Evading Detection: The Rise of SILKLOADER Malware and its Ties to Chinese and Russian Cybercriminals

In recent years, Chinese and Russian hackers have turned to increasingly sophisticated methods to evade detection. One such example is the use of SILKLOADER malware, which enables them to load Cobalt Strike onto infected machines.

As cybersecurity companies continue to improve their detection capabilities, cybercriminals must constantly adapt and find new ways to propagate their tools. This article explores the emergence of SILKLOADER, its ties to Chinese and Russian hackers, and the broader implications for cybersecurity.

The Emergence of SILKLOADER Malware

Finnish cybersecurity company WithSecure has discovered a new malware, dubbed SILKLOADER, that is being used by threat actors affiliated with Chinese and Russian cybercriminal ecosystems. This malware leverages DLL side-loading techniques to deliver commercial adversary simulation software, specifically the Cobalt Strike framework.

This development has come as a response to improved detection capabilities against Cobalt Strike, a legitimate post-exploitation tool used for red team operations.

SILKLOADER and Its Kin: KoboldLoader, MagnetLoader, and LithiumLoader

SILKLOADER is not the only loader used by cybercriminals to incorporate Cobalt Strike components. Other recently discovered loaders include KoboldLoader, MagnetLoader, and LithiumLoader. Both SILKLOADER and LithiumLoader employ DLL side-loading methods to hijack legitimate applications with the goal of running a separate, malicious dynamic link library (DLL).

SILKLOADER in Action: A Closer Look at Recent Attacks

WithSecure has identified the use of SILKLOADER in several human-operated intrusions targeting a wide range of organizations in Brazil, France, and Taiwan in the last quarter of 2022. While these attacks were ultimately unsuccessful, they are suspected to be a precursor to ransomware deployments. In one instance, a French social welfare organization was targeted, and the threat actor gained a foothold in their network by exploiting a compromised Fortinet SSL VPN appliance to stage Cobalt Strike beacons.

The Packer-as-a-Service Model: SILKLOADER’s Role in the Cybercriminal Ecosystem

SILKLOADER is believed to be offered as an off-the-shelf loader through a Packer-as-a-Service program to Russian-based threat actors. This means that the loader is provided either directly to ransomware groups or via groups offering Cobalt Strike and Infrastructure-as-a-Service to trusted affiliates. WithSecure’s analysis suggests that most of these affiliates have had close working relationships with the Conti group, its members, and offspring after its alleged shutdown.

The Origins and Evolution of SILKLOADER

SILKLOADER samples analyzed by WithSecure reveal that early versions of the malware date back to the beginning of 2022. Initially, the loader was exclusively used in attacks targeting victims in China and Hong Kong. The shift from East Asian targets to countries like Brazil and France is believed to have occurred around July 2022. Since then, all SILKLOADER-related incidents have been attributed to Russian cybercriminal actors.

This suggests that SILKLOADER was initially developed by threat actors within the Chinese cybercriminal ecosystem and was later acquired by a Russian threat actor. This acquisition is believed to have occurred between July 2022 and September 2022, when the original Chinese author sold the loader to a Russian threat actor after it was no longer of use to them.