Cybersecurity researchers have uncovered a new post-exploitation red team tool known as Splinter in recent findings. Palo Alto Networks Unit 42 shared their discovery after detecting the program on multiple customers’ systems.
According to Unit 42’s Dominik Reichel, Splinter, developed using the Rust programming language, possesses standard features commonly found in penetration testing tools. While not as advanced as other well-known post-exploitation tools like Cobalt Strike, Splinter still poses a potential threat if misused.
Penetration testing tools are typically utilized for red team operations to identify security vulnerabilities within a company’s network. However, these adversary simulation tools can also be weaponized by threat actors for malicious purposes.
Unit 42 has not observed any threat actor activity associated with Splinter at this time. The tool’s artifacts indicate its large size, around 7 MB, due to the inclusion of 61 Rust crates. Splinter operates similarly to other post-exploitation frameworks, utilizing a task-based model controlled by a command-and-control server defined by the attacker.
Functions of Splinter include executing Windows commands, remote process injection, file uploads and downloads, cloud service account information collection, and self-deletion from the system. Reichel emphasized the importance of staying updated on prevention and detection capabilities to combat evolving criminal techniques.
In related news, Deep Instinct detailed two attack methods involving stealthy code injection and privilege escalation through leveraging an RPC interface in Microsoft Office and a malicious shim, respectively.
Check Point also highlighted a new process injection technique called Thread Name-Calling, allowing the implantation of shellcode into a running process while bypassing endpoint protection products.
As new threats continue to emerge, it is crucial for organizations to remain vigilant and proactive in their cybersecurity measures.