Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Curious Serpens’ False Font Backdoor: Technical Analysis, Detection and Prevention

Summary: Unit 42 analyzed FalseFont, an ASP.NET Core backdoor attributed to the suspected Iranian-affiliated espionage group Curious Serpens (also tracked as Peach Sandstorm, APT33 and other names), which disguises itself as a job application GUI for a U.S.-based aerospace company and ships as a 182 MB native executable. The malware sends entered credentials as JSON over HTTP POST to a C2 server at 64.52.80[.]30 on TCP port 8080, drops three copies of itself, establishes persistence through the registry CurrentVersion\Run key, and accepts commands via a polling URI and a SignalR client that supports command execution, file upload and download, directory listing, screenshot capture and browser credential theft.

Bottom line: A group active since at least 2013 is using a fake recruitment portal aimed specifically at aerospace and defense job applicants, so a single employee entering credentials on what looks like a careers page hands over both their login and a persistent backdoor with screenshot and file-exfiltration capability.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Threat Actors & Nation-State
Related