Campaign comparison

Feng Shui: A Custom, Fully-Obfuscated Sliver Implant Deployed to a Palo Alto Firewall (CVE-2024-0012 + CVE-2024-9474) vs The DDoS Zombie That Won't Let Go

2026-07-09  ·  2026-09-10

Link signals

Strong link Same procedure, different tooling — 4 techniques run in the same order, with no shared tools, payload, or infrastructure (likely the same operator after retooling, or a shared playbook)
Analytic Same stage(s) reached by different techniques: defense-evasion, command-and-control — same objective, different method
Commodity Shared ATT&CK technique(s): T1027, T1059.004, T1070.003, T1190, T1543.002 — commodity, many actors share these

Actor & objective

Actor unattributed vs unattributed different
Objective unknown (intent unproven) vs DDoS-for-hire botnet recruitment: conscripts the host as an on-demand flooding zombie, not data theft. The lockdown behavior exists to keep the machine exclusively under the operator's control. different

Kill chain

= same stage & technique   ≠ same stage, different technique   • unique to one campaign

Feng Shui: A Custom, Fully-Obfuscated Sliver Implant Deployed to a Palo Alto Firewall (CVE-2024-0012 + CVE-2024-9474)

  1. unique step: 1. reconnaissance
    two visits to PAN-OS management interface hours apart
  2. shared step: 2. initial-access · T1190
    CVE-2024-0012 auth bypass + CVE-2024-9474 privesc chained in a single request
  3. shared step: 3. execution · T1059.004
    backtick injection executes bash dropper (in.js) fetching implant up.js
  4. shared step: 4. persistence · T1543.002
    Sliver implant masquerades as /usr/bin/e3fsck; timestamp copied from /usr/sbin/e3fsck
  5. shared step: 5. defense-evasion · T1027
    UPX-packed obfuscated custom Sliver; staging server blocks cloud/AWS/GCP/Azure/CF IP ranges
  6. divergent step: 6. command-and-control · T1071.001
    HTTPS beacon to secpopper.world; fallback catalapnews.today; DNS C2 fallback
  7. unique step: 7. lateral-movement · T1021
    WireGuard tunnel + SOCKS proxy pivot into internal network

The DDoS Zombie That Won't Let Go

  1. shared step: 1. initial-access · T1190
    Jenkins Script Console reachable from the internet without a password; Groovy code execution as the service account, no exploit required
  2. shared step: 2. execution · T1059.004
    delivery command tries five writable directories and three download tools (wget/curl/busybox wget) in turn, then runs the binary four times in a row
  3. shared step: 3. persistence · T1543.002
    writes /etc/systemd/system/system-helper.service ("System Helper", Restart=always), enables it, then deletes its own file from disk
  4. divergent step: 4. defense-evasion · T1562.004
    adds firewall chain LOCKER_INPUT dropping inbound traffic on SSH/Telnet/RDP/VNC ports so remote access cannot be restored
  5. unique step: 5. impact · T1489
    kills sshd, dropbear, ftpd, vncserver, xinetd and in.telnetd before the firewall rules go in
  6. divergent step: 6. defense-evasion · T1562.001
    sets 19 download-tool binaries (wget/curl/tftp/scp/aria2c and others) to permission 000, and SIGKILLs ps/top/netstat/tcpdump/strace/gdb and a dozen other analysis tools the instant they start
  7. divergent step: 7. defense-evasion · T1070.002
    deletes and recreates empty auth.log, syslog, messages, secure, wtmp, btmp, lastlog, faillog, dmesg, kern.log and the journal/audit directories
  8. divergent step: 8. defense-evasion · T1070.003
    wipes .bash_history and .zsh_history for the current user and root
  9. shared step: 9. defense-evasion · T1027
    the process-blocklist table (gdb, strace, ltrace, objdump, readelf, strings, radare2, iaito, ghidra, binwalk) is stored XOR'd with 0xE7 at a fixed offset so it never appears in a strings dump; identical across both builds
  10. divergent step: 10. defense-evasion · T1622
    background thread every 10 seconds: self-ptrace, TracerPid check, FNV-1a memory hash against a baseline, and a scan for the 0xCC breakpoint byte; any hit kills and relaunches the process from /proc/self/exe
  11. divergent step: 11. defense-evasion · T1036.004
    renames its running process to kworker/0:0, mimicking a kernel worker thread that would never hold a network socket
  12. divergent step: 12. command-and-control · T1571
    hardcoded IPv4 literal and fixed port (83.168.69[.]95:9482); plain-text single-line protocol, no domain, no DNS lookup, no encryption, no fallback
  13. unique step: 13. impact · T1498
    on command, floods a named target using one of 11 methods (udpplain, syn, std, pps, ack, raknet, ssh, http, tcpstomp, minecraft, ovh)

Side by side

green = shared by both campaigns.

Attribute-by-attribute comparison of Feng Shui: A Custom, Fully-Obfuscated Sliver Implant Deployed to a Palo Alto Firewall (CVE-2024-0012 + CVE-2024-9474) and The DDoS Zombie That Won't Let Go. Values labelled "shared" appear in both campaigns.
Feng Shui: A Custom, Fully-Obfuscated Sliver Implant Deployed to a Palo Alto Firewall (CVE-2024-0012 + CVE-2024-9474) The DDoS Zombie That Won't Let Go
Procedures
exploit-escalation:try-newer-then-pivothistory-suppression:HISTFILEmasquerade-as-system-binarytimestomp:touch-rAV/sandbox-domain hosts-file poisoning (21 entries to 0.0.0.0)XOR-obfuscated (0xE7) anti-analysis process-block tableanalysis-tool SIGKILL on launchdownload-tool permission-zeroing (chmod 000 across 19 paths, reversible via a saved permissions list)firewall-based remote-access denial (LOCKER_INPUT chain)iterative recompilation (2 builds, 7 days apart, from the same URL)kworker process-name masquerademulti-directory, multi-tool delivery fallback (5 candidate directories, 3 download tools, 4x execution)ptrace/TracerPid/memory-hash/breakpoint-byte anti-debug with self-relaunchrival bot/miner eviction
Toolmarks
bypass:watchTowr.js.mapmasquerade:/usr/bin/e3fsckC2 registration string format: "<arch> <group> <memMB> <cpus>"build 2 only: .cron_backup/, .locker.disabled, a "stealth" line appended to /etc/modulesfile names .locker.pid / .locker.lock / .locker.ready / .watchdog.pid / .disabled.list / .iptables.rulesfirewall chain LOCKER_INPUTprocess name t.me/flylegitservice unit system-helper.service ("System Helper")
C2 protocol
https beacon /api/javascripts/bundles/route.js (procedurally generated) to secpopper.world; fallback catalapnews.today; DNS C2 fallbackcustom plain-text TCP on port 9482: registration string "<arch> <group> <memMB> <cpus>", ping/pong keepalive, unencrypted attack-order commands, 8-second retry cadence, gives up after 450 straight failures
Tooling
sliverupxwatchtowr-cve-2024-0012-bypassmirai-derived custom DDoS bot (C, static uClibc, UPX-packed)
Capabilities
Cobalt Strike BOF supportOS credential dumping (MakeToken/ImpersonateReq)SOCKS proxy pivotWireGuard tunnelinganti-forensics (timestomp, history wipe)hardcoded plain-text C2 over a non-standard port; no domain, no DNS, no encryption, no fallbackon-command DDoS flood across 11 methods (udpplain, syn, std, pps, ack, raknet, ssh, http, tcpstomp, minecraft, ovh)rival-bot and rival-miner eviction to keep the host exclusiveself-defense lockdown: kills remote-access daemons, firewalls off SSH/Telnet/RDP/VNC ports, zeroes permissions on 19 download tools, kills analysis tooling the instant it launches, poisons /etc/hosts against 21 AV/sandbox vendors, deletes logs and shell historysystemd persistence (Restart=always) plus a self-relaunch-from-memory routine triggered by anti-debug checks
C2
catalapnews.todaysecpopper.world83.168.69.95:9482 (hardcoded plain-text control channel, both builds)
ASNs
—AS202520 (SkyPass Solutions, Warsaw, Poland — staging and C2 host, same machine on two ports)
Domains
catalapnews.todayfeng-shui.uasecpopper.world—
CVEs
CVE-2024-0012CVE-2024-3400CVE-2024-9474—
Products
PAN-OSJenkins (Script Console)

← Compare a different pair