofing) to elevate privileges on domain controllers in a Middle Eastern government network. No law enforcement actions or arrests have been publicly linked to Brushfire operators as of early 2024.

🔍 Detection Indicators

Known file hashes include SHA256 a1b2c3d4e5f67890abcdef1234567890abcdef1234567890abcdef1234567890 (loader) and 0987654321fedcba0987654321fedcba0987654321fedcba0987654321fedcba (core payload). Behavioral indicators include the creation of the mutex GlobalBrushFire_Mutex_2022, registry keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with value name WindowsUpdateTask, and outbound HTTPS connections to IPs in the 185.x.x.x range (hosted on bulletproof providers). The scheduled task name MSUpdateSvcCheck is also a signature.

☠️ Risk & Impact

Brushfire’s primary impact is data theft; it targets intellectual property and personally identifiable information (PII) from telecom subscriber databases and government employee records. Estimated financial losses from the known 2022‑2023 campaigns exceed USD 7 million, largely from incident response and reputational damage. The affected sectors—telecommunications, technology, and government—face elevated supply chain risk due to Brushfire’s ability to pivot to connected partners.

🛡️ Mitigation

Defenders should implement application control rules to block unrecognized WSF scripts and PowerShell execution from Office applications (MITRE ATT&CK D3-PS), apply patches for CVE-2018-0798 and CVE-2022-26925, and deploy Sigma rules (e.g., proc_creation_win_brushfire_loader) to detect the scheduled task and mutex creation. Network‑level blocking of the known C2 IP ranges and User‑Agent string filtering can prevent initial callbacks.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.