Chapter 5 · Attacks & Defenses·Advanced·~16 min

Malware

Packers and unpacking workflows, the ransomware-as-a-service economy, kernel rootkits, EDR evasion techniques, and how supply-chain malware actually lands.

You will learn

  • Static vs dynamic unpacking, and why most modern samples are packed
  • The RaaS affiliate model and how ransom payments are split
  • Kernel-mode rootkits: DKOM, hypervisor rootkits, Secure Boot bypasses
  • EDR evasion: AMSI bypass, syscall direct invocation, BYOVD
  • Supply-chain compromises: SolarWinds, 3CX, XZ Utils backdoor

Packers and unpacking

A packer compresses or encrypts a payload and prepends a stub that restores it at runtime. Original purposes were legitimate (UPX for size reduction). Today, packing is the default for commodity malware because it defeats simple hash-based detection and bloats the analyst's workload.

Two unpacking strategies:

  • Static unpacking: read the stub, reverse the unpack routine in IDA or Ghidra, dump the inner PE. Fast and reliable for known packers; useless for custom ones.
  • Dynamic unpacking: run the sample in a sandbox, set memory breakpoints on RWX pages, dump when execution transfers to the unpacked region. Catches anything but pays the cost of sandbox detection.

Modern crypters chain packers (UPX wrapping a custom crypter wrapping a Themida layer). Each layer is independent code; analysts dump after each transfer.

Ransomware-as-a-service

The professionalization of ransomware turned it into a franchise. The operator (LockBit, BlackCat, Akira) maintains the encryptor, the leak site, and the negotiation portal. Affiliates do the intrusion and pay 20-30% of revenue.

Typical kill chain:

  1. Initial access broker sells a foothold (often a Citrix or Ivanti exploit, or stolen creds) for a few hundred to a few thousand dollars.
  2. Affiliate buys access, escalates via misconfigured AD or unpatched DC.
  3. Cobalt Strike or Brute Ratel beacon for hands-on-keyboard movement.
  4. Exfil to mega.nz or rclone-to-S3 (double extortion).
  5. Domain-wide encryption, usually on a Friday night for maximum response delay.
  6. Negotiation portal opens; ransom in Bitcoin or Monero.

The economic moat: leak sites force payment even when backups are clean. The defensive moat: immutable, off-network backups and tested restore procedures, plus rapid detection of the precursor tools (Cobalt Strike, AnyDesk being installed where it should not be).

Kernel rootkits

Once an attacker has kernel code execution, defense is largely lost. Techniques:

  • DKOM (Direct Kernel Object Manipulation): unlink a process from the active process list so Task Manager and most EDR products miss it.
  • SSDT hooking (legacy Windows): replace function pointers in the System Service Descriptor Table to intercept syscalls. PatchGuard kills this on x64; attackers use other techniques.
  • Hypervisor rootkits: install a thin VMM under the OS so the OS itself becomes the guest. Detection requires hardware-level introspection.
  • Secure Boot bypass: BlackLotus (2023) demonstrated a UEFI bootkit that loads before Windows kernel checks, surviving OS reinstalls.

Modern Windows defenses: HVCI (Hypervisor-protected Code Integrity), kernel CET shadow stacks, and signed-driver enforcement. Most of which can be defeated by bringing your own vulnerable driver.

EDR evasion

EDR works by hooking user-mode functions (ntdll wrappers around syscalls) and inspecting telemetry. Three popular bypass families:

  • AMSI bypass: patch the AmsiScanBuffer return value in memory before running PowerShell payloads. Trivially detected if telemetry catches the patch, but still common.
  • Direct syscalls: skip ntdll entirely. Tools like SysWhispers generate stubs that invoke syscalls directly with the right number for the target Windows build. The EDR sees no ntdll hook fire.
  • BYOVD (Bring Your Own Vulnerable Driver): install a signed but vulnerable driver (often graphics or anti-cheat) and use it to disable EDR kernel callbacks. Microsoft publishes a driver blocklist, but the list lags.

Counter-counter: kernel-callback-based EDR (cannot be unhooked from user mode), ETW-TI telemetry, and behavioral models that ignore the hooks and look at outcomes.

Supply chain

The watershed cases:

  • SolarWinds Sunburst (2020): SVR (APT29) compromised the Orion build system, injected a backdoor into a signed update, distributed to ~18,000 customers. Selective exploitation followed.
  • 3CX (2023): a North Korean group compromised the desk-phone software's build, signed the trojanized installer with the legitimate cert. Cascading: it was itself reached via a prior supply-chain compromise of X_TRADER.
  • XZ Utils (2024): "Jia Tan" spent two years gaining maintainer trust on the xz compression library, then merged a sshd backdoor that only triggered on certain CPU features. Caught by a Postgres dev investigating slow logins. Came within days of shipping in stable Debian.

Defense at the consumer end is hard: you cannot meaningfully audit every dependency. The realistic posture is SBOM tracking, network egress rules that catch outbound C2 from build hosts, and reproducible builds so any unexpected binary divergence is detectable.

Detection engineering

Modern blue-team work centers on detection-as-code: Sigma rules, Splunk searches, KQL queries kept in version control with tests. Two principles:

  • Detect behaviors, not indicators: hash-based IOCs rot in hours. Behavior rules (lsass dump via comsvcs.dll, scheduled-task persistence creating an LNK in Startup) last for years.
  • Tune for the environment: a generic Sigma rule fires constantly in any real network. Detections need exclusions for known-good admin tools, but exclusions must themselves be auditable.

MITRE ATT&CK is the lingua franca; map every detection to a technique ID so coverage gaps are visible.

Take the quizBack to intermediate