Cybersecurity researchers have uncovered a new post-exploitation red team tool called Splinter in the wild. Palo Alto Networks Unit 42 shared its findings after discovering the program on several customers’ systems.
“It has a standard set of features commonly found in penetration testing tools and its developer created it using the Rust programming language,” said Unit 42’s Dominik Reichel. “While Splinter is not as advanced as other well-known post-exploitation tools like Cobalt Strike, it still presents a potential threat to organizations if it is misused.”
Penetration testing tools are often used for red team operations to identify security issues in a company’s network. However, these tools can also be weaponized by threat actors for malicious purposes.
Unit 42 has not detected any threat actor activity associated with the Splinter tool set. The tool’s artifacts are notably large, around 7 MB, due to the presence of 61 Rust crates within it.
Splinter functions similarly to other post-exploitation frameworks, with a task-based model controlled by a command-and-control (C2) server. Some of its capabilities include executing Windows commands, remote process injection, file uploads and downloads, collecting cloud service account information, and self-deletion from the system.
The cybersecurity firm Deep Instinct also detailed two attack methods involving stealthy code injection and privilege escalation using Microsoft Office and a malicious shim.
As new techniques and tools emerge in the cybersecurity landscape, staying up to date on prevention and detection capabilities is crucial to combat evolving threats. Researchers continue to uncover innovative methods used by threat actors to exploit vulnerabilities in systems.
For more exclusive content on cybersecurity, follow us on Twitter and LinkedIn.