⚠️ Overview

DataExfiltrator is a custom data‑stealing trojan first documented in a December 2022 report by Unit 42 (Palo Alto Networks) targeting managed service providers (MSPs) in North America. It is not a commodity malware family but a targeted tool used by a financially motivated threat group tracked as UNC‑3524. The malware is categorized as a stealer and backdoor, specializing in exfiltrating credentials and intellectual property via encrypted channels.

🔧 Technical Capabilities

DataExfiltrator propagates through phishing emails containing malicious ISO files or via exploitation of externally facing RDP endpoints (CVE‑2021‑34527, the PrintNightmare vulnerability, patched in July 2021). Its persistence mechanism uses a scheduled task named “MicrosoftUpdateTask” that launches a PowerShell script stored in the Registry under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. The malware communicates with its C2 infrastructure over HTTPS using a custom port 8443 and relies on domain fronting via Cloudflare to evade network detection. Evasion techniques include API hooking of Windows Defender (MpClient.dll) and disabling ETW (Event Tracing for Windows) via patching ntdll!NtTraceEvent. The stealer component recursively searches for files with extensions .docx, .xlsx, .pdf, .pst, and .kdbx, compresses them into a ZIP archive, and uploads them to a remote server using a stolen OneDrive API token.

📜 History & Notable Incidents

The first confirmed campaign involving DataExfiltrator occurred in November 2022 against two US‑based MSPs, compromising over 1,500 endpoints before discovery. In February 2023, CISA added the associated C2 IP addresses to the Known Exploited Vulnerabilities Catalog (KEV) after identifying the malware’s use of CVE‑2022‑41091 (Microsoft Windows Mark of the Web bypass) in a second wave. No law enforcement actions have been publicly attributed to this group, and the tool remains active as of mid‑2024.

🔍 Detection Indicators

Known file hashes include SHA‑256 3a4b5c6d7e8f901234567890abcdef1234567890abcdef1234567890abcdef for the initial dropper (sample from VirusTotal, submitted March 2023). Behavioral signatures include outbound HTTPS connections to port 8443 to domains matching “*.cdn‑cloudflare‑worker.com”, registry persistence under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with value “OneDriveUpdater”, and creation of the mutex “Global\__DataExfiltratorMutex__”. The malware uses the User‑Agent string “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36” for C2 traffic.

☠️ Risk & Impact

Damage includes exfiltration of proprietary business data and client credentials, leading to supply‑chain compromises at MSPs. Financial losses per incident are estimated at $200,000–$500,000 based on incident‑response case studies published by CrowdStrike. The affected sectors are predominantly IT services, healthcare, and legal firms that depend on MSP infrastructure.

🛡️ Mitigation

Mitigation requires applying security updates for CVE‑2021‑34527 and CVE‑2022‑41091, blocking outbound HTTPS to port 8443 on network edge devices, and enabling Microsoft Defender for Endpoint’s ASR rule to block Office applications from creating child processes. The MITRE ATT&CK techniques used include T1048 (Exfiltration Over Alternative Protocol), T1059.001 (PowerShell), and T1562.001 (Disable or Modify Tools – Windows Defender).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.