CLOUDHAZE Propose Change

According to Rogue Authority, CLOUDHAZE is a backdoor written in Rust that is compiled into a working, EV-signed PDF viewer, which serves as the lure while the backdoor module, named "zenith" by its authors, runs alongside it. On start it writes a persistent machine identifier to a file disguised as viewer settings and checks in with its C2 server over HTTPS, using a geology-themed protocol in which messages are additionally gzip-compressed, XOR-chained with a fixed key and per-message seed, bit-rotated and shuffled with a seeded Fisher-Yates permutation before base64 encoding. Its tasking allows execution of arbitrary commands in a hidden command shell with the output returned, as well as reading and replacing files in a Chromium-family browser profile and restarting the browser with that profile, apparently to change browser settings or extensions without the user's involvement. It polls the C2 server very rarely, and one-character edits to embedded Rust source paths may be intended to defeat string-based detection and code similarity matching.

References

There is no Yara-Signature yet.