Alchimist: A new attack framework in Chinese for Mac, Linux and Windows
Summary: Cisco Talos discovered a single-file command and control framework called "Alchimist," a 64-bit GoLang Linux executable packed with a Simplified Chinese web interface and Insekt RAT payloads for Windows and Linux. Talos assesses with moderate-high confidence the framework is used in the wild, and found it alongside a Mach-O dropper exploiting CVE-2021-4034 in polkit's pkexec, a Mach-O bind shell backdoor, psexec, netcat, and the fscan intranet scanning tool.
What you should know: The implant retries the C2 ten times at one-second intervals, then checks in once every hour, and supports WSS/WS, TLS and SNI - so blocking a single protocol or a short-lived connection won't reliably cut it off. Talos tied five hosts to one hardcoded self-signed certificate, giving defenders a concrete pivot for hunting.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2021-4034
- Related
- CVE-2021-4034: Red Hat Polkit Out-of-Bounds Read and Write Vulnerability Known Exploited Vulnerabilities · Jun 27, 2022New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026