DEV Community

Anoymask
Anoymask

Posted on

KREMLIN: Forging Chromium Integrity Checks to Steal Banking Sessions

#security #threatintel

1. Basic Information

2. Executive Summary

Targeting banking users in Brazil, KREMLIN combines a JavaScript loader, Ethereum smart contracts that provide payload and configuration locations, and modification of Chromium Secure Preferences to load malicious extensions without user approval.

3. Attack Flow

Flow 1: Forced extension registration via JavaScript loader

  1. A user opens a JavaScript file disguised as a bank receipt, invoice, or payment record.
  2. The loader displays a fake error message and checks if it is running in an analysis environment. If those checks pass, it downloads Node.js. The next stage creates a scheduled task for persistence.
  3. It uses an Ethereum smart contract as a dead-drop resolver to retrieve additional payloads and extension distribution locations.
  4. It waits for a time when the user is inactive, closes Chrome or Edge if necessary, and copies the extension into the profile.
  5. It retrieves existing OSCrypt and App-Bound keys, then regenerates the HMACs and encrypted hashes corresponding to the modified Secure Preferences. This allows it to bypass browser integrity checks and load the malicious extension.
  6. The AVSync extension collects cookies, sessions, input, screens, and HTTP traffic, and receives commands via WebSocket.

4. Attacker Positioning and Execution Location

  • Initially outside the user's endpoint as a distributor of files disguised as banking documents.
  • After infection, the attackers use Ethereum, payload distribution sites, the Internet Archive, and WebSocket command and control (C2), and interfere with authenticated sessions through extensions running inside the browser.

5. Victim and Administrator Perspective

Victim

  • Fake errors or sudden browser closures and restarts may be visible. Extensions appear to be legitimately registered even without user approval.

Administrator

  • Observable indicators include JavaScript execution leading to Node.js, scheduled tasks, browser profile modifications, developer mode, Secure Preferences diffs, and anomalous extension IDs.

6. Success and Failure Conditions

Success Conditions

  • The user must be able to run the malicious JavaScript file on the endpoint.
  • Later stages require Node.js execution, scheduled task creation, and access to the required payload distribution sites and Ethereum RPC endpoints.
  • Browser profiles and integrity information must be modified, and the browser must be restarted.

Failure Conditions

  • Inference: If script execution controls or similar mechanisms block the initial JavaScript execution, initial execution of this infection vector can be prevented.
  • Inference: If controls can actually block unauthorized writes to profiles or extension loading, this registration stage can be disrupted. Detection via integrity monitoring alone does not mean prevention.
  • Inference: Blocking required distribution points or C2 communication at that stage can hinder subsequent processing or remote control. Communication blocking alone does not remove existing infections.

7. Impact of Success

  • Bank credentials, cookies, sessions, form inputs, and HTTP bodies/headers can be stolen.
  • Authenticated actions or transfer screens can be modified via HTML injection or clickjacking.
  • May lead to remote endpoint control via REMCOS or PULSAR.

8. Observable Logs

Email

  • Inference: Check for .js attachments or download URLs disguised as invoices, receipts, or payment records.

Proxy / SWG / DNS

  • Inference: Check for Ethereum RPC, Internet Archive, reported distribution and C2 domains, extension ZIP downloads, and WebSocket connections.

Endpoint / EDR

  • Inference: Check for Node.js, scheduled tasks, browser termination, and profile/Secure Preferences modifications initiated by wscript/cscript or JavaScript.

Identity / IdP

  • Inference: Check for access from new IPs or devices using stolen cookies or sessions.

SaaS / Cloud

  • Inference: Review available banking and SaaS audit logs for unusual operations and session reuse. Investigate altered click targets or form submission destinations using browser evidence where available; standard audit logs may not capture those changes.

Network

  • Inference: Correlate WebSocket C2, smart contract references, and subsequent communications after JPEG retrieval on the same endpoint.

9. Attack Success Determination

Internal Determination Criteria

  • Confirm Initial Execution: Criteria: Use endpoint execution records to confirm that the JavaScript loader ran. Correlate subsequent Node.js execution and scheduled task creation to establish how far the chain progressed.
  • Confirm Malware Execution or Authentication Success: Criteria: Verify extensions added to Secure Preferences, running AVSync code, and WebSocket traffic.
  • Confirm Information Theft or Session Compromise: Criteria: Substantiate collection and exfiltration of cookies, browser storage, forms, and HTTP data, or unauthorized session use.

10. Investigation Playbook

Trigger

  • Inference: Triggered by JavaScript execution disguised as banking documents, unauthorized extensions, or suspicious modifications to Secure Preferences.

Initial Triage

  • Inference: Check files opened by the user, Chrome/Edge profiles, and the installation/execution time of Node.js.

Endpoints and Servers

  • Inference: Examine the chronological sequence from JavaScript executing Node.js, scheduled tasks, and browser termination, to acquiring existing keys and modifying Secure Preferences.

Authentication and Cloud

  • Inference: Check banking and business services used in the target browser for session reuse or unauthorized operations.

Subsequent Operations

  • Inference: Investigate extension execution and external exfiltration; substantiate the execution of additional payloads such as REMCOS or PULSAR with separate evidence.

Containment

  • Inference: Isolate the endpoint to preserve profiles and execution logs, remove the loader, persistence, and malicious extensions, and revoke exposed sessions.

Determination Categories

  • Inference: Separate requests to the canary domain, extension execution, information theft, and subsequent operations. Do not assume remediation is complete simply because communication has stopped.

11. Defense and Detection Ideas

Single Event

  • Inference: Detect Secure Preferences modifications and unauthorized extension directory creation immediately after Chrome/Edge closes.

Time-Series Correlation

  • Inference: Correlate the sequence of JavaScript execution, Node.js retrieval, scheduled tasks, forced browser termination, profile modification, and WebSocket activity.

Threat Hunting

  • Inference: Cross-search for extension IDs, mutexes, customer IDs, reported IOCs, developer mode, and App-Bound key acquisition artifacts.

Log Gaps

  • Inference: HTTP bodies inside browsers and extension behavior may not be visible in standard EDR or proxy logs alone.

Prioritized Countermeasures

  • Inference: Prioritize script controls, extension allowlisting, browser profile monitoring, and session re-authentication and revocation.

12. Facts / Inference / Hypothesis

Facts

  • Elastic tracked the malware operation designated REF9334 for 15 months starting May 2025 and analyzed seven campaigns impersonating 12 Brazilian banks and payment services. The 1,515 figure is not the total victim count across the entire period, but rather the observed count at the time of writing of infected endpoints that contacted the canary domain registered by researchers.
  • The entry point is JavaScript disguised as invoices, receipts, or payment records, which retrieves Node.js and establishes persistence via scheduled tasks.
  • KREMLIN retrieves the location of additional payloads from Ethereum smart contracts and also uses payloads hidden inside JPEGs on the Internet Archive.
  • It acquires existing encryption keys for Chrome and Edge, edits Secure Preferences, and then regenerates the HMACs and encrypted hashes required for integrity checks.
  • The extension disguised as AVSync collects cookies, browser storage, form inputs, screens, page sources, tabs, history, and HTTP bodies/headers, implementing HTML injection, clickjacking, and WebSocket C2.
  • Elastic temporarily disrupted the campaign by registering a previously unregistered domain used in a network canary check. A successful HTTP response from that domain caused the malware to deliberately crash. This disruption did not remove the malware from infected endpoints. Elastic also documented infrastructure updates and delivery of REMCOS or PULSAR.

Inference

  • Correlating the appearance of extensions in Secure Preferences without Chrome Web Store installation records with the moments immediately before and after browser termination/restart can improve detection accuracy.

Hypothesis

No additional hypotheses. Unverified items are listed in "Unknowns and Further Investigation".

13. MITRE ATT&CK Mapping

  • T1204.002 User Execution: Malicious File (Confidence: High): Induces users to open JavaScript disguised as banking documents.
  • T1053.005 Scheduled Task/Job: Scheduled Task (Confidence: High): Establishes persistence via scheduled tasks.
  • T1102 Web Service (Confidence: High): Uses Ethereum and the Internet Archive for configuration and distribution.
  • T1176.001 Software Extensions: Browser Extensions (Confidence: High): Force-registers malicious extensions into Chrome/Edge.
  • T1539 Steal Web Session Cookie (Confidence: High): Acquires cookies and session tokens.
  • T1056.001 Input Capture: Keylogging (Confidence: High): Records form inputs.

14. Unknowns and Further Investigation

  • The complete delivery paths by which the initial JavaScript files reached each victim.
  • Which capabilities were executed on the 1,515 observed endpoints and what data was actually stolen.
  • Changes in attack infrastructure and distribution paths after temporary disruption, and the recovery status of infected endpoints.

15. Impact on SOCs and Organizations

Although the primary targets are in Brazil, the techniques are also applicable to organizations using Edge and Chrome globally. Monitoring should cover extension inventories, Secure Preferences changes, App-Bound key recovery, forced browser termination, Node.js activity, and outbound connections to Ethereum RPC endpoints and the Internet Archive.

16. Summary by Role

  • SOC: Track JavaScript, Node.js, scheduled tasks, browser termination, Secure Preferences modifications, malicious extensions, and WebSocket communications as a unified chain of behavior.
  • Administrators: Enforce allowed extensions via policy, and restrict unmanaged Node.js execution, script attachments, and browser profile modifications.
  • Users: Avoid opening JavaScript files disguised as invoices or receipts, and report unexpected browser closures or newly added extensions.

Top comments (0)