ITSEC Newsletter 2024-12-05

Since at least June 29, 2024, cybercriminals have been taking advantage of Godot Engine to execute crafted GDScript code which triggers malicious commands and delivers malware. This technique has remained undetected by most Antivirus tools on VirusTotal, possibly infecting more than 17,000 machines in just a few months. The loader using this novel technique, GodLoader, has been distributed throughout September and October via the Stargazers Ghost Network. This network operates as a Distribution as a Service (DaaS), enabling the “legitimate” distribution of malware through GitHub repositories.

Mandiant’s Red Team developed a novel solution to this problem. Instead of returning the C2 data in the HTTP request headers or body, the C2 server returns a valid web page that visually shows a QR code. The implant then uses a local headless browser (e.g., using Selenium) to render the page, grabs a screenshot, and reads the QR code to retrieve the embedded data. By taking advantage of machine-readable QR codes, an attacker can send data from the attacker-controlled server to a malicious implant even when the web page is rendered in a remote browser.